From d84a669a62d4d968254a75c2a0d518e84113bf79 Mon Sep 17 00:00:00 2001 From: Richard Tomik Date: Tue, 15 Sep 2026 11:37:19 +0200 Subject: [PATCH] adguard home release 0.0.1 --- charts/adguard-home/Chart.yaml | 19 ++ charts/adguard-home/NOTES.txt | 55 ++++ charts/adguard-home/readme.md | 235 ++++++++++++++++++ charts/adguard-home/templates/_helpers.tpl | 45 ++++ charts/adguard-home/templates/deployment.yaml | 150 +++++++++++ charts/adguard-home/templates/ingress.yaml | 43 ++++ charts/adguard-home/templates/pvc.yaml | 43 ++++ charts/adguard-home/templates/service.yaml | 76 ++++++ charts/adguard-home/values.yaml | 161 ++++++++++++ 9 files changed, 827 insertions(+) create mode 100644 charts/adguard-home/Chart.yaml create mode 100644 charts/adguard-home/NOTES.txt create mode 100644 charts/adguard-home/readme.md create mode 100644 charts/adguard-home/templates/_helpers.tpl create mode 100644 charts/adguard-home/templates/deployment.yaml create mode 100644 charts/adguard-home/templates/ingress.yaml create mode 100644 charts/adguard-home/templates/pvc.yaml create mode 100644 charts/adguard-home/templates/service.yaml create mode 100644 charts/adguard-home/values.yaml diff --git a/charts/adguard-home/Chart.yaml b/charts/adguard-home/Chart.yaml new file mode 100644 index 0000000..d91d3c7 --- /dev/null +++ b/charts/adguard-home/Chart.yaml @@ -0,0 +1,19 @@ +apiVersion: v2 +name: adguard-home +description: AdGuard Home helm chart for Kubernetes - Network-wide ad and tracker blocking DNS server +type: application +version: 0.0.1 +appVersion: "v0.107.79" +maintainers: + - name: Richard Tomik + email: no@m.com +keywords: + - dns + - ad-blocking + - dns-filtering + - adguard-home + - privacy + - network-security +home: https://github.com/rtomik/helm-charts +sources: + - https://github.com/AdguardTeam/AdGuardHome diff --git a/charts/adguard-home/NOTES.txt b/charts/adguard-home/NOTES.txt new file mode 100644 index 0000000..307c9b2 --- /dev/null +++ b/charts/adguard-home/NOTES.txt @@ -0,0 +1,55 @@ +1. Get the admin dashboard URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range $host := .Values.ingress.hosts }} + {{- range .paths }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }} + {{- end }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[?(@.name=='web')].nodePort}" services {{ include "adguard-home.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "adguard-home.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "adguard-home.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + echo http://$SERVICE_IP:{{ .Values.ports.web.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "adguard-home.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + echo "Visit http://127.0.0.1:8080 to use the AdGuard Home setup wizard / dashboard" + kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:{{ .Values.ports.web.port }} +{{- end }} + +2. On first access, complete the AdGuard Home setup wizard (admin user, DNS listener + interfaces/ports). The resulting AdGuardHome.yaml is written to the conf volume. + +3. DNS listens on port {{ .Values.ports.dns.port }} (TCP/UDP). +{{- if not .Values.hostNetwork }} + NOTE: hostNetwork is disabled, so clients will see the Service/pod IP, not their + real IP, in the AdGuard Home query log/filters. Set hostNetwork: true, or use a + LoadBalancer Service with externalTrafficPolicy: Local, to preserve client IPs. +{{- end }} +{{- if .Values.ports.dhcp.enabled }} +4. DHCP server is enabled on UDP 67/68. +{{- if not .Values.hostNetwork }} + WARNING: DHCP requires hostNetwork: true to function correctly - it will not + work through a ClusterIP/LoadBalancer Service. +{{- end }} +{{- end }} + +{{- if or .Values.persistence.work.enabled .Values.persistence.conf.enabled }} + +5. Data is persisted using PVCs: +{{- if .Values.persistence.work.enabled }} + - {{ .Values.persistence.work.existingClaim | default (printf "%s-work" (include "adguard-home.fullname" .)) }} (query log, filter cache, stats) +{{- end }} +{{- if .Values.persistence.conf.enabled }} + - {{ .Values.persistence.conf.existingClaim | default (printf "%s-conf" (include "adguard-home.fullname" .)) }} (AdGuardHome.yaml) +{{- end }} +{{- else }} + +5. WARNING: No persistence enabled. Configuration and filter data will be lost when + the pod restarts. +{{- end }} + +For more information about using this Helm chart, please refer to the readme.md file. diff --git a/charts/adguard-home/readme.md b/charts/adguard-home/readme.md new file mode 100644 index 0000000..2f184e7 --- /dev/null +++ b/charts/adguard-home/readme.md @@ -0,0 +1,235 @@ +# AdGuard Home Helm Chart + +A Helm chart for deploying [AdGuard Home](https://github.com/AdguardTeam/AdGuardHome), a network-wide DNS ad and tracker blocker, on Kubernetes. + +## Introduction + +This chart deploys AdGuard Home on a Kubernetes cluster using the Helm package manager. AdGuard Home is a self-hosted DNS server that blocks ads and trackers for every device on your network, and can also act as a DHCP server, DNS-over-TLS/HTTPS/QUIC resolver, and DNSCrypt server. + +Source code: https://github.com/rtomik/helm-charts/tree/main/charts/adguard-home + +## Prerequisites + +- Kubernetes 1.19+ +- Helm 3.0+ +- PV provisioner support (if persistence is needed) +- A way to route real LAN clients to the DNS Service (LoadBalancer/MetalLB, NodePort, or `hostNetwork: true`) if you intend to use it as your network's resolver + +## Installing the Chart + +```bash +helm repo add rtomik https://rtomik.github.io/helm-charts +helm install adguard-home rtomik/adguard-home +``` + +## Uninstalling the Chart + +```bash +helm uninstall adguard-home +``` + +## Configuration Examples + +### Minimal Installation (admin UI only, no DNS exposed on the LAN) + +```yaml +persistence: + work: + enabled: true + size: 2Gi + conf: + enabled: true + size: 100Mi + +ingress: + enabled: true + hosts: + - host: adguard.example.com + paths: + - path: / + pathType: Prefix + tls: + - hosts: + - adguard.example.com + secretName: adguard-tls +``` + +### Expose DNS to the LAN via LoadBalancer (e.g. MetalLB) + +```yaml +service: + type: LoadBalancer + loadBalancerIP: 192.168.1.53 + annotations: + metallb.universe.tf/allow-shared-ip: adguard-home + +hostNetwork: true # preserves real client IPs in the query log/filters +``` + +### Enable DNS-over-TLS / DNS-over-QUIC and DNS-over-HTTPS + +```yaml +ports: + dot: + enabled: true + https: + enabled: true +``` + +### Enable the DHCP server + +DHCP requires `hostNetwork: true` - it cannot be proxied through a ClusterIP/LoadBalancer Service. + +```yaml +hostNetwork: true +ports: + dhcp: + enabled: true +``` + +### Use an existing PVC + +```yaml +persistence: + work: + existingClaim: "adguard-work-pvc" + conf: + existingClaim: "adguard-conf-pvc" +``` + +## Parameters + +### Global Parameters + +| Name | Description | Default | +|------|-------------|---------| +| `nameOverride` | Override the release name | `""` | +| `fullnameOverride` | Fully override the release name | `""` | + +### Image Parameters + +| Name | Description | Default | +|------|-------------|---------| +| `image.repository` | AdGuard Home image repository | `adguard/adguardhome` | +| `image.tag` | Image tag | `v0.107.79` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `imagePullSecrets` | Image pull secrets | `[]` | + +### Deployment Parameters + +| Name | Description | Default | +|------|-------------|---------| +| `replicaCount` | Number of replicas (keep at 1 - AdGuard Home is not multi-writer safe) | `1` | +| `revisionHistoryLimit` | Revisions to retain | `3` | +| `podSecurityContext.runAsNonRoot` | Run as non-root | `true` | +| `podSecurityContext.runAsUser` | User ID | `1000` | +| `podSecurityContext.runAsGroup` | Group ID | `1000` | +| `podSecurityContext.fsGroup` | Filesystem group ID | `1000` | +| `containerSecurityContext.capabilities.add` | Capabilities added (NET_BIND_SERVICE for ports < 1024) | `["NET_BIND_SERVICE"]` | +| `hostNetwork` | Use host networking (required for DHCP, recommended for accurate client IPs) | `false` | +| `nodeSelector` | Node selector | `{}` | +| `tolerations` | Tolerations | `[]` | +| `affinity` | Affinity rules | `{}` | + +### Ports Parameters + +| Name | Description | Default | +|------|-------------|---------| +| `ports.web.port` | Admin dashboard / setup wizard | `3000` | +| `ports.dns.port` | Plain DNS (TCP+UDP) | `53` | +| `ports.dot.enabled` | Enable DNS-over-TLS / DNS-over-QUIC | `false` | +| `ports.dot.port` | DoT/DoQ port (TCP+UDP) | `853` | +| `ports.https.enabled` | Enable DNS-over-HTTPS / HTTPS admin dashboard | `false` | +| `ports.https.port` | HTTPS port (TCP+UDP) | `443` | +| `ports.dnscrypt.enabled` | Enable DNSCrypt | `false` | +| `ports.dnscrypt.port` | DNSCrypt port (TCP+UDP) | `5443` | +| `ports.dhcp.enabled` | Enable DHCP server (67/68 UDP, requires `hostNetwork: true`) | `false` | +| `ports.pprof.enabled` | Enable the debug pprof API | `false` | +| `ports.pprof.port` | pprof port | `6060` | + +### Service Parameters + +| Name | Description | Default | +|------|-------------|---------| +| `service.type` | Service type | `ClusterIP` | +| `service.annotations` | Service annotations | `{}` | +| `service.loadBalancerIP` | Static LoadBalancer IP (e.g. for MetalLB) | `""` | + +### Ingress Parameters + +| Name | Description | Default | +|------|-------------|---------| +| `ingress.enabled` | Enable ingress (routes to the admin dashboard only) | `false` | +| `ingress.className` | Ingress class name | `""` | +| `ingress.annotations` | Ingress annotations | See values.yaml | +| `ingress.hosts` | Ingress hosts | See values.yaml | +| `ingress.tls` | TLS configuration | See values.yaml | + +### Persistence Parameters + +| Name | Description | Default | +|------|-------------|---------| +| `persistence.work.enabled` | Persist `/opt/adguardhome/work` (query log, filter cache, stats) | `true` | +| `persistence.work.existingClaim` | Use an existing PVC instead of creating one | `""` | +| `persistence.work.storageClass` | Storage class | `""` | +| `persistence.work.accessMode` | Access mode | `ReadWriteOnce` | +| `persistence.work.size` | PVC size | `1Gi` | +| `persistence.conf.enabled` | Persist `/opt/adguardhome/conf` (AdGuardHome.yaml) | `true` | +| `persistence.conf.existingClaim` | Use an existing PVC instead of creating one | `""` | +| `persistence.conf.storageClass` | Storage class | `""` | +| `persistence.conf.accessMode` | Access mode | `ReadWriteOnce` | +| `persistence.conf.size` | PVC size | `100Mi` | + +### Resource Parameters + +| Name | Description | Default | +|------|-------------|---------| +| `resources` | Resource limits and requests | `{}` | + +### Health Check Parameters + +| Name | Description | Default | +|------|-------------|---------| +| `probes.liveness.enabled` | Enable liveness probe (TCP check on the admin web port) | `true` | +| `probes.liveness.initialDelaySeconds` | Liveness initial delay | `15` | +| `probes.liveness.periodSeconds` | Liveness period | `30` | +| `probes.readiness.enabled` | Enable readiness probe (TCP check on the admin web port) | `true` | +| `probes.readiness.initialDelaySeconds` | Readiness initial delay | `5` | +| `probes.readiness.periodSeconds` | Readiness period | `10` | + +### Other Parameters + +| Name | Description | Default | +|------|-------------|---------| +| `extraEnv` | Additional environment variables | `[]` | +| `extraVolumeMounts` | Additional volume mounts | `[]` | +| `extraVolumes` | Additional volumes | `[]` | + +## Notes + +- AdGuard Home has no supported way to bootstrap its admin account or DNS settings via + environment variables - complete the setup wizard once at `http://:3000` + after the first install. The resulting `AdGuardHome.yaml` is written to the `conf` PVC, + so it survives pod restarts/upgrades. +- Because AdGuard Home stores state on disk and isn't multi-writer safe, do not scale + `replicaCount` beyond `1`. +- If you plan to use this as your network's DNS resolver, prefer `hostNetwork: true` (or + a LoadBalancer Service with `externalTrafficPolicy: Local`) so AdGuard Home sees real + client IPs rather than a single Service/NAT IP for every device. + +## Troubleshooting + +- **Clients all show up as the same IP / filters by client don't work**: enable `hostNetwork` or use `externalTrafficPolicy: Local` on a LoadBalancer Service. +- **DHCP doesn't hand out leases**: DHCP only works with `hostNetwork: true`. +- **Setup wizard settings don't persist**: verify `persistence.conf.enabled` is `true` and the PVC is bound. + +```bash +kubectl logs -f deployment/adguard-home +kubectl describe pod -l app.kubernetes.io/name=adguard-home +``` + +## Links + +- [AdGuard Home GitHub](https://github.com/AdguardTeam/AdGuardHome) +- [AdGuard Home Docker documentation](https://adguard-dns.io/kb/adguard-home/docker/) +- [Chart Source](https://github.com/rtomik/helm-charts/tree/main/charts/adguard-home) diff --git a/charts/adguard-home/templates/_helpers.tpl b/charts/adguard-home/templates/_helpers.tpl new file mode 100644 index 0000000..ca2cf9e --- /dev/null +++ b/charts/adguard-home/templates/_helpers.tpl @@ -0,0 +1,45 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "adguard-home.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +*/}} +{{- define "adguard-home.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- printf "%s" $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "adguard-home.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "adguard-home.labels" -}} +helm.sh/chart: {{ include "adguard-home.chart" . }} +{{ include "adguard-home.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "adguard-home.selectorLabels" -}} +app.kubernetes.io/name: {{ include "adguard-home.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/charts/adguard-home/templates/deployment.yaml b/charts/adguard-home/templates/deployment.yaml new file mode 100644 index 0000000..424609d --- /dev/null +++ b/charts/adguard-home/templates/deployment.yaml @@ -0,0 +1,150 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "adguard-home.fullname" . }} + labels: + {{- include "adguard-home.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicaCount }} + revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} + selector: + matchLabels: + {{- include "adguard-home.selectorLabels" . | nindent 6 }} + strategy: + type: Recreate + template: + metadata: + labels: + {{- include "adguard-home.selectorLabels" . | nindent 8 }} + annotations: + {{- with .Values.podAnnotations }} + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.hostNetwork }} + hostNetwork: true + dnsPolicy: ClusterFirstWithHostNet + {{- end }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.containerSecurityContext | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: web + containerPort: {{ .Values.ports.web.port }} + protocol: TCP + - name: dns-tcp + containerPort: {{ .Values.ports.dns.port }} + protocol: TCP + - name: dns-udp + containerPort: {{ .Values.ports.dns.port }} + protocol: UDP + {{- if .Values.ports.dot.enabled }} + - name: dot-tcp + containerPort: {{ .Values.ports.dot.port }} + protocol: TCP + - name: dot-udp + containerPort: {{ .Values.ports.dot.port }} + protocol: UDP + {{- end }} + {{- if .Values.ports.https.enabled }} + - name: https-tcp + containerPort: {{ .Values.ports.https.port }} + protocol: TCP + - name: https-udp + containerPort: {{ .Values.ports.https.port }} + protocol: UDP + {{- end }} + {{- if .Values.ports.dnscrypt.enabled }} + - name: dnscrypt-tcp + containerPort: {{ .Values.ports.dnscrypt.port }} + protocol: TCP + - name: dnscrypt-udp + containerPort: {{ .Values.ports.dnscrypt.port }} + protocol: UDP + {{- end }} + {{- if .Values.ports.dhcp.enabled }} + - name: dhcp-server + containerPort: 67 + protocol: UDP + - name: dhcp-client + containerPort: 68 + protocol: UDP + {{- end }} + {{- if .Values.ports.pprof.enabled }} + - name: pprof + containerPort: {{ .Values.ports.pprof.port }} + protocol: TCP + {{- end }} + {{- if .Values.probes.liveness.enabled }} + livenessProbe: + tcpSocket: + port: web + initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }} + periodSeconds: {{ .Values.probes.liveness.periodSeconds }} + timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }} + failureThreshold: {{ .Values.probes.liveness.failureThreshold }} + successThreshold: {{ .Values.probes.liveness.successThreshold }} + {{- end }} + {{- if .Values.probes.readiness.enabled }} + readinessProbe: + tcpSocket: + port: web + initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }} + periodSeconds: {{ .Values.probes.readiness.periodSeconds }} + timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }} + failureThreshold: {{ .Values.probes.readiness.failureThreshold }} + successThreshold: {{ .Values.probes.readiness.successThreshold }} + {{- end }} + {{- with .Values.extraEnv }} + env: + {{- toYaml . | nindent 12 }} + {{- end }} + volumeMounts: + {{- if .Values.persistence.work.enabled }} + - name: work + mountPath: /opt/adguardhome/work + {{- end }} + {{- if .Values.persistence.conf.enabled }} + - name: conf + mountPath: /opt/adguardhome/conf + {{- end }} + {{- with .Values.extraVolumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumes: + {{- if .Values.persistence.work.enabled }} + - name: work + persistentVolumeClaim: + claimName: {{ .Values.persistence.work.existingClaim | default (printf "%s-work" (include "adguard-home.fullname" .)) }} + {{- end }} + {{- if .Values.persistence.conf.enabled }} + - name: conf + persistentVolumeClaim: + claimName: {{ .Values.persistence.conf.existingClaim | default (printf "%s-conf" (include "adguard-home.fullname" .)) }} + {{- end }} + {{- with .Values.extraVolumes }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/adguard-home/templates/ingress.yaml b/charts/adguard-home/templates/ingress.yaml new file mode 100644 index 0000000..87da1e9 --- /dev/null +++ b/charts/adguard-home/templates/ingress.yaml @@ -0,0 +1,43 @@ +{{- if .Values.ingress.enabled -}} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "adguard-home.fullname" . }} + labels: + {{- include "adguard-home.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if .Values.ingress.className }} + ingressClassName: {{ .Values.ingress.className }} + {{- end }} + {{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + {{- if .secretName }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + pathType: {{ .pathType }} + backend: + service: + name: {{ include "adguard-home.fullname" $ }} + port: + number: {{ $.Values.ports.web.port }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/adguard-home/templates/pvc.yaml b/charts/adguard-home/templates/pvc.yaml new file mode 100644 index 0000000..ae99837 --- /dev/null +++ b/charts/adguard-home/templates/pvc.yaml @@ -0,0 +1,43 @@ +{{- if and .Values.persistence.work.enabled (not .Values.persistence.work.existingClaim) }} +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ include "adguard-home.fullname" . }}-work + labels: + {{- include "adguard-home.labels" . | nindent 4 }} + {{- with .Values.persistence.work.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + accessModes: + - {{ .Values.persistence.work.accessMode | quote }} + {{- if .Values.persistence.work.storageClass }} + storageClassName: {{ .Values.persistence.work.storageClass | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.persistence.work.size | quote }} +{{- end }} +--- +{{- if and .Values.persistence.conf.enabled (not .Values.persistence.conf.existingClaim) }} +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ include "adguard-home.fullname" . }}-conf + labels: + {{- include "adguard-home.labels" . | nindent 4 }} + {{- with .Values.persistence.conf.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + accessModes: + - {{ .Values.persistence.conf.accessMode | quote }} + {{- if .Values.persistence.conf.storageClass }} + storageClassName: {{ .Values.persistence.conf.storageClass | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.persistence.conf.size | quote }} +{{- end }} diff --git a/charts/adguard-home/templates/service.yaml b/charts/adguard-home/templates/service.yaml new file mode 100644 index 0000000..53108b7 --- /dev/null +++ b/charts/adguard-home/templates/service.yaml @@ -0,0 +1,76 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "adguard-home.fullname" . }} + labels: + {{- include "adguard-home.labels" . | nindent 4 }} + {{- with .Values.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.service.type }} + {{- if .Values.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.service.loadBalancerIP }} + {{- end }} + ports: + - name: web + port: {{ .Values.ports.web.port }} + targetPort: web + protocol: TCP + - name: dns-tcp + port: {{ .Values.ports.dns.port }} + targetPort: dns-tcp + protocol: TCP + - name: dns-udp + port: {{ .Values.ports.dns.port }} + targetPort: dns-udp + protocol: UDP + {{- if .Values.ports.dot.enabled }} + - name: dot-tcp + port: {{ .Values.ports.dot.port }} + targetPort: dot-tcp + protocol: TCP + - name: dot-udp + port: {{ .Values.ports.dot.port }} + targetPort: dot-udp + protocol: UDP + {{- end }} + {{- if .Values.ports.https.enabled }} + - name: https-tcp + port: {{ .Values.ports.https.port }} + targetPort: https-tcp + protocol: TCP + - name: https-udp + port: {{ .Values.ports.https.port }} + targetPort: https-udp + protocol: UDP + {{- end }} + {{- if .Values.ports.dnscrypt.enabled }} + - name: dnscrypt-tcp + port: {{ .Values.ports.dnscrypt.port }} + targetPort: dnscrypt-tcp + protocol: TCP + - name: dnscrypt-udp + port: {{ .Values.ports.dnscrypt.port }} + targetPort: dnscrypt-udp + protocol: UDP + {{- end }} + {{- if .Values.ports.dhcp.enabled }} + - name: dhcp-server + port: 67 + targetPort: dhcp-server + protocol: UDP + - name: dhcp-client + port: 68 + targetPort: dhcp-client + protocol: UDP + {{- end }} + {{- if .Values.ports.pprof.enabled }} + - name: pprof + port: {{ .Values.ports.pprof.port }} + targetPort: pprof + protocol: TCP + {{- end }} + selector: + {{- include "adguard-home.selectorLabels" . | nindent 4 }} diff --git a/charts/adguard-home/values.yaml b/charts/adguard-home/values.yaml new file mode 100644 index 0000000..96993be --- /dev/null +++ b/charts/adguard-home/values.yaml @@ -0,0 +1,161 @@ +## Global settings +nameOverride: "" +fullnameOverride: "" + +## Image settings +image: + repository: adguard/adguardhome + tag: "v0.107.79" + pullPolicy: IfNotPresent + +imagePullSecrets: [] + +## Deployment settings +## AdGuard Home keeps its state on disk (PVCs below) and is not designed to run as +## multiple replicas against the same data - keep replicaCount at 1. +replicaCount: 1 +revisionHistoryLimit: 3 + +## Pod security settings +## AdGuard Home's own startup check refuses to run on its first launch unless the +## process euid is 0 ("this is the first launch of adguard home; you must run it as +## administrator"), so - unlike most charts here - this one runs as root. Capabilities +## are still dropped to the minimum the binary needs. +podSecurityContext: + runAsNonRoot: false + runAsUser: 0 + fsGroup: 0 + +containerSecurityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + capabilities: + drop: + - ALL + add: + - NET_BIND_SERVICE + - CHOWN + - DAC_OVERRIDE + - SETUID + - SETGID + +## Pod scheduling +nodeSelector: {} +tolerations: [] +affinity: {} +podAnnotations: {} + +## Use host networking. Required if you enable the DHCP server, and recommended +## when exposing DNS so AdGuard Home sees real client IPs instead of the pod/service IP. +hostNetwork: false + +## Ports exposed by AdGuard Home. web+dns are enabled by default; the rest are +## optional protocols you can turn on as needed. +## https://adguard-dns.io/kb/adguard-home/docker/ +ports: + web: + # Admin dashboard / setup wizard + port: 3000 + dns: + # Plain DNS (TCP+UDP) + port: 53 + dot: + # DNS-over-TLS / DNS-over-QUIC (TCP+UDP) + enabled: false + port: 853 + https: + # DNS-over-HTTPS and HTTPS admin dashboard (TCP+UDP) + enabled: false + port: 443 + dnscrypt: + # DNSCrypt (TCP+UDP) + enabled: false + port: 5443 + dhcp: + # DHCP server (UDP 67/68). Requires hostNetwork: true. + enabled: false + pprof: + # Debug pprof API - leave disabled unless troubleshooting + enabled: false + port: 6060 + +## Service settings +## For exposing DNS to your LAN, set type to LoadBalancer (e.g. with MetalLB) and +## add annotations/loadBalancerIP as needed, or use type: NodePort. +service: + type: ClusterIP + annotations: {} + # loadBalancerIP: 192.168.1.53 + +## Ingress settings (routes to the admin web UI only) +ingress: + enabled: false + className: "" + annotations: + traefik.ingress.kubernetes.io/router.entrypoints: websecure + hosts: + - host: adguard.domain.com + paths: + - path: / + pathType: Prefix + tls: + - hosts: + - adguard.domain.com + +## Persistence settings +persistence: + work: + # /opt/adguardhome/work - query log, filter cache, stats + enabled: true + existingClaim: "" + storageClass: "" + accessMode: ReadWriteOnce + size: 1Gi + annotations: {} + conf: + # /opt/adguardhome/conf - AdGuardHome.yaml configuration + enabled: true + existingClaim: "" + storageClass: "" + accessMode: ReadWriteOnce + size: 100Mi + annotations: {} + +## Resource limits and requests +resources: {} +# resources: +# limits: +# cpu: 500m +# memory: 256Mi +# requests: +# cpu: 50m +# memory: 64Mi + +## Application health checks +## Uses a TCP check against the admin web port. The DNS listener only comes up after +## the first-run setup wizard is completed, so probing the DNS port instead would +## fail/restart the pod before it's ever configured; the web port is always up. +probes: + liveness: + enabled: true + initialDelaySeconds: 15 + periodSeconds: 30 + timeoutSeconds: 5 + failureThreshold: 3 + successThreshold: 1 + readiness: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + successThreshold: 1 + +## Extra environment variables +extraEnv: [] + +## Extra volume mounts +extraVolumeMounts: [] + +## Extra volumes +extraVolumes: []