Updating AdGuard Home

[tackynugget]

Hi there,
I hope this isn't too silly of a question--I cannot seem to find any documentation or discussion on how to update AdGuardHome when installed according to https://github.com/boostchicken/udm-utilities/tree/master/AdguardHome.

I don't want to lose any of the configs I've put in place.

Would it be safe to run step 7 commands?

podman run -d --network dns --restart always \
--name adguardhome \
-v "/mnt/data/AdguardHome-Confdir/:/opt/adguardhome/conf/" \
-v "/mnt/data/AdguardHome-Workdir/:/opt/adguardhome/work/" \
--dns=127.0.0.1 --dns=1.1.1.1 \
--hostname adguardhome \
adguard/adguardhome:latest

I had to rebuild everything from scratch before. My previous notes suggest I had some trouble getting AdGuardHome installed this way, because I had a note that I could start the installation over by running this:
Podman rm adguardhome

[tackynugget]

Ok. I took the plunge and figured it out myself after coming across this comment that suggested docker would be interchangeable with podman. I found the docker instructions here and planned out my testing.

Enabled SSH (via unifi.ui.com)

Noted current version: v0.104.3

Backed up files

• Created backup directories on my computer
• scp -r root@[IP]:/mnt/data/AdGuardHome-Confdir ~/UniFi_Backups/AdGuardHome/AdGuardHome-Confdir
• scp -r root@[IP]:/mnt/data/AdGuardHome-Workdir ~/UniFi_Backups/AdGuardHome/AdGuardHome-Workdir
• scp -r root@[IP]:/mnt/data/on_boot.d/10-dns.sh ~/UniFi_Backups/bootscript/mnt/data/on_boot.d/10-dns.sh
• scp -r root@[IP]:/mnt/data/podman/cni/20-dns.conflist ~/UniFi_Backups/bootscript/mnt/data/podman/cni/20-dns.conflist

Removed the AdGuardHome Container

• podman stop adguardhome
• podman rm adguardhome

Navigated to the AdGuardHome IP to make sure it was gone

Pulled the latest version of AdGuardHome as per the Docker documentation

• podman pull adguard/adguardhome:latest

Reinstalled AdGuardHome

podman run -d --network dns --restart always  \
--name adguardhome \
-v "/mnt/data/AdGuardHome-Confdir/:/opt/adguardhome/conf/" \
-v "/mnt/data/AdGuardHome-Workdir/:/opt/adguardhome/work/" \
--dns=127.0.0.1 --dns=1.1.1.1 \
--hostname adguardhome \
adguard/adguardhome:latest

Noted current version: v0.106.3

Confirmed settings pulled across

Verified settings continue to work by testing a custom DNS entry.

Disabled SSH (via unifi.ui.com)

I hope this helps someone else.

[FlorentCoppint]

Would it be possible to include container auto-update while starting in 10-dns.sh ?
I know how to add commands, but I don't know if it's a "best practice" to do so ?

[tackynugget]

Hi @FlorentCoppint

I'm not familiar with container auto-update. What does it do?

I have been reading a lot about the pros and cons of auto-updating software now that supply chain attacks are becoming more common.

I think auto-updating critical OS/security patches is fine, but you might want to leave yourself at least a week's time before updating other things.

As far as I understand the 10-dns.sh script in relation to the onboot script, I think the 10-dns.sh script would only run if/when the Dream Machine is rebooted.

[FlorentCoppint]

I don't know well either sorry :(

[tackynugget]

@FlorentCoppint do you have a link to the script/code you're trying to run?

[FlorentCoppint]

I was just talking about the answer you did 10 days ago, to update manually AdGuard Home container.
And I was wondering if it was possible to automate the 4 commands : podman stop / rm / pull / run
To always start an up-to-date AdGuard Home.

[tackynugget]

Ah. I understand now. Thank you for the clarification @FlorentCoppint.

I don’t know what the official best practice here would be. I imagine it would depend on your priorities. I’d be curious to hear what others think.

I wouldn’t do it for the following reasons:

1. Reboot frequency - I think the 10-dns.sh script only runs at boot, so it would only update AdGuardHome when the UDM is rebooted. I don’t know how often you reboot your UDM, so you would have to judge the usefulness of that.

2. Troubleshooting complications - If your UDM automatically updates its firmware, having AdGuardHome also update during boot (without notifying you) could make troubleshooting Ubiquiti’s notoriously buggy firmware more difficult.

3. Update frequency - Since DNS is usually pretty important, I would want to know what changes were made to AdGuardHome before applying them to my environment. It looks like we can subscribe to the release notes here: https://github.com/AdguardTeam/AdGuardHome/releases (Watch > Custom > Releases > Apply).
Also, since I don’t imagine many of us restart our UDM frequently (outside of troubleshooting or tinkering), I’m not sure if it would update any more frequently than if we did it manually.

4. Update issues - Reviewing past releases, I don’t see any patterns that suggest regular critical or security updates. As such, I would want to wait a few days after each release to let others find the issues and vulnerabilities.

5. Update objectives - Stability and security are higher priorities for my environment than testing the latest and greatest. I don’t see a significant security benefit in automating these updates. Even if I were to prioritize testing, I would want to automate this through a different mechanism besides a boot script and be fully aware of what changes to look for.

6. Update channel - I’m not sure which release podman pull adguard/adguardhome:latest pulls (the latest official release or the latest beta?), but I would want to know and control this.

I hope this helps.

What are your thoughts?

[gatesry]

The label “latest” is not always the latest. It depends on the developers updating each new release with that tag.

Podman connects to Docker.io first to look for the specified image in your run command.

The AdGuard team follows semantic versioning, and as seen above they have latest, edge, and then actual releases.

[gatesry]

Look into cron jobs. This script here adds them every startup, the individual commands can be nested inside the job. #186