# FIRST-BOOT SEED ONLY — AdGuard rewrites this file at runtime.
#
# It exists so the container comes up already configured instead of sitting in
# the setup wizard waiting for a human. After first boot the live copy is in
# the adguard-ana_adguard_conf volume and diverges from this file; treat this
# as the bootstrap, not as ongoing config. Notably the `rewrites:` list stays
# EMPTY here — scripts/dns-sync.py owns it from dns/internal.yaml.
#
# ⚠️ NO BLOCKLISTS, DELIBERATELY. The other two AdGuards filter ads for human
# browsing; this one resolves for a rack of servers. A blocklist false-positive
# here breaks service-to-service calls at 3am for no upside, so filtering is
# off and this instance is a plain recursive resolver plus the .internal zone.
http:
  address: 0.0.0.0:80
users:
  - name: infra-ops
    password: $2a$05$v7d1ASBg9qprZNx3Y50YqempdiL.Lo8.jMYxyVr6MroaGF0w5tQje
auth_attempts: 5
block_auth_min: 15
language: en
theme: auto
dns:
  bind_hosts:
    - 0.0.0.0
  port: 53
  upstream_dns:
    - 1.1.1.1
    - 1.0.0.1
  bootstrap_dns:
    - 1.1.1.1
    - 8.8.8.8
  protection_enabled: true
  filtering_enabled: false
  safebrowsing_enabled: false
  parental_enabled: false
  rewrites: []
filters: []
whitelist_filters: []
user_rules: []
log:
  verbose: false
schema_version: 29