rootguard

RootGuard is a self-hosted DNS protection stack deployed with Docker Compose. It pairs AdGuard Home, used for network-wide DNS filtering, with a private recursive Unbound resolver that queries the DNS hierarchy and validates DNSSEC. Devices on the network point at the stack's DNS endpoint, so ads and known trackers can be blocked for televisions, phones, game consoles, computers and other clients without installing an extension or app on each device. The README is published in German and English. The project is a monorepo with several independently buildable components: - RootGuard WebApp: login, dashboard and guided management. - RootGuard Core: orchestration and validated configuration changes. - RootGuard Updater: coordinated Core/WebApp updates with rollback. - AdGuard Home: network-wide DNS filtering. - Unbound: recursive DNS resolution and DNSSEC validation. - rootguard-unbound: hardened Unbound image. - rootguard-blockpage: landing page for blocked requests. - rootguard-attestation-proxy: egress proxy for cosign attestation checks. Formerly separate repositories are archived but still readable for history and old issues; active development now happens only in this monorepo. Getting started requires Docker Compose v2. The release-candidate phase publishes ready-made amd64 and arm64 images, so no local build is needed. The documented flow is to download compose.release.yaml and .env.release.example for the tag, generate two independent secrets with openssl rand -hex 32, set a strong admin password plus separate API and recovery tokens in .env, and start the stack with docker compose. Users then open the web GUI on port 8080 and follow the guided setup, which offers a recommended Stable channel and an explicitly experimental AdGuard Home Beta channel. The README warns that beta may contain bugs and that DNS resolution and blocking must not be treated as fail-safe when it is selected. Requirements, router configuration, upgrades and troubleshooting are covered in the online handbook. The web interface also handles configuration, updates, health checks, diagnostics and rollbacks, and provides guided local DNS management: local records, private domains, conditional forwarding and RFC1918 reverse zones without editing raw Unbound files. RootGuard is in public release-candidate testing ahead of 1.0, and the maintainers state it is not yet recommended as the only DNS service in a production network. The repository documents architecture and trust boundaries, current project state, roadmap, changelog, image digests and retention policy, verified installation platforms, a performance and memory baseline, and an accessibility and security review. Quality assurance combines human code review with an AI-assisted tool that looks for bugs and security risks; findings are verified by a human before being fixed, and audit rounds are logged publicly. Contributions are welcome via a contributor guide, good first issue and help wanted labels, while security problems should be reported privately. The software is licensed AGPL-3.0-or-later, with a separate trademark policy for the RootGuard and Foxly IT names and logos. Screenshots in the README come from a verified deployment on an isolated test host using the documented default account.