AdGuard: enforce filter lists and DNS upstreams via init container

ConfigMap adguard-defaults holds desired settings (upstreams, bootstrap DNS,
filter lists, rewrites). Init container merges them into the PVC config on
every pod start — no more manual kubectl edits needed.

- Switch upstreams to Cloudflare + Google DoH (Quad9 was failing)
- Bootstrap DNS IPv4-only (removes IPv6 timeout errors)
- Add OISD Big, EasyList, EasyPrivacy filter lists
- Fix DNS rewrites pointing to old IP 192.168.0.105

servers/legion/adguard.tf

@@ -42,6 +42,65 @@ resource "kubernetes_persistent_volume_claim" "adguard_data" {
   }
 }
 
+# Desired AdGuard settings — applied by init container on every pod start.
+# To change DNS upstreams, filter lists, or rewrites: edit here, terraform apply, then push apps/adguard.yaml.
+resource "kubernetes_config_map" "adguard_defaults" {
+  metadata {
+    name      = "adguard-defaults"
+    namespace = kubernetes_namespace.dns.metadata[0].name
+  }
+
+  data = {
+    "AdGuardHome.yaml" = <<-EOT
+      dns:
+        bind_hosts:
+          - 0.0.0.0
+        port: 53
+        upstream_dns:
+          - https://dns.cloudflare.com/dns-query
+          - https://dns.google/dns-query
+        bootstrap_dns:
+          - 1.1.1.1
+          - 8.8.8.8
+          - 9.9.9.10
+          - 149.112.112.10
+        upstream_mode: load_balance
+        cache_enabled: true
+        cache_size: 4194304
+      filters:
+        - enabled: true
+          url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt
+          name: AdGuard DNS filter
+          id: 1
+        - enabled: true
+          url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt
+          name: AdAway Default Blocklist
+          id: 2
+        - enabled: true
+          url: https://big.oisd.nl/domainswild
+          name: OISD Big
+          id: 3
+        - enabled: true
+          url: https://easylist.to/easylist/easylist.txt
+          name: EasyList
+          id: 4
+        - enabled: true
+          url: https://easylist.to/easylist/easyprivacy.txt
+          name: EasyPrivacy
+          id: 5
+      filtering:
+        filtering_enabled: true
+        rewrites:
+          - domain: '*.nook.family'
+            answer: ${var.legion_ip}
+            enabled: true
+          - domain: '*.neuralplatform.dev'
+            answer: ${var.legion_ip}
+            enabled: true
+    EOT
+  }
+}
+
 # Deployment + Service managed by Argo CD — see servers/legion/apps/adguard.yaml
 
 resource "kubernetes_ingress_v1" "adguard" {