sirkirby

{
  "decision_model": "jev-1.13.0",
  "ms": 152,
  "headline": "routr: standard, debug work; approach_open, cause_unknown",
  "level": "standard",
  "sure": true,
  "work_type": "debug",
  "high_risk": false,
  "worker": "worth a worker",
  "facts": {

sirkirby

! routr dispatch "The nightly export job times out on large accounts. Find the cause, fix it, add a regression test, run bun test."

sirkirby

! Upload via UniFi Network -> Settings -> Routing -> BGP (UniFi OS 4.1.13+)
! UDM-Pro-SE, AS 65000. Peers with both AdGuard hosts; prefers .101.
router bgp 65000
 bgp router-id 10.0.0.1
 no bgp ebgp-requires-policy
 neighbor 10.0.0.101 remote-as 65001
 neighbor 10.0.0.102 remote-as 65002
 !
 address-family ipv4 unicast
  neighbor 10.0.0.101 activate

sirkirby

! /etc/frr/frr.conf on the STANDBY (10.0.0.102, AS 65002)
! Same as the primary, plus an AS-path prepend so the gateway prefers the primary.
frr defaults traditional
hostname adguard-standby
log syslog informational
service integrated-vtysh-config
!
ip prefix-list DNSVIP seq 5 permit 10.0.53.53/32
!
route-map RM-REDIST permit 10

sirkirby

! /etc/frr/frr.conf on the PRIMARY (10.0.0.101, AS 65001)
frr defaults traditional
hostname adguard-primary
log syslog informational
service integrated-vtysh-config
!
ip prefix-list DNSVIP seq 5 permit 10.0.53.53/32
!
route-map RM-REDIST permit 10
 match ip address prefix-list DNSVIP

sirkirby

#!/usr/bin/env bash
# acme.sh --reloadcmd on the primary: reload AdGuard here, then push the renewed
# cert+key to the standby and reload AdGuard there, so the standby never goes stale.
set -uo pipefail
SSL_DIR=/opt/AdGuardHome/data/ssl
ADGUARD=/opt/AdGuardHome/AdGuardHome
STANDBY=chris@10.0.0.102
OPTS=(-i /root/.ssh/id_ed25519_adguard_deploy -o BatchMode=yes -o ConnectTimeout=10)

"$ADGUARD" -s restart    # primary picks up the freshly installed cert

sirkirby

tls:
  enabled: true
  server_name: adguard.example.com
  force_https: true
  certificate_path: /opt/AdGuardHome/data/ssl/cert.pem
  private_key_path: /opt/AdGuardHome/data/ssl/private.key

sirkirby

# ~/.adguardhome-sync.yaml  (runs on the replica/standby host)
cron: "*/5 * * * *"
runOnStart: true
origin:
  url: https://10.0.0.101
  insecureSkipVerify: true
  username: admin
  password: <redacted>
replica:
  url: https://10.0.0.102      # HTTPS on purpose. See the gotcha below.

sirkirby

[Unit]
Description=AdGuard DNS anycast VIP health gate
After=network-online.target AdGuardHome.service
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/local/bin/dns-vip-health.sh
# Drop the VIP if the gate stops, so a dead node never keeps advertising.
ExecStopPost=-/usr/sbin/ip addr del 10.0.53.53/32 dev lo

sirkirby

#!/usr/bin/env bash
# dns-vip-health.sh
# Bind the DNS anycast VIP to lo ONLY while local AdGuard answers a local rewrite.
# FRR redistributes the connected /32 into BGP, so:
#   AdGuard healthy -> VIP on lo -> /32 advertised -> gateway routes here
#   AdGuard down    -> VIP removed -> /32 withdrawn -> gateway uses the other node
set -u

VIP="10.0.53.53/32"
HEALTH_NAME="dnshealth.home.lab"   # a local rewrite -> 127.0.0.1, synced to both boxes