#!/usr/bin/env bash
#
# A second AdGuard Home that keeps DNS working when the first one dies
# https://www.zadran.net/guides/second-adguard-home-that-stays-in-sync
# Generated from the guide, last updated 2026-10-13.
#
# NO WARRANTY. This script is provided as is. You are responsible for
# understanding what it does before running it, and for the consequences.
# Take a backup first. See https://www.zadran.net/disclaimer
#
# Destructive steps are left commented out on purpose -- uncomment them
# only once you have understood what they do.
#
# These are the guide's bash commands. Its PowerShell commands are in
# https://www.zadran.net/guides/second-adguard-home-that-stays-in-sync/script.ps1

set -euo pipefail

# ---- Set these for your environment ----
# The one you already run and configure
AG1_IP='192.168.1.6'
# A free IP on your network
AG2_IP='192.168.1.30'
# Usually your router
GATEWAY='192.168.1.1'
# Any number not already used on the second node
CTID='130'
# Only used for the failover test
AG1_CTID='106'

pveam update
TPL=$(pveam available --section system | awk '/debian-13-standard.*_amd64/ {print $2}' | sort -V | tail -1)
echo "Downloading: $TPL"
pveam download local "$TPL"

TPL=$(ls /var/lib/vz/template/cache/ | grep 'debian-13-standard.*_amd64' | sort -V | tail -1)

pct create ${CTID} local:vztmpl/$TPL \
  --hostname adguard2 \
  --cores 1 --memory 512 --swap 256 \
  --rootfs local-lvm:4 \
  --net0 name=eth0,bridge=vmbr0,ip=${AG2_IP}/24,gw=${GATEWAY} \
  --nameserver ${GATEWAY} \
  --unprivileged 1 --features nesting=1 \
  --onboot 1

pct start ${CTID}
pct exec ${CTID} -- passwd

pct exec ${CTID} -- bash -c "apt update && apt full-upgrade -y && apt install -y curl"
pct exec ${CTID} -- bash -c "curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v"

pct enter ${CTID}

URL=$(curl -s https://api.github.com/repos/bakito/adguardhome-sync/releases/latest | grep browser_download_url | grep 'linux_amd64.tar.gz"' | cut -d '"' -f4)
curl -sL "$URL" | tar -xz -C /usr/local/bin adguardhome-sync
chmod +x /usr/local/bin/adguardhome-sync

read -rp  "AdGuard #1 username: " U1; read -rsp "AdGuard #1 password: " P1; echo
read -rp  "AdGuard #2 username: " U2; read -rsp "AdGuard #2 password: " P2; echo

mkdir -p /etc/adguardhome-sync
cat > /etc/adguardhome-sync/config.yaml <<EOF
cron: "*/10 * * * *"
runOnStart: true
origin:
  url: http://${AG1_IP}:80
  username: '$U1'
  password: '$P1'
replicas:
  - url: http://${AG2_IP}:80
    username: '$U2'
    password: '$P2'
api:
  port: 8080
features:
  dhcp:
    serverConfig: false
    staticLeases: false
EOF
chmod 600 /etc/adguardhome-sync/config.yaml
unset P1 P2

cat > /etc/systemd/system/adguardhome-sync.service <<'EOF'
[Unit]
Description=AdGuard Home Sync
After=network-online.target AdGuardHome.service
Wants=network-online.target

[Service]
ExecStart=/usr/local/bin/adguardhome-sync run --config /etc/adguardhome-sync/config.yaml
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable --now adguardhome-sync
journalctl -u adguardhome-sync -n 20 --no-pager

pct stop ${AG1_CTID}

nslookup doubleclick.net

pct start ${AG1_CTID}