curl -fsSL https://get.docker.com | sh
docker --version && docker compose version

docker volume create portainer_data

docker run -d \
  --name portainer \
  --restart unless-stopped \
  -p 9443:9443 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data \
  portainer/portainer-ce:latest

# Primary server
dns.yourdomain.com          A      YOUR_PRIMARY_SERVER_IP    Proxy: OFF
*.dns.yourdomain.com        CNAME  dns.yourdomain.com        Proxy: OFF

# Per-node admin access (used by scripts to identify each node)
node1.dns.yourdomain.com    A      YOUR_PRIMARY_SERVER_IP    Proxy: OFF (or via Tunnel)
node2.dns.yourdomain.com    A      YOUR_SECONDARY_SERVER_IP  Proxy: OFF (or via Tunnel)

# Secondary server (optional)
dns2.yourdomain.com         A      YOUR_SECONDARY_SERVER_IP  Proxy: OFF
*.dns2.yourdomain.com       CNAME  dns2.yourdomain.com       Proxy: OFF

version: "3.8"

services:
  adguardhome:
    image: adguard/adguardhome:latest
    container_name: adguardhome
    restart: unless-stopped
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "443:443/tcp"
      - "443:443/udp"
      - "853:853/tcp"
      - "853:853/udp"
      - "80:80/tcp"
    volumes:
      - ./conf:/opt/adguardhome/conf
      - ./work:/opt/adguardhome/work
      - /etc/letsencrypt:/etc/letsencrypt:ro  # cert access
    networks:
      adguard_net:
        ipv4_address: 172.34.0.100

networks:
  adguard_net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.34.0.0/16

docker compose up -d
docker logs adguardhome --tail 20

apt install certbot python3-certbot-dns-cloudflare -y

mkdir -p ~/.secrets
cat > ~/.secrets/cloudflare.ini << EOF
dns_cloudflare_api_token = YOUR_CLOUDFLARE_API_TOKEN_HERE
EOF
chmod 600 ~/.secrets/cloudflare.ini

# Wildcard only — do NOT add the bare domain
certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials ~/.secrets/cloudflare.ini \
  -d "*.dns.yourdomain.com"

tls:
  enabled: true
  server_name: dns.yourdomain.com
  strict_sni_check: true
  force_https: true
  port_https: 443
  port_dns_over_tls: 853
  port_dns_over_quic: 0

docker restart adguardhome

# Read and base64-encode the certificate and key
CERT_B64=$(base64 -w 0 /etc/letsencrypt/live/dns.yourdomain.com/fullchain.pem)
KEY_B64=$(base64 -w 0 /etc/letsencrypt/live/dns.yourdomain.com/privkey.pem)

# Build the JSON payload
PAYLOAD=$(jq -n \
  --arg sname "dns.yourdomain.com" \
  --arg cert "$CERT_B64" \
  --arg key "$KEY_B64" \
  '{
    "enabled": true,
    "server_name": $sname,
    "force_https": true,
    "port_https": 443,
    "port_dns_over_tls": 853,
    "certificate_chain": $cert,
    "private_key": $key,
    "strict_sni_check": true
  }')

# Send to AdGuard — replace admin:password and hostname
curl -s -u "admin:YOUR_ADGUARD_PASSWORD" \
  -X POST "https://node1.dns.yourdomain.com/control/tls/configure" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD" \
  -w "\nHTTP Status: %{http_code}\n"

# Variables
PORTAINER_URL="https://node1.dns.yourdomain.com:9443"   # or your Portainer URL
PORTAINER_TOKEN="YOUR_PORTAINER_API_TOKEN"
PORTAINER_ENV_ID=1          # Environment ID — check in Portainer UI
CONTAINER_NAME="adguardhome"

# Step 1: Look up the container ID by name
CONTAINER_ID=$(curl -s \
  -H "X-API-Key: $PORTAINER_TOKEN" \
  "$PORTAINER_URL/api/endpoints/$PORTAINER_ENV_ID/docker/containers/json?all=true" \
  | jq -r ".[] | select(.Names[] | contains(\"$CONTAINER_NAME\")) | .Id")

echo "Container ID: ${CONTAINER_ID:0:12}"

# Step 2: Restart the container
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
  -X POST \
  -H "X-API-Key: $PORTAINER_TOKEN" \
  "$PORTAINER_URL/api/endpoints/$PORTAINER_ENV_ID/docker/containers/$CONTAINER_ID/restart")

echo "Restart HTTP status: $HTTP_STATUS"
# 204 = success

dns:
  upstream_dns:
    - tls://your-gateway-id.cloudflare-gateway.com
    - https://your-gateway-id.cloudflare-gateway.com/dns-query
  bootstrap_dns:
    - 172.64.36.1    # Cloudflare anycast infrastructure — not the public 1.1.1.1
    - 172.64.36.2
  fallback_dns:
    - 172.64.36.1
    - 172.64.36.2
  upstream_mode: load_balance
  cache_enabled: true
  cache_size: 4194304
  enable_dnssec: true
  refuse_any: true
  ratelimit: 100

dns:
  allowed_clients:
    - 127.0.0.1
    - 172.16.0.0/11       # All Docker bridge networks (172.16.x.x–172.47.x.x)
    - device1             # Named client aliases matching your client entries
    - device2
    - device3
  disallowed_clients: []

function Test-AdGuardDoT {
    param(
        [Parameter(Mandatory)][string]$Server,
        [Parameter(Mandatory)][string]$SNI,
        [string]$Query   = "google.com",
        [int]$Port       = 853,
        [int]$Timeout    = 5000
    )

    function Build-DnsQuery {
        param([string]$Domain)
        $labels = $Domain.Split('.')
        $qname  = @()
        foreach ($label in $labels) {
            $bytes  = [System.Text.Encoding]::ASCII.GetBytes($label)
            $qname += [byte]$bytes.Length
            $qname += $bytes
        }
        $qname += [byte]0x00
        $header = [byte[]]@(0xAB,0xCD, 0x01,0x00, 0x00,0x01, 0x00,0x00, 0x00,0x00, 0x00,0x00)
        return $header + $qname + [byte[]]@(0x00,0x01) + [byte[]]@(0x00,0x01)
    }

    $tcp    = $null
    $ssl    = $null
    $result = [PSCustomObject]@{
        Server   = $Server
        Port     = $Port
        SNI      = $SNI
        Query    = $Query
        Status   = "BLOCKED"
        RCODE    = -1
        Answers  = 0
        ErrorMsg = $null
    }

    try {
        $tcp = [System.Net.Sockets.TcpClient]::new($Server, $Port)
        $tcp.ReceiveTimeout = $Timeout
        $tcp.SendTimeout    = $Timeout

        # Accept any certificate — we are testing DoT SNI enforcement,
        # not validating the certificate chain here
        $ssl = [System.Net.Security.SslStream]::new($tcp.GetStream(), $false, { $true })
        $ssl.AuthenticateAsClient($SNI)

        $dnsQuery       = Build-DnsQuery -Domain $Query
        [int]$length    = $dnsQuery.Length
        [byte]$highByte = [math]::Floor($length / 256)
        [byte]$lowByte  = $length % 256
        $fullQuery      = [byte[]]@($highByte, $lowByte) + $dnsQuery

        $ssl.Write($fullQuery, 0, $fullQuery.Length)
        $ssl.Flush()

        $lenBuf = [byte[]]::new(2)
        $ssl.Read($lenBuf, 0, 2) | Out-Null
        [int]$responseLen = $lenBuf[0] * 256 + $lenBuf[1]

        $response = [byte[]]::new($responseLen)
        $ssl.Read($response, 0, $responseLen) | Out-Null

        # Extract RCODE (lower 4 bits of byte 3) and answer count
        [int]$rcode   = $response[3] % 16
        [int]$answers = $response[6] * 256 + $response[7]

        $result.RCODE   = $rcode
        $result.Answers = $answers
        # RCODE 5 = REFUSED — AdGuard's response for unauthorized clients
        $result.Status  = if ($rcode -eq 5) { "BLOCKED" } else { "ALLOWED" }

    } catch {
        $raw             = $_.Exception.Message -replace "`r","" -replace "`n"," " -replace "\s+"," "
        $result.ErrorMsg = if ($raw.Length -gt 30) { $raw.Substring(0,30).TrimEnd() + "..." } else { $raw }
        # TLS failure = blocked at handshake (strict SNI enforcement working)
        $result.Status   = "BLOCKED"
    } finally {
        if ($ssl) { try { $ssl.Close() } catch {} }
        if ($tcp) { try { $tcp.Close() } catch {} }
    }

    return $result
}

function Write-TableRow {
    param(
        [string]$Name, [string]$SNI, [string]$Expected,
        [string]$Got, [string]$Badge, [string]$Detail,
        [string]$BadgeColor, [string]$ExpColor, [string]$GotColor
    )
    Write-Host ("{0,-14} " -f $Name)          -NoNewline -ForegroundColor White
    Write-Host ("{0,-42} " -f $SNI)           -NoNewline -ForegroundColor DarkGray
    Write-Host ("Exp: {0,-7} " -f $Expected)  -NoNewline -ForegroundColor $ExpColor
    Write-Host ("Got: {0,-7} " -f $Got)       -NoNewline -ForegroundColor $GotColor
    Write-Host (" [{0}] "    -f $Badge)       -NoNewline -ForegroundColor $BadgeColor
    Write-Host $Detail                                    -ForegroundColor DarkGray
}

function Invoke-AdGuardTest {
    param(
        [Parameter(Mandatory)][string]$Server,
        [int]$Port     = 853,
        [string]$Query = "google.com",
        [array]$Clients
    )

    $divider = "-" * 100

    Write-Host ""
    Write-Host "  AdGuard Home - DoT Client Access Test" -ForegroundColor Cyan
    Write-Host "  Server  :  $Server : $Port"           -ForegroundColor DarkCyan
    Write-Host "  Query   :  $Query"                    -ForegroundColor DarkCyan
    Write-Host ""
    Write-Host $divider -ForegroundColor DarkGray
    Write-Host ("{0,-14} {1,-42} {2,-12} {3,-12} {4,-8} {5}" -f `
        "  Client", "SNI", "Expected", "Got", "Result", "Detail") -ForegroundColor DarkCyan
    Write-Host $divider -ForegroundColor DarkGray

    $passed = 0; $failed = 0

    foreach ($client in $Clients) {
        $res   = Test-AdGuardDoT -Server $Server -Port $Port -SNI $client.SNI -Query $Query
        $match = $res.Status -eq $client.Expected

        $badge      = if ($match) { "PASS" } else { "FAIL" }
        $badgeColor = if ($match) { "Green" } else { "Red" }
        $expColor   = if ($client.Expected -eq "ALLOWED") { "Green" } else { "Red" }
        $gotColor   = if ($res.Status      -eq "ALLOWED") { "Green" } else { "Red" }
        $detail     = if ($res.ErrorMsg)       { "TLS-ERR: $($res.ErrorMsg)" } `
                      elseif ($res.RCODE -ge 0) { "rcode=$($res.RCODE)  ans=$($res.Answers)" } `
                      else { "" }

        if ($match) { $passed++ } else { $failed++ }

        Write-TableRow -Name $client.Name -SNI $client.SNI `
            -Expected $client.Expected -Got $res.Status `
            -Badge $badge -Detail $detail `
            -BadgeColor $badgeColor -ExpColor $expColor -GotColor $gotColor
    }

    Write-Host $divider -ForegroundColor DarkGray
    Write-Host ""
    Write-Host "  Results :  " -NoNewline -ForegroundColor White
    Write-Host "$passed passed" -NoNewline -ForegroundColor Green
    Write-Host "  |  "         -NoNewline -ForegroundColor DarkGray
    Write-Host "$failed failed" -ForegroundColor $(if ($failed -gt 0) { "Red" } else { "Green" })
    Write-Host ""
}

# ── CONFIGURE YOUR CLIENTS BELOW ─────────────────────────────────────────────
# Add one entry per registered device. Set Expected to ALLOWED or BLOCKED.
# For blocked tests: use the bare domain, an unregistered alias, or a fake domain.

$clients = @(
    [PSCustomObject]@{ Name = "phone";      SNI = "phone.dns.yourdomain.com";   Expected = "ALLOWED" },
    [PSCustomObject]@{ Name = "laptop";     SNI = "laptop.dns.yourdomain.com";  Expected = "ALLOWED" },
    [PSCustomObject]@{ Name = "tv";         SNI = "tv.dns.yourdomain.com";       Expected = "ALLOWED" },
    [PSCustomObject]@{ Name = "tablet";     SNI = "tablet.dns.yourdomain.com";   Expected = "ALLOWED" },
    [PSCustomObject]@{ Name = "kids";       SNI = "kids.dns.yourdomain.com";     Expected = "ALLOWED" },
    [PSCustomObject]@{ Name = "bare domain";SNI = "dns.yourdomain.com";          Expected = "BLOCKED" },
    [PSCustomObject]@{ Name = "unknown";    SNI = "unknown.dns.yourdomain.com";  Expected = "BLOCKED" },
    [PSCustomObject]@{ Name = "fake";       SNI = "fake.com";                    Expected = "BLOCKED" }
)

# ── RUN AGAINST YOUR NODES — replace with your actual server IPs ──────────────
Invoke-AdGuardTest -Server "YOUR_PRIMARY_SERVER_IP"   -Port 853 -Query "google.com" -Clients $clients
Invoke-AdGuardTest -Server "YOUR_SECONDARY_SERVER_IP" -Port 853 -Query "google.com" -Clients $clients

#!/bin/bash
# ────────────────────────────────────────────────────────────────────────────
# agh-cert-renew.sh
# Checks certificate expiry on each AdGuard node, pushes renewed cert via
# the AdGuard TLS API, and restarts the container via Portainer API.
#
# Usage:
#   sudo ./agh-cert-renew.sh            # Update only if expiry <= DAYS_THRESHOLD
#   sudo ./agh-cert-renew.sh --force    # Force update regardless of expiry
#
# Requirements:  jq, curl, openssl, root privileges
# ────────────────────────────────────────────────────────────────────────────

# ── CONFIGURATION ────────────────────────────────────────────────────────────
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ENC_FILE="$SCRIPT_DIR/cred.base64"        # Credential file (see format below)
LOG_FILE="/var/log/agh_ssl_update.log"

# Local certificate path — where certbot stores the renewed certificate
CERT_BASE_DIR="/etc/letsencrypt/live"
DOMAIN_PATTERN="dns.yourdomain.com"       # Must match your certbot domain name
SERVER_NAME="dns.yourdomain.com"          # AdGuard server_name in TLS config

DAYS_THRESHOLD=7                          # Renew if expiry is within this many days

# Portainer endpoints — one per node
# These are the URLs of your Portainer instances, accessible from this server
PORTAINER_NODE1_URL="https://node1.dns.yourdomain.com:9443"
PORTAINER_NODE2_URL="https://node2.dns.yourdomain.com:9443"

# Portainer environment IDs (find in Portainer UI: Environments menu, numeric ID in URL)
PORTAINER_NODE1_ENV=1
PORTAINER_NODE2_ENV=1

CONTAINER_NAME="adguardhome"

# AdGuard node hostnames — used to check live cert expiry and push the update
# These must be reachable over HTTPS from this server
HOSTS=(
    "node1.dns.yourdomain.com"
    "node2.dns.yourdomain.com"
)

# ── SETUP ─────────────────────────────────────────────────────────────────────
# Create log symlink in script directory for convenience
SYMLINK_PATH="$SCRIPT_DIR/agh_ssl_update.log"
if [[ ! -L "$SYMLINK_PATH" ]]; then
    touch "$LOG_FILE"
    ln -s "$LOG_FILE" "$SYMLINK_PATH"
fi

# Parse --force flag
FORCE_UPDATE=0
for arg in "$@"; do
    [[ "$arg" == "--force" || "$arg" == "-f" ]] && FORCE_UPDATE=1
done

# Must run as root (required to read /etc/letsencrypt/live/)
if [[ $EUID -ne 0 ]]; then
    echo "This script must be run as root (use sudo)."
    exit 1
fi

# Check dependency
if ! command -v jq &> /dev/null; then
    echo "ERROR: 'jq' is missing. Install with: apt-get install jq"
    exit 1
fi

log_message() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# ── CREDENTIAL FILE FORMAT ────────────────────────────────────────────────────
# File: cred.base64 (in same directory as this script)
# Each Portainer token is stored base64-encoded for basic obfuscation.
# To encode a token:  printf "your-token-here" | base64
#
# File contents:
#   NODE1_TOKEN=
#   NODE2_TOKEN=
#   AGH_CREDS=admin:your-adguard-password
#
# AGH_CREDS is used for HTTP Basic Auth against the AdGuard API.
# ─────────────────────────────────────────────────────────────────────────────

if [[ ! -f "$ENC_FILE" ]]; then
    log_message "ERROR: Credential file $ENC_FILE not found."
    exit 1
fi

# Source the credential file and decode tokens
source "$ENC_FILE"
NODE1_TOKEN=$(printf "%s" "$NODE1_TOKEN" | base64 -d 2>/dev/null)
NODE2_TOKEN=$(printf "%s" "$NODE2_TOKEN" | base64 -d 2>/dev/null)

if [[ -z "$AGH_CREDS" || -z "$NODE1_TOKEN" || -z "$NODE2_TOKEN" ]]; then
    log_message "ERROR: Missing credentials. Required: AGH_CREDS, NODE1_TOKEN, NODE2_TOKEN"
    exit 1
fi

# ── PORTAINER RESTART FUNCTION ────────────────────────────────────────────────
# Looks up the AdGuard container ID by name and triggers a restart via
# the Portainer Docker proxy API.
portainer_restart() {
    local host="$1"
    local portainer_url portainer_token portainer_env

    # Select credentials based on which host we are restarting
    if [[ "$host" == "node1.dns.yourdomain.com" ]]; then
        portainer_url="$PORTAINER_NODE1_URL"
        portainer_token="$NODE1_TOKEN"
        portainer_env="$PORTAINER_NODE1_ENV"
    else
        portainer_url="$PORTAINER_NODE2_URL"
        portainer_token="$NODE2_TOKEN"
        portainer_env="$PORTAINER_NODE2_ENV"
    fi

    log_message "ACTION: Looking up container '$CONTAINER_NAME' on $portainer_url..."

    # Query Portainer's Docker proxy for a list of all containers,
    # then extract the ID of the one matching CONTAINER_NAME
    CONTAINER_ID=$(curl -s \
        -H "X-API-Key: $portainer_token" \
        "$portainer_url/api/endpoints/$portainer_env/docker/containers/json?all=true" \
        | jq -r ".[] | select(.Names[] | contains(\"$CONTAINER_NAME\")) | .Id")

    if [[ -z "$CONTAINER_ID" ]]; then
        log_message "ERROR: Container '$CONTAINER_NAME' not found on $portainer_url."
        return 1
    fi

    log_message "INFO: Container ID ${CONTAINER_ID:0:12} found."

    # Trigger a restart — Portainer proxies this to the Docker daemon
    # HTTP 204 = success (no content)
    HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
        -X POST \
        -H "X-API-Key: $portainer_token" \
        "$portainer_url/api/endpoints/$portainer_env/docker/containers/$CONTAINER_ID/restart")

    if [[ "$HTTP_STATUS" == "204" ]]; then
        log_message "SUCCESS: '$CONTAINER_NAME' restarted via Portainer on $host (HTTP 204)."
    else
        log_message "FAILURE: Portainer restart failed on $host (HTTP $HTTP_STATUS)."
        return 1
    fi
}

# ── FIND LATEST LOCAL CERTIFICATE ─────────────────────────────────────────────
LATEST_DIR=$(ls -d "${CERT_BASE_DIR}/${DOMAIN_PATTERN}"* 2>/dev/null | sort -V | tail -n 1)
if [[ -z "$LATEST_DIR" ]]; then
    log_message "ERROR: No certificate directory found matching '${DOMAIN_PATTERN}' in $CERT_BASE_DIR."
    exit 1
fi

CERT_FILE="$LATEST_DIR/fullchain.pem"
KEY_FILE="$LATEST_DIR/privkey.pem"
log_message "INFO: Using certificate from $LATEST_DIR"

# ── MAIN LOOP: CHECK AND UPDATE EACH NODE ─────────────────────────────────────
for HOST in "${HOSTS[@]}"; do
    log_message "--- Checking $HOST ---"

    # Connect to port 443 and read the live certificate's expiry date
    REMOTE_EXPIRY_DATE=$(echo | openssl s_client \
        -servername "$HOST" -connect "$HOST":443 2>/dev/null \
        | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)

    if [[ -z "$REMOTE_EXPIRY_DATE" ]]; then
        log_message "ERROR: Could not reach $HOST:443 to check certificate expiry."
        continue
    fi

    EXPIRY_EPOCH=$(date -d "$REMOTE_EXPIRY_DATE" +%s)
    NOW_EPOCH=$(date +%s)
    DIFF_DAYS=$(( (EXPIRY_EPOCH - NOW_EPOCH) / 86400 ))

    log_message "INFO: $HOST certificate expires in $DIFF_DAYS days ($REMOTE_EXPIRY_DATE)."

    # Update if within threshold OR if --force was passed
    if [[ "$DIFF_DAYS" -le "$DAYS_THRESHOLD" ]] || [[ "$FORCE_UPDATE" -eq 1 ]]; then

        if [[ "$FORCE_UPDATE" -eq 1 ]]; then
            log_message "ACTION: --force flag set. Pushing certificate to $HOST regardless of expiry."
        else
            log_message "ACTION: $DIFF_DAYS days until expiry — within threshold. Updating $HOST..."
        fi

        # Base64-encode certificate and key for the API payload
        CERT_B64=$(base64 -w 0 "$CERT_FILE")
        KEY_B64=$(base64 -w 0 "$KEY_FILE")

        # Build JSON payload for AdGuard TLS API
        # strict_sni_check: true — always enforce, even after cert update
        PAYLOAD=$(jq -n \
            --arg sname "$SERVER_NAME" \
            --arg cert "$CERT_B64" \
            --arg key "$KEY_B64" \
            '{
                "enabled": true,
                "server_name": $sname,
                "force_https": true,
                "port_https": 443,
                "port_dns_over_tls": 853,
                "certificate_chain": $cert,
                "private_key": $key,
                "strict_sni_check": true
            }')

        # Push to AdGuard TLS configuration API
        RESP_FILE=$(mktemp)
        HTTP_STATUS=$(curl -s -u "$AGH_CREDS" \
            -X POST "https://$HOST/control/tls/configure" \
            -H "Content-Type: application/json" \
            -d "$PAYLOAD" \
            -w "%{http_code}" -o "$RESP_FILE")
        RESPONSE_BODY=$(cat "$RESP_FILE")
        rm -f "$RESP_FILE"

        if [[ "$HTTP_STATUS" == "200" ]]; then
            log_message "SUCCESS: Certificate pushed to $HOST via AdGuard API (HTTP 200)."
            # Restart the container so the new certificate is loaded cleanly
            portainer_restart "$HOST"
        else
            log_message "FAILURE: AdGuard API update failed on $HOST (HTTP $HTTP_STATUS)."
            log_message "DETAIL: $RESPONSE_BODY"
        fi

    else
        log_message "INFO: $HOST is healthy ($DIFF_DAYS days remaining). No action needed."
    fi

done

log_message "--- Run complete ---"

# Encode each Portainer token — run this on your server for each token
printf "your-node1-portainer-api-token" | base64
# Output: eW91ci1ub2RlMS1wb3J0YWluZXItYXBpLXRva2Vu

printf "your-node2-portainer-api-token" | base64
# Output: eW91ci1ub2RlMi1wb3J0YWluZXItYXBpLXRva2Vu

# Then create the credential file
cat > /opt/adguard/cred.base64 << 'EOF'
NODE1_TOKEN=eW91ci1ub2RlMS1wb3J0YWluZXItYXBpLXRva2Vu
NODE2_TOKEN=eW91ci1ub2RlMi1wb3J0YWluZXItYXBpLXRva2Vu
AGH_CREDS=admin:your-adguard-admin-password
EOF

chmod 600 /opt/adguard/cred.base64

mkdir -p /opt/adguard
cp agh-cert-renew.sh /opt/adguard/
chmod +x /opt/adguard/agh-cert-renew.sh

# Test manually first
sudo /opt/adguard/agh-cert-renew.sh --force

# If successful, add to root crontab
crontab -e
# Add this line — runs at 3am daily:
0 3 * * * /opt/adguard/agh-cert-renew.sh >> /var/log/agh_ssl_update.log 2>&1

#!/bin/bash
# ────────────────────────────────────────────────────────────────────────────
# adguard-log-summary.sh
# Parses AdGuard Home container logs and prints a health summary.
# Usage:
#   ./adguard-log-summary.sh        # Last 24 hours
#   ./adguard-log-summary.sh 6      # Last 6 hours
# ────────────────────────────────────────────────────────────────────────────

CONTAINER="adguardhome"
HOURS=${1:-24}

LOGS=$(docker logs "${CONTAINER}" --since "${HOURS}h" 2>&1)

echo "========================================================"
echo " AdGuard Home — Log Summary (last ${HOURS} hours)"
echo "========================================================"
echo ""
echo "Event Counts:"
echo "  Invalid SNI rejections   : $(echo "$LOGS" | grep -c 'invalid SNI')"
echo "  TLS handshake errors     : $(echo "$LOGS" | grep -c 'TLS handshake error')"
echo "  Filter list updates      : $(echo "$LOGS" | grep -c 'filter updated')"
echo "  Admin logins             : $(echo "$LOGS" | grep -c 'successful login')"
echo "  Upstream timeouts        : $(echo "$LOGS" | grep -c 'i/o timeout')"
echo "  Service restarts         : $(echo "$LOGS" | grep -c 'starting adguard home')"
echo "  Upstream conn errors     : $(echo "$LOGS" | grep -c 'response received upstream')"
echo ""
echo "Top Source IPs (TLS errors):"
echo "$LOGS" | grep 'TLS handshake error from' | \
    grep -oP '\d+\.\d+\.\d+\.\d+' | \
    sort | uniq -c | sort -rn | head -10 | \
    awk '{printf "  %-8s hits  :  %s\n", $1, $2}'
echo ""
echo "Recent Invalid SNI values:"
echo "$LOGS" | grep 'unknown SNI in Client Hello' | \
    grep -oP 'server_name=\K[^\s"]+' | \
    sort | uniq -c | sort -rn | head -10 | \
    awk '{printf "  %-6s times  :  %s\n", $1, $2}'
echo ""
echo "Container Status:"
docker inspect --format='  Status   : {{.State.Status}}' "${CONTAINER}" 2>/dev/null
docker inspect --format='  Started  : {{.State.StartedAt}}' "${CONTAINER}" 2>/dev/null
echo "========================================================"

#!/bin/bash
# ────────────────────────────────────────────────────────────────────────────
# enable-strict-sni.sh
# Enables strict SNI enforcement in AdGuardHome.yaml and restarts the container.
# Run from the directory containing your docker-compose.yml.
# ────────────────────────────────────────────────────────────────────────────

CONTAINER="adguardhome"
CONFIG_PATH="./conf/AdGuardHome.yaml"
TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')

echo "[$TIMESTAMP] Enabling strict SNI check on $CONTAINER..."

# Verify config exists
if [[ ! -f "$CONFIG_PATH" ]]; then
    echo "ERROR: Config file not found at $CONFIG_PATH"
    echo "       Run this script from the directory containing your docker-compose.yml"
    exit 1
fi

# Back up current config
BACKUP="${CONFIG_PATH}.backup.$(date +%s)"
cp "$CONFIG_PATH" "$BACKUP"
echo "Config backed up to $BACKUP"

# Apply the setting
if grep -q "strict_sni_check" "$CONFIG_PATH"; then
    # Key exists — update it (handles both true and false)
    sed -i 's/strict_sni_check: false/strict_sni_check: true/' "$CONFIG_PATH"
    echo "Updated strict_sni_check to true."
else
    # Key not present — add it after 'enabled: true' in the tls section
    sed -i '/^tls:/,/^[^[:space:]]/{s/\(  enabled: true\)/\1\n  strict_sni_check: true/}' "$CONFIG_PATH"
    echo "Added strict_sni_check: true to tls section."
fi

# Verify the change took effect
if grep -q "strict_sni_check: true" "$CONFIG_PATH"; then
    echo "Verification: strict_sni_check: true confirmed in $CONFIG_PATH"
else
    echo "WARNING: Could not verify the change. Check $CONFIG_PATH manually."
    exit 1
fi

# Restart the container
echo "Restarting $CONTAINER..."
docker restart "$CONTAINER"

if [[ $? -eq 0 ]]; then
    echo ""
    echo "Done. Strict SNI enforcement is now active."
    echo "Run the PowerShell verification script (Script A) to confirm client access."
else
    echo "ERROR: Container failed to restart. Check 'docker logs $CONTAINER'."
    exit 1
fi