AdGuard Home Wildcard aliases

[girish]

@lukas yeah, there is a bug in their API or I don't know how to access wildcard dns entries via their API. I have sent them an email.

I have an A record at adguard.cloudron.click. This works:

$ curl -H "Content-Type: application/json" -X POST -d '{ "apikey" : "pk1_6e058c5e56b050d8052ee869dbd137857386dcfd403698b46e6d0e7694acf241", "secretapikey" : "sk1_xx" }' https://porkbun.com/api/json/v3/dns/retrieveByNameType/cloudron.click/A/adguard

{"status":"SUCCESS","cloudflare":"enabled","records":[{"id":"313173661","name":"adguard.cloudron.click","type":"A","content":"89.58.59.112","ttl":"600","prio":"0","notes":null}]}


I have an A record at *.test.cloudron.click . This does not work:

$ curl -w '%{response_code}' -H "Content-Type: application/json" -X POST -d '{ "apikey" : "pk1_6e058c5e56b050d8052ee869dbd137857386dcfd403698b46e6d0e7694acf241", "secretapikey" : "sk1_xx" }' https://porkbun.com/api/json/v3/dns/retrieveByNameType/cloudron.click/A/*.test

    <div id="container">
        <h1>An Error Was Encountered</h1>
        <p>The URI you submitted has disallowed characters.</p>        <p>You can probably find what you're looking for on our <a href="/">homepage</a>.</p>
    </div>
400

I tried with percent encoding but that does not work either:

$ curl -w '%{response_code}' -H "Content-Type: application/json" -X POST -d '{ "apikey" : "pk1_6e058c5e56b050d8052ee869dbd137857386dcfd403698b46e6d0e7694acf241", "secretapikey" : "sk1_xx" }' https://porkbun.com/api/json/v3/dns/retrieveByNameType/cloudron.click/A/%2A.test

{"status":"SUCCESS","cloudflare":"enabled","records":[]}200

[lukas]

@girish cool, thank you for checking this. So we have to wait for Porkbuns support response, right?

[girish]

@lukas yes. Their API is quite strange, so it's kinda hard to guess. For example, all requests are POST (even to retrieve stuff).

[lukas]

@girish so until issue is fixed no chance to use AdGuard Home DoT / DoH ?

[girish]

@lukas yes

[lukas]

@girish I switched to other domain (DNS Provider: Wildcard). Now I have to create manually the *.adgaurd.mydomain.tld DNS A-Entry are there more entries which I have to create manually ?

[BrutalBirdie]

@lukas
I am using Cloudflare and for me I had to restart the app after adding a client identifier.

Now in my Android I set the eliasop7.dns.DOMAIN.TLD - this only worked after an app restart I am not sure if the app restart is really necessary.

[lukas]

@BrutalBirdie thank you but something is generally wrong here... wondering why there is no *.adguard.mydomain.tld but only *.mydomain.tld

...

here my Cloudron AdGuard Home App settings:

and If I try to connect via private DNS (Android) then I see this in Log-File:

[error] handling tcp: reading msg: reading len: remote error: tls: unknown certificate authority

[BrutalBirdie]

@lukas OH! Sorry I read the topic completely wrong! Sorry about that.

[Kubernetes]

@lukas may you explain for what reason you want to have an Alias Domain for AdGuard, please? I think 99% of all use cases doesn't need an Alias Domain for it.

[lukas]

@Kubernetes I want to use DoT / DoH on my Android / iOS devices and allow only my clients to use this AdGuard Home instance. I'm doing something wrong?

[Kubernetes]

@lukas Okay, then you don't need an Alias in Cloudron for AdGuard. What you need to do is to configure the ClientIDs as I mentioned in your other Thread directly in the AdGuard Home Admin Interface

[lukas]

@Kubernetes But If I don't need an Alias for AdGaurd in Cloudron, how do I set the Client Identifier ind Adroids Private DNS and / or in AdGuard App? Sorry but it's confusing for me.

It this Guide https://docs.cloudron.io/apps/adguard-home/#security i need DoT for my Android devices, to an wildcard alias is needed to identify my Android devices

[Kubernetes]

@lukas You have to set the ClientID in Adguard Home Admin Interface, but not in Cloudron. Then all you need to do is to combine the URL to your Adguard Home with the ClientID you have configured already.

This should look like this:
https://adguard.yourdomain.tld/dns-query/CLIENTID

I assume that you never had a look at the Adguard Home Admin Interface, did you? There is a tab "Setup Assistant" which explains how to do it with Android, Windows, Browser, iOS, Router....

I hope that helps?

[lukas]

@Kubernetes said in AdGuard Home Wildcard aliases:

This should look like this:
https://adguard.yourdomain.tld/dns-query/CLIENTID

yes, but for Android I have to use DoT and not DoH ?

DoT
DNS over TLS (DoT) is supported and uses port 853 by default. DoT is required for Android's "Private DNS mode" (available since Android 9.0 Pie).

To use Client ID identifiers, you must add a wildcard subdomain alias of the form *.adguard.domain.com.

[Kubernetes]

@lukas Ahh, okay, I don't use DoT, so I don't know how this is setup correctly.

[lukas]

@Kubernetes as I understand this, for DoT I need a wildcard domain. In AdGuard Adnroid app I can use DoH with your string, this works fine.

[girish]

@lukas to give an update, I still haven't gotten a response from Porkbun. They were supposed to reply last monday. Sent them a reminder on Friday.

[lukas]

@girish I switched now from Porkbun API to Wildcard Domain. How to get it working now?

Just get this:

Apr 29 22:16:09 2023/04/29 20:16:09.334842 [error] handling tcp: reading msg: reading len: remote error: tls: unknown certificate authority
Apr 29 22:16:09 2023/04/29 20:16:09.584416 [error] handling tcp: reading msg: reading len: remote error: tls: unknown certificate authority
Apr 29 22:16:09 2023/04/29 20:16:09.602320 [error] handling tcp: reading msg: reading len: remote error: tls: unknown certificate authority

[girish]

@lukas Yeah, so they never got back I even sent them a reminder. Please point them to this thread (if you are a customer). I sent mails from girish@cloudron.io

Unfortunately, one cannot create a wildcard certificate from the Wildcard Domain. This is because Let's Encrypt requires you to set values in the DNS to get a wildcard cert. With a wildcard provider, Cloudron has no way to program the DNS. Only fix right now is to switch to some other programmable DNS provider. Sorry...