AdGuard: enforce filter lists and DNS upstreams via init container

ConfigMap adguard-defaults holds desired settings (upstreams, bootstrap DNS,
filter lists, rewrites). Init container merges them into the PVC config on
every pod start — no more manual kubectl edits needed.

- Switch upstreams to Cloudflare + Google DoH (Quad9 was failing)
- Bootstrap DNS IPv4-only (removes IPv6 timeout errors)
- Add OISD Big, EasyList, EasyPrivacy filter lists
- Fix DNS rewrites pointing to old IP 192.168.0.105

servers/legion/apps/adguard.yaml

@@ -20,29 +20,59 @@ spec:
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
       initContainers:
-        - name: fix-bind-hosts
+        - name: apply-config
           image: python:3.12-alpine
           command: ["python3", "-c"]
           args:
             - |
-              import re, os
-              config = "/opt/adguardhome/conf/AdGuardHome.yaml"
-              if os.path.exists(config):
-                  with open(config) as f:
-                      content = f.read()
-                  content = re.sub(
-                      r'(bind_hosts:\n)((?:[ \t]*- .*\n)*)',
-                      'bind_hosts:\n  - 0.0.0.0\n',
-                      content
-                  )
-                  with open(config, "w") as f:
-                      f.write(content)
-                  print("bind_hosts set to 0.0.0.0")
+              import yaml, os, shutil
+
+              CONFIG  = "/opt/adguardhome/conf/AdGuardHome.yaml"
+              DEFAULT = "/opt/adguard-defaults/AdGuardHome.yaml"
+
+              with open(DEFAULT) as f:
+                  desired = yaml.safe_load(f)
+
+              if not os.path.exists(CONFIG):
+                  # First run — seed from defaults
+                  shutil.copy(DEFAULT, CONFIG)
+                  print("First run: seeded config from defaults")
               else:
-                  print("No config yet — AdGuard will create it on first run")
+                  with open(CONFIG) as f:
+                      cfg = yaml.safe_load(f)
+
+                  # Enforce bind_hosts
+                  cfg.setdefault("dns", {})["bind_hosts"] = ["0.0.0.0"]
+
+                  # Enforce upstream + bootstrap DNS
+                  cfg["dns"]["upstream_dns"]  = desired["dns"]["upstream_dns"]
+                  cfg["dns"]["bootstrap_dns"] = desired["dns"]["bootstrap_dns"]
+
+                  # Ensure desired filter lists are all present and enabled
+                  existing = {f["url"]: f for f in cfg.get("filters", [])}
+                  for df in desired.get("filters", []):
+                      if df["url"] in existing:
+                          existing[df["url"]]["enabled"] = True
+                      else:
+                          cfg.setdefault("filters", []).append(df)
+
+                  # Fix/ensure rewrites
+                  cfg.setdefault("filtering", {})
+                  existing_rw = {rw["domain"]: rw for rw in cfg["filtering"].get("rewrites", [])}
+                  for rw in desired.get("filtering", {}).get("rewrites", []):
+                      if rw["domain"] in existing_rw:
+                          existing_rw[rw["domain"]]["answer"] = rw["answer"]
+                      else:
+                          cfg["filtering"].setdefault("rewrites", []).append(rw)
+
+                  with open(CONFIG, "w") as f:
+                      yaml.dump(cfg, f, default_flow_style=False, allow_unicode=True)
+                  print("Config patched: DNS upstreams, filter lists, rewrites enforced")
           volumeMounts:
             - name: config
               mountPath: /opt/adguardhome/conf
+            - name: defaults
+              mountPath: /opt/adguard-defaults
       containers:
         - name: adguard
           image: adguard/adguardhome:latest
@@ -75,6 +105,9 @@ spec:
         - name: data
           persistentVolumeClaim:
             claimName: adguard-data
+        - name: defaults
+          configMap:
+            name: adguard-defaults
 ---
 apiVersion: v1
 kind: Service