- ddclient.tf: dynamic DNS daemon that keeps dot.nook.family A record
pointing at the home public IP via Cloudflare API (updates every 5m)
- adguard.tf: cert-manager Certificate for dot.nook.family via DNS-01,
updated TLS config block with DoT paths and port 853
- apps/adguard.yaml: mount adguard-dot-tls secret, expose port 853,
init container enforces TLS/DoT settings on every restart
- adguard.tf: fix stale neuralplatform.dev → neuralplatform.ai rewrite
Android Private DNS: set to dot.nook.family
Router: forward TCP 853 → 192.168.68.77
ConfigMap adguard-defaults holds desired settings (upstreams, bootstrap DNS,
filter lists, rewrites). Init container merges them into the PVC config on
every pod start — no more manual kubectl edits needed.
- Switch upstreams to Cloudflare + Google DoH (Quad9 was failing)
- Bootstrap DNS IPv4-only (removes IPv6 timeout errors)
- Add OISD Big, EasyList, EasyPrivacy filter lists
- Fix DNS rewrites pointing to old IP 192.168.0.105
Will Anderson