From ed5f330d2c8388e4122334e0ae31c9c35118d89d Mon Sep 17 00:00:00 2001 From: jeremy Date: Mon, 13 Jul 2026 20:20:37 -0500 Subject: [PATCH] chore: decommission AdGuard Home (dead since 2026-05-17, LAN uses router DNS) Container, data, compose dir, and Prometheus probe removed from .192. Ports 53 and 3000 freed. Co-Authored-By: Claude Fable 5 --- CLAUDE.md | 9 +++---- .../hf-pdocker-01/adguard/docker-compose.yml | 26 ------------------- 2 files changed, 4 insertions(+), 31 deletions(-) delete mode 100644 compose/hf-pdocker-01/adguard/docker-compose.yml diff --git a/CLAUDE.md b/CLAUDE.md index e276f32..080b60e 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -31,7 +31,7 @@ hf-pdocker-01 (23GB RAM, i7-7700T, NVMe, HD 630 GPU) -- RESTORED (2026-03-08, ha ├── [COMPOSE] Guacamole (:8199) + guacd + guacamole-db (mysql, LOCAL /var/lib/guacamole-db) ├── [COMPOSE] AI Agents (margaret:18790, spirit:18795 [infra ops]) ├── [COMPOSE] Traefik (reverse proxy, ports 80/443/8090) -├── [COMPOSE] AdGuard Home (:3000, :53) -- **BROKEN since 2026-05-17**: conf dir empty, stuck in first-run wizard, DNS not answering. No backup found; needs manual reconfigure via :3000/install.html. +├── [REMOVED] AdGuard Home -- decommissioned 2026-07-13 (conf dir had been empty since 2026-05-17, DNS engine never ran, LAN uses router DNS). Ports 53/3000 freed on .192. ├── [COMPOSE] Monitoring (Grafana :3001, Prometheus :9095, Alertmanager :9093, InfluxDB :8086, Blackbox :9115, matrix-receiver :9094) ├── [COMPOSE] Farm Manager API (:8888) -- dashboard + API server ├── [COMPOSE] Farm Agent (:8889) @@ -160,7 +160,6 @@ compose/ # Standalone Compose definitions (deployed per-node) - Matrix/Synapse: :8008 - Well-known (Matrix federation): :8010 - Guacamole: :8199 -- AdGuard Home: :3000 (DNS: :53) - Traefik Dashboard: :8090 (HTTP: :80, HTTPS: :443) - Grafana: :3001 - Prometheus: :9095 @@ -210,7 +209,7 @@ compose/ # Standalone Compose definitions (deployed per-node) Port conflicts already resolved: - Port 8000: Freed (MCPO moved to 8001, Portainer moved elsewhere) -- Port 3000: AdGuard Home (Gitea moved to 3003) +- Port 3000: freed 2026-07-13 (was AdGuard Home, decommissioned; Gitea remains on 3003) - Port 3001: Grafana (Semaphore moved to 3004) - Port 5000: Frigate uses host networking (registry container stopped) - AI Agent ports re-spaced (2026-03-15): openclaw 2026.3.13 uses gateway+2 and gateway+3 for browser/chrome-relay. Agents spaced 5 apart: margaret=18790, spirit=18795 @@ -296,7 +295,7 @@ All persistent data on NAS at `/mnt/docker-data/`: 4. **InfluxDB Connection**: Telegraf may show timeout errors if InfluxDB is not running 5. **Frigate cameras**: Cameras on 192.168.44.x subnet may show RTSP timeouts (check camera network) 6. **Registry container**: Stopped on hf-pdocker-01 to free port 5000 for Frigate -7. **systemd-resolved DNSStubListener**: Must be disabled on any node running AdGuard Home (port 53 conflict). Fix: `/etc/systemd/resolved.conf.d/nostub.conf` with `DNSStubListener=no`, then `systemctl restart systemd-resolved`. Applied on hf-pdocker-01 and hf-pdocker-02. +7. **systemd-resolved DNSStubListener**: disabled on hf-pdocker-01 and hf-pdocker-02 via `/etc/systemd/resolved.conf.d/nostub.conf` (`DNSStubListener=no`) — originally for AdGuard Home's port 53. AdGuard was decommissioned 2026-07-13; the stub-listener change is harmless and left in place (re-enable only if something needs 127.0.0.53). 8. **NFS boot-mount race (hf-pdocker-01)**: NFS mounts failed at boot (network not ready in time). Fixed 2026-05-20 by adding `nofail,x-systemd.after=network-online.target,x-systemd.mount-timeout=60s` to both fstab entries. If mounts are missing after reboot: `sudo mount /mnt/docker-data && sudo mount /mnt/infrastructure`. 9. **Guacamole schema**: App image pinned to `guacamole/guacamole:1.6.0` + `guacd:1.6.0` with Watchtower disabled. DB schema was reset to fresh 1.6.0 on 2026-05-20 (old schema was non-standard). Recreate connections after any DB reset. 10. **Gitea image**: Pinned to `gitea/gitea:1.26.1` with Watchtower disabled (2026-05-20). Watchtower previously pulled broken `:latest` images causing missing git binary errors. @@ -307,6 +306,6 @@ All persistent data on NAS at `/mnt/docker-data/`: 15. **litellm hangs after DB blip**: litellm does NOT self-recover from a transient `litellm-db` disconnect — it loops on "Prisma DB reconnect failed" forever; needs manual `docker restart litellm`. Its healthcheck was fixed from `curl` (absent from image, permanent false-unhealthy) to a python urllib check (2026-07-11). 16. **Stale NFS locks after unclean reboot/power loss (2026-07-12 power event)**: NFS file locks held by pre-reboot client identities survive on the Synology and block relocking — gitea crash-looped 7,972× on its LevelDB queue lock, semaphore-db 975× on `ibdata1`. Fix applied 2026-07-13: lock-prone data moved to LOCAL disk (gitea queues → `/var/lib/gitea-queues`, semaphore-db → `/var/lib/semaphore-db` on .100; sonarr config → `/var/lib/sonarr` on bart). **Rule: anything holding long-lived file locks (MySQL, SQLite, LevelDB) goes on local disk, never NFS.** 17. **Synapse rate-limited Alertmanager notifications**: default `rc_message` (0.2 msg/s) made every matrix-alertmanager-receiver send fail with M_LIMIT_EXCEEDED 429 — **no alerts reached Matrix for weeks** while outages accumulated (Onyx down 5 weeks, AdGuard dead 2 months, unnoticed). Fixed 2026-07-13: `rc_message: {per_second: 5, burst_count: 50}` in homeserver.yaml (backup `.bak-20260713-ratelimit`). -18. **AdGuard Home unconfigured since 2026-05-17**: its conf dir (`/mnt/docker-data/configs/adguardhome/conf`) is empty — container runs the first-launch wizard and serves NO DNS. No AdGuardHome.yaml backup exists anywhere. LAN DNS has been coming from elsewhere (router) since May. Needs manual re-setup at http://192.168.86.192:3000. +18. **AdGuard Home decommissioned 2026-07-13**: its conf dir had been empty since 2026-05-17 (container ran the first-launch wizard, served no DNS, no backup existed) and the LAN had been using router DNS ever since. Container, data, compose dir, and Prometheus probe all removed; ports 53/3000 freed on .192. LAN DNS = the router. 19. **Duplicate failover stacks removed from .100 and bart (2026-07-13)**: .100 ran a second monitoring stack (prometheus/grafana/alertmanager/influxdb/blackbox), an idle traefik (shared acme.json with .192 — ACME conflict risk), and a stray guacamole; bart ran a failover guacamole. All removed (~2GB RAM reclaimed). Compose dirs kept for reference; data volumes untouched. 20. **UniFi OS Server probe port**: `unifi-os-server` on .100 serves HTTPS on host port **11443** (container 443), not 8443. Blackbox probe fixed 2026-07-13. solo.hobbs.farm returns 401 (Traefik basicAuth) when healthy — probed via `http_2xx_or_401` module. diff --git a/compose/hf-pdocker-01/adguard/docker-compose.yml b/compose/hf-pdocker-01/adguard/docker-compose.yml deleted file mode 100644 index fd7b2d3..0000000 --- a/compose/hf-pdocker-01/adguard/docker-compose.yml +++ /dev/null @@ -1,26 +0,0 @@ -services: - adguardhome: - image: adguard/adguardhome:latest - container_name: adguardhome - restart: unless-stopped - volumes: - - /mnt/docker-data/configs/adguardhome/work:/opt/adguardhome/work - - /mnt/docker-data/configs/adguardhome/conf:/opt/adguardhome/conf - ports: - - "53:53/tcp" - - "53:53/udp" - - "3000:3000/tcp" - - "853:853/tcp" - mem_limit: 256M - memswap_limit: 256M - healthcheck: - test: ["CMD-SHELL", "wget -q --spider http://localhost:3000/ || exit 1"] - interval: 30s - timeout: 10s - retries: 3 - start_period: 30s - logging: - driver: "json-file" - options: - max-size: "50m" - max-file: "3"