adguard home release 0.0.1

charts/adguard-home/Chart.yaml

@@ -0,0 +1,19 @@
+apiVersion: v2
+name: adguard-home
+description: AdGuard Home helm chart for Kubernetes - Network-wide ad and tracker blocking DNS server
+type: application
+version: 0.0.1
+appVersion: "v0.107.79"
+maintainers:
+  - name: Richard Tomik
+    email: no@m.com
+keywords:
+  - dns
+  - ad-blocking
+  - dns-filtering
+  - adguard-home
+  - privacy
+  - network-security
+home: https://github.com/rtomik/helm-charts
+sources:
+  - https://github.com/AdguardTeam/AdGuardHome

charts/adguard-home/NOTES.txt

@@ -0,0 +1,55 @@
+1. Get the admin dashboard URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[?(@.name=='web')].nodePort}" services {{ include "adguard-home.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "adguard-home.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "adguard-home.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.ports.web.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "adguard-home.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  echo "Visit http://127.0.0.1:8080 to use the AdGuard Home setup wizard / dashboard"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:{{ .Values.ports.web.port }}
+{{- end }}
+
+2. On first access, complete the AdGuard Home setup wizard (admin user, DNS listener
+   interfaces/ports). The resulting AdGuardHome.yaml is written to the conf volume.
+
+3. DNS listens on port {{ .Values.ports.dns.port }} (TCP/UDP).
+{{- if not .Values.hostNetwork }}
+   NOTE: hostNetwork is disabled, so clients will see the Service/pod IP, not their
+   real IP, in the AdGuard Home query log/filters. Set hostNetwork: true, or use a
+   LoadBalancer Service with externalTrafficPolicy: Local, to preserve client IPs.
+{{- end }}
+{{- if .Values.ports.dhcp.enabled }}
+4. DHCP server is enabled on UDP 67/68.
+{{- if not .Values.hostNetwork }}
+   WARNING: DHCP requires hostNetwork: true to function correctly - it will not
+   work through a ClusterIP/LoadBalancer Service.
+{{- end }}
+{{- end }}
+
+{{- if or .Values.persistence.work.enabled .Values.persistence.conf.enabled }}
+
+5. Data is persisted using PVCs:
+{{- if .Values.persistence.work.enabled }}
+   - {{ .Values.persistence.work.existingClaim | default (printf "%s-work" (include "adguard-home.fullname" .)) }} (query log, filter cache, stats)
+{{- end }}
+{{- if .Values.persistence.conf.enabled }}
+   - {{ .Values.persistence.conf.existingClaim | default (printf "%s-conf" (include "adguard-home.fullname" .)) }} (AdGuardHome.yaml)
+{{- end }}
+{{- else }}
+
+5. WARNING: No persistence enabled. Configuration and filter data will be lost when
+   the pod restarts.
+{{- end }}
+
+For more information about using this Helm chart, please refer to the readme.md file.

charts/adguard-home/readme.md

@@ -0,0 +1,235 @@
+# AdGuard Home Helm Chart
+
+A Helm chart for deploying [AdGuard Home](https://github.com/AdguardTeam/AdGuardHome), a network-wide DNS ad and tracker blocker, on Kubernetes.
+
+## Introduction
+
+This chart deploys AdGuard Home on a Kubernetes cluster using the Helm package manager. AdGuard Home is a self-hosted DNS server that blocks ads and trackers for every device on your network, and can also act as a DHCP server, DNS-over-TLS/HTTPS/QUIC resolver, and DNSCrypt server.
+
+Source code: https://github.com/rtomik/helm-charts/tree/main/charts/adguard-home
+
+## Prerequisites
+
+- Kubernetes 1.19+
+- Helm 3.0+
+- PV provisioner support (if persistence is needed)
+- A way to route real LAN clients to the DNS Service (LoadBalancer/MetalLB, NodePort, or `hostNetwork: true`) if you intend to use it as your network's resolver
+
+## Installing the Chart
+
+```bash
+helm repo add rtomik https://rtomik.github.io/helm-charts
+helm install adguard-home rtomik/adguard-home
+```
+
+## Uninstalling the Chart
+
+```bash
+helm uninstall adguard-home
+```
+
+## Configuration Examples
+
+### Minimal Installation (admin UI only, no DNS exposed on the LAN)
+
+```yaml
+persistence:
+  work:
+    enabled: true
+    size: 2Gi
+  conf:
+    enabled: true
+    size: 100Mi
+
+ingress:
+  enabled: true
+  hosts:
+    - host: adguard.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - hosts:
+        - adguard.example.com
+      secretName: adguard-tls
+```
+
+### Expose DNS to the LAN via LoadBalancer (e.g. MetalLB)
+
+```yaml
+service:
+  type: LoadBalancer
+  loadBalancerIP: 192.168.1.53
+  annotations:
+    metallb.universe.tf/allow-shared-ip: adguard-home
+
+hostNetwork: true  # preserves real client IPs in the query log/filters
+```
+
+### Enable DNS-over-TLS / DNS-over-QUIC and DNS-over-HTTPS
+
+```yaml
+ports:
+  dot:
+    enabled: true
+  https:
+    enabled: true
+```
+
+### Enable the DHCP server
+
+DHCP requires `hostNetwork: true` - it cannot be proxied through a ClusterIP/LoadBalancer Service.
+
+```yaml
+hostNetwork: true
+ports:
+  dhcp:
+    enabled: true
+```
+
+### Use an existing PVC
+
+```yaml
+persistence:
+  work:
+    existingClaim: "adguard-work-pvc"
+  conf:
+    existingClaim: "adguard-conf-pvc"
+```
+
+## Parameters
+
+### Global Parameters
+
+| Name | Description | Default |
+|------|-------------|---------|
+| `nameOverride` | Override the release name | `""` |
+| `fullnameOverride` | Fully override the release name | `""` |
+
+### Image Parameters
+
+| Name | Description | Default |
+|------|-------------|---------|
+| `image.repository` | AdGuard Home image repository | `adguard/adguardhome` |
+| `image.tag` | Image tag | `v0.107.79` |
+| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
+| `imagePullSecrets` | Image pull secrets | `[]` |
+
+### Deployment Parameters
+
+| Name | Description | Default |
+|------|-------------|---------|
+| `replicaCount` | Number of replicas (keep at 1 - AdGuard Home is not multi-writer safe) | `1` |
+| `revisionHistoryLimit` | Revisions to retain | `3` |
+| `podSecurityContext.runAsNonRoot` | Run as non-root | `true` |
+| `podSecurityContext.runAsUser` | User ID | `1000` |
+| `podSecurityContext.runAsGroup` | Group ID | `1000` |
+| `podSecurityContext.fsGroup` | Filesystem group ID | `1000` |
+| `containerSecurityContext.capabilities.add` | Capabilities added (NET_BIND_SERVICE for ports < 1024) | `["NET_BIND_SERVICE"]` |
+| `hostNetwork` | Use host networking (required for DHCP, recommended for accurate client IPs) | `false` |
+| `nodeSelector` | Node selector | `{}` |
+| `tolerations` | Tolerations | `[]` |
+| `affinity` | Affinity rules | `{}` |
+
+### Ports Parameters
+
+| Name | Description | Default |
+|------|-------------|---------|
+| `ports.web.port` | Admin dashboard / setup wizard | `3000` |
+| `ports.dns.port` | Plain DNS (TCP+UDP) | `53` |
+| `ports.dot.enabled` | Enable DNS-over-TLS / DNS-over-QUIC | `false` |
+| `ports.dot.port` | DoT/DoQ port (TCP+UDP) | `853` |
+| `ports.https.enabled` | Enable DNS-over-HTTPS / HTTPS admin dashboard | `false` |
+| `ports.https.port` | HTTPS port (TCP+UDP) | `443` |
+| `ports.dnscrypt.enabled` | Enable DNSCrypt | `false` |
+| `ports.dnscrypt.port` | DNSCrypt port (TCP+UDP) | `5443` |
+| `ports.dhcp.enabled` | Enable DHCP server (67/68 UDP, requires `hostNetwork: true`) | `false` |
+| `ports.pprof.enabled` | Enable the debug pprof API | `false` |
+| `ports.pprof.port` | pprof port | `6060` |
+
+### Service Parameters
+
+| Name | Description | Default |
+|------|-------------|---------|
+| `service.type` | Service type | `ClusterIP` |
+| `service.annotations` | Service annotations | `{}` |
+| `service.loadBalancerIP` | Static LoadBalancer IP (e.g. for MetalLB) | `""` |
+
+### Ingress Parameters
+
+| Name | Description | Default |
+|------|-------------|---------|
+| `ingress.enabled` | Enable ingress (routes to the admin dashboard only) | `false` |
+| `ingress.className` | Ingress class name | `""` |
+| `ingress.annotations` | Ingress annotations | See values.yaml |
+| `ingress.hosts` | Ingress hosts | See values.yaml |
+| `ingress.tls` | TLS configuration | See values.yaml |
+
+### Persistence Parameters
+
+| Name | Description | Default |
+|------|-------------|---------|
+| `persistence.work.enabled` | Persist `/opt/adguardhome/work` (query log, filter cache, stats) | `true` |
+| `persistence.work.existingClaim` | Use an existing PVC instead of creating one | `""` |
+| `persistence.work.storageClass` | Storage class | `""` |
+| `persistence.work.accessMode` | Access mode | `ReadWriteOnce` |
+| `persistence.work.size` | PVC size | `1Gi` |
+| `persistence.conf.enabled` | Persist `/opt/adguardhome/conf` (AdGuardHome.yaml) | `true` |
+| `persistence.conf.existingClaim` | Use an existing PVC instead of creating one | `""` |
+| `persistence.conf.storageClass` | Storage class | `""` |
+| `persistence.conf.accessMode` | Access mode | `ReadWriteOnce` |
+| `persistence.conf.size` | PVC size | `100Mi` |
+
+### Resource Parameters
+
+| Name | Description | Default |
+|------|-------------|---------|
+| `resources` | Resource limits and requests | `{}` |
+
+### Health Check Parameters
+
+| Name | Description | Default |
+|------|-------------|---------|
+| `probes.liveness.enabled` | Enable liveness probe (TCP check on the admin web port) | `true` |
+| `probes.liveness.initialDelaySeconds` | Liveness initial delay | `15` |
+| `probes.liveness.periodSeconds` | Liveness period | `30` |
+| `probes.readiness.enabled` | Enable readiness probe (TCP check on the admin web port) | `true` |
+| `probes.readiness.initialDelaySeconds` | Readiness initial delay | `5` |
+| `probes.readiness.periodSeconds` | Readiness period | `10` |
+
+### Other Parameters
+
+| Name | Description | Default |
+|------|-------------|---------|
+| `extraEnv` | Additional environment variables | `[]` |
+| `extraVolumeMounts` | Additional volume mounts | `[]` |
+| `extraVolumes` | Additional volumes | `[]` |
+
+## Notes
+
+- AdGuard Home has no supported way to bootstrap its admin account or DNS settings via
+  environment variables - complete the setup wizard once at `http://<web-service>:3000`
+  after the first install. The resulting `AdGuardHome.yaml` is written to the `conf` PVC,
+  so it survives pod restarts/upgrades.
+- Because AdGuard Home stores state on disk and isn't multi-writer safe, do not scale
+  `replicaCount` beyond `1`.
+- If you plan to use this as your network's DNS resolver, prefer `hostNetwork: true` (or
+  a LoadBalancer Service with `externalTrafficPolicy: Local`) so AdGuard Home sees real
+  client IPs rather than a single Service/NAT IP for every device.
+
+## Troubleshooting
+
+- **Clients all show up as the same IP / filters by client don't work**: enable `hostNetwork` or use `externalTrafficPolicy: Local` on a LoadBalancer Service.
+- **DHCP doesn't hand out leases**: DHCP only works with `hostNetwork: true`.
+- **Setup wizard settings don't persist**: verify `persistence.conf.enabled` is `true` and the PVC is bound.
+
+```bash
+kubectl logs -f deployment/adguard-home
+kubectl describe pod -l app.kubernetes.io/name=adguard-home
+```
+
+## Links
+
+- [AdGuard Home GitHub](https://github.com/AdguardTeam/AdGuardHome)
+- [AdGuard Home Docker documentation](https://adguard-dns.io/kb/adguard-home/docker/)
+- [Chart Source](https://github.com/rtomik/helm-charts/tree/main/charts/adguard-home)

charts/adguard-home/templates/_helpers.tpl

@@ -0,0 +1,45 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "adguard-home.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+*/}}
+{{- define "adguard-home.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- printf "%s" $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "adguard-home.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "adguard-home.labels" -}}
+helm.sh/chart: {{ include "adguard-home.chart" . }}
+{{ include "adguard-home.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "adguard-home.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "adguard-home.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}

charts/adguard-home/templates/deployment.yaml

@@ -0,0 +1,150 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "adguard-home.fullname" . }}
+  labels:
+    {{- include "adguard-home.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+      {{- include "adguard-home.selectorLabels" . | nindent 6 }}
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        {{- include "adguard-home.selectorLabels" . | nindent 8 }}
+      annotations:
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.hostNetwork }}
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: web
+              containerPort: {{ .Values.ports.web.port }}
+              protocol: TCP
+            - name: dns-tcp
+              containerPort: {{ .Values.ports.dns.port }}
+              protocol: TCP
+            - name: dns-udp
+              containerPort: {{ .Values.ports.dns.port }}
+              protocol: UDP
+            {{- if .Values.ports.dot.enabled }}
+            - name: dot-tcp
+              containerPort: {{ .Values.ports.dot.port }}
+              protocol: TCP
+            - name: dot-udp
+              containerPort: {{ .Values.ports.dot.port }}
+              protocol: UDP
+            {{- end }}
+            {{- if .Values.ports.https.enabled }}
+            - name: https-tcp
+              containerPort: {{ .Values.ports.https.port }}
+              protocol: TCP
+            - name: https-udp
+              containerPort: {{ .Values.ports.https.port }}
+              protocol: UDP
+            {{- end }}
+            {{- if .Values.ports.dnscrypt.enabled }}
+            - name: dnscrypt-tcp
+              containerPort: {{ .Values.ports.dnscrypt.port }}
+              protocol: TCP
+            - name: dnscrypt-udp
+              containerPort: {{ .Values.ports.dnscrypt.port }}
+              protocol: UDP
+            {{- end }}
+            {{- if .Values.ports.dhcp.enabled }}
+            - name: dhcp-server
+              containerPort: 67
+              protocol: UDP
+            - name: dhcp-client
+              containerPort: 68
+              protocol: UDP
+            {{- end }}
+            {{- if .Values.ports.pprof.enabled }}
+            - name: pprof
+              containerPort: {{ .Values.ports.pprof.port }}
+              protocol: TCP
+            {{- end }}
+          {{- if .Values.probes.liveness.enabled }}
+          livenessProbe:
+            tcpSocket:
+              port: web
+            initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
+            successThreshold: {{ .Values.probes.liveness.successThreshold }}
+          {{- end }}
+          {{- if .Values.probes.readiness.enabled }}
+          readinessProbe:
+            tcpSocket:
+              port: web
+            initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
+            successThreshold: {{ .Values.probes.readiness.successThreshold }}
+          {{- end }}
+          {{- with .Values.extraEnv }}
+          env:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            {{- if .Values.persistence.work.enabled }}
+            - name: work
+              mountPath: /opt/adguardhome/work
+            {{- end }}
+            {{- if .Values.persistence.conf.enabled }}
+            - name: conf
+              mountPath: /opt/adguardhome/conf
+            {{- end }}
+            {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      volumes:
+        {{- if .Values.persistence.work.enabled }}
+        - name: work
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.work.existingClaim | default (printf "%s-work" (include "adguard-home.fullname" .)) }}
+        {{- end }}
+        {{- if .Values.persistence.conf.enabled }}
+        - name: conf
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.conf.existingClaim | default (printf "%s-conf" (include "adguard-home.fullname" .)) }}
+        {{- end }}
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/adguard-home/templates/ingress.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "adguard-home.fullname" . }}
+  labels:
+    {{- include "adguard-home.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      {{- if .secretName }}
+      secretName: {{ .secretName }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "adguard-home.fullname" $ }}
+                port:
+                  number: {{ $.Values.ports.web.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

charts/adguard-home/templates/pvc.yaml

@@ -0,0 +1,43 @@
+{{- if and .Values.persistence.work.enabled (not .Values.persistence.work.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "adguard-home.fullname" . }}-work
+  labels:
+    {{- include "adguard-home.labels" . | nindent 4 }}
+  {{- with .Values.persistence.work.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.work.accessMode | quote }}
+  {{- if .Values.persistence.work.storageClass }}
+  storageClassName: {{ .Values.persistence.work.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.work.size | quote }}
+{{- end }}
+---
+{{- if and .Values.persistence.conf.enabled (not .Values.persistence.conf.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "adguard-home.fullname" . }}-conf
+  labels:
+    {{- include "adguard-home.labels" . | nindent 4 }}
+  {{- with .Values.persistence.conf.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.conf.accessMode | quote }}
+  {{- if .Values.persistence.conf.storageClass }}
+  storageClassName: {{ .Values.persistence.conf.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.conf.size | quote }}
+{{- end }}

charts/adguard-home/templates/service.yaml

@@ -0,0 +1,76 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "adguard-home.fullname" . }}
+  labels:
+    {{- include "adguard-home.labels" . | nindent 4 }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  {{- if .Values.service.loadBalancerIP }}
+  loadBalancerIP: {{ .Values.service.loadBalancerIP }}
+  {{- end }}
+  ports:
+    - name: web
+      port: {{ .Values.ports.web.port }}
+      targetPort: web
+      protocol: TCP
+    - name: dns-tcp
+      port: {{ .Values.ports.dns.port }}
+      targetPort: dns-tcp
+      protocol: TCP
+    - name: dns-udp
+      port: {{ .Values.ports.dns.port }}
+      targetPort: dns-udp
+      protocol: UDP
+    {{- if .Values.ports.dot.enabled }}
+    - name: dot-tcp
+      port: {{ .Values.ports.dot.port }}
+      targetPort: dot-tcp
+      protocol: TCP
+    - name: dot-udp
+      port: {{ .Values.ports.dot.port }}
+      targetPort: dot-udp
+      protocol: UDP
+    {{- end }}
+    {{- if .Values.ports.https.enabled }}
+    - name: https-tcp
+      port: {{ .Values.ports.https.port }}
+      targetPort: https-tcp
+      protocol: TCP
+    - name: https-udp
+      port: {{ .Values.ports.https.port }}
+      targetPort: https-udp
+      protocol: UDP
+    {{- end }}
+    {{- if .Values.ports.dnscrypt.enabled }}
+    - name: dnscrypt-tcp
+      port: {{ .Values.ports.dnscrypt.port }}
+      targetPort: dnscrypt-tcp
+      protocol: TCP
+    - name: dnscrypt-udp
+      port: {{ .Values.ports.dnscrypt.port }}
+      targetPort: dnscrypt-udp
+      protocol: UDP
+    {{- end }}
+    {{- if .Values.ports.dhcp.enabled }}
+    - name: dhcp-server
+      port: 67
+      targetPort: dhcp-server
+      protocol: UDP
+    - name: dhcp-client
+      port: 68
+      targetPort: dhcp-client
+      protocol: UDP
+    {{- end }}
+    {{- if .Values.ports.pprof.enabled }}
+    - name: pprof
+      port: {{ .Values.ports.pprof.port }}
+      targetPort: pprof
+      protocol: TCP
+    {{- end }}
+  selector:
+    {{- include "adguard-home.selectorLabels" . | nindent 4 }}

charts/adguard-home/values.yaml

@@ -0,0 +1,161 @@
+## Global settings
+nameOverride: ""
+fullnameOverride: ""
+
+## Image settings
+image:
+  repository: adguard/adguardhome
+  tag: "v0.107.79"
+  pullPolicy: IfNotPresent
+
+imagePullSecrets: []
+
+## Deployment settings
+## AdGuard Home keeps its state on disk (PVCs below) and is not designed to run as
+## multiple replicas against the same data - keep replicaCount at 1.
+replicaCount: 1
+revisionHistoryLimit: 3
+
+## Pod security settings
+## AdGuard Home's own startup check refuses to run on its first launch unless the
+## process euid is 0 ("this is the first launch of adguard home; you must run it as
+## administrator"), so - unlike most charts here - this one runs as root. Capabilities
+## are still dropped to the minimum the binary needs.
+podSecurityContext:
+  runAsNonRoot: false
+  runAsUser: 0
+  fsGroup: 0
+
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: false
+  capabilities:
+    drop:
+      - ALL
+    add:
+      - NET_BIND_SERVICE
+      - CHOWN
+      - DAC_OVERRIDE
+      - SETUID
+      - SETGID
+
+## Pod scheduling
+nodeSelector: {}
+tolerations: []
+affinity: {}
+podAnnotations: {}
+
+## Use host networking. Required if you enable the DHCP server, and recommended
+## when exposing DNS so AdGuard Home sees real client IPs instead of the pod/service IP.
+hostNetwork: false
+
+## Ports exposed by AdGuard Home. web+dns are enabled by default; the rest are
+## optional protocols you can turn on as needed.
+## https://adguard-dns.io/kb/adguard-home/docker/
+ports:
+  web:
+    # Admin dashboard / setup wizard
+    port: 3000
+  dns:
+    # Plain DNS (TCP+UDP)
+    port: 53
+  dot:
+    # DNS-over-TLS / DNS-over-QUIC (TCP+UDP)
+    enabled: false
+    port: 853
+  https:
+    # DNS-over-HTTPS and HTTPS admin dashboard (TCP+UDP)
+    enabled: false
+    port: 443
+  dnscrypt:
+    # DNSCrypt (TCP+UDP)
+    enabled: false
+    port: 5443
+  dhcp:
+    # DHCP server (UDP 67/68). Requires hostNetwork: true.
+    enabled: false
+  pprof:
+    # Debug pprof API - leave disabled unless troubleshooting
+    enabled: false
+    port: 6060
+
+## Service settings
+## For exposing DNS to your LAN, set type to LoadBalancer (e.g. with MetalLB) and
+## add annotations/loadBalancerIP as needed, or use type: NodePort.
+service:
+  type: ClusterIP
+  annotations: {}
+  # loadBalancerIP: 192.168.1.53
+
+## Ingress settings (routes to the admin web UI only)
+ingress:
+  enabled: false
+  className: ""
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+  hosts:
+    - host: adguard.domain.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - hosts:
+        - adguard.domain.com
+
+## Persistence settings
+persistence:
+  work:
+    # /opt/adguardhome/work - query log, filter cache, stats
+    enabled: true
+    existingClaim: ""
+    storageClass: ""
+    accessMode: ReadWriteOnce
+    size: 1Gi
+    annotations: {}
+  conf:
+    # /opt/adguardhome/conf - AdGuardHome.yaml configuration
+    enabled: true
+    existingClaim: ""
+    storageClass: ""
+    accessMode: ReadWriteOnce
+    size: 100Mi
+    annotations: {}
+
+## Resource limits and requests
+resources: {}
+# resources:
+#   limits:
+#     cpu: 500m
+#     memory: 256Mi
+#   requests:
+#     cpu: 50m
+#     memory: 64Mi
+
+## Application health checks
+## Uses a TCP check against the admin web port. The DNS listener only comes up after
+## the first-run setup wizard is completed, so probing the DNS port instead would
+## fail/restart the pod before it's ever configured; the web port is always up.
+probes:
+  liveness:
+    enabled: true
+    initialDelaySeconds: 15
+    periodSeconds: 30
+    timeoutSeconds: 5
+    failureThreshold: 3
+    successThreshold: 1
+  readiness:
+    enabled: true
+    initialDelaySeconds: 5
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+    successThreshold: 1
+
+## Extra environment variables
+extraEnv: []
+
+## Extra volume mounts
+extraVolumeMounts: []
+
+## Extra volumes
+extraVolumes: []