Hello,
I need help with a very specific problem; I don’t understand what I’ve done…
Background
I have an OpenWRT router, and behind it a Debian server which I use as a reverse proxy. The router is running AdGuard Home.
The reverse proxy listens on *.mydomain.tld and forwards requests to various addresses, so that I can access my services from outside the network.
Adguard-Home is configured to respond to DNS-over-TLS requests via clientid.adguard.mydomain.tld.
The Debian server also runs acme.sh to manage SSL certificates.
Everything was working more or less fine until this morning.
The problem
I often have issues with certificate renewal. Acme.sh used to place the certificates in a folder mounted via NFS.
As it struck me as a rather shoddy job (I know 
), I wanted to change this approach... So I used an SSH deploy-hook. It worked very well…
EXCEPT that since then, I’ve lost access to adguard.domain.tld.
As a result, I can no longer use DNS-over-TLS… I don’t understand what’s going on.
From the debian server I get:
root@Debian:~# curl -v https://adguard.mydomaine.tld
* Could not resolve host: adguard.mydomaine.tld
* shutting down connection #0
curl: (6) Could not resolve host: adguard.mydomaine.tld
root@Debian:~# curl -v http://192.168.0.1:8083
* Trying 192.168.0.1:8083...
* Connected to 192.168.0.1 (192.168.0.1) port 8083
* using HTTP/1.x
> GET / HTTP/1.1
> Host: 192.168.0.1:8083
> User-Agent: curl/8.14.1
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 302 Found
< Content-Type: text/html; charset=utf-8
< Location: /login.html
< Date: Wed, 02 Sep 2026 10:47:50 GMT
< Content-Length: 34
<
<a href="/login.html">Found</a>.
* Connection #0 to host 192.168.0.1 left intact
root@Debian:~# curl -v http://adguard.mydomaine.tld:8083
* Could not resolve host: adguard.mydomaine.tld
* shutting down connection #0
curl: (6) Could not resolve host: adguard.mydomaine.tld
And from the outside (here my phone):
root@localhost:~# curl -v https://mydomain.tld
* Host mydomain.tld:443 was resolved.
* IPv6: (none)
* IPv4: IP
* Trying IP:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
* ALPN: server accepted h2
* Server certificate:
* subject: CN=mydomain.tld
* start date: Sep 2 10:39:56 2026 GMT
* expire date: Dec 1 10:39:55 2026 GMT
* subjectAltName: host "mydomain.tld" matched cert's "mydomain.tld"
* issuer: C=US; O=Let's Encrypt; CN=YE2
* SSL certificate verify ok.
* Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA384
* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
* Certificate level 2: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
* Certificate level 3: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
* Connected to mydomain.tld (31.37.1.131) port 443
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://mydomain.tld/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: mydomain.tld]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.14.1]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: mydomain.tld
> User-Agent: curl/8.14.1
> Accept: */*
>
* Request completely sent off
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
< HTTP/2 200
< server: nginx
< date: Wed, 02 Sep 2026 12:46:49 GMT
< content-type: text/html
< content-length: 1403
[...]
* Connection #0 to host mydomain.tld left intact
</html>
root@localhost:~# curl -v https://adguard.mydomain.tld
* Could not resolve host: adguard.mydomain.tld
* shutting down connection #0
curl: (6) Could not resolve host: adguard.mydomain.tld
I can’t even begin to understand where this might be coming from. The reverse proxy was working; I haven’t touched it, and it’s still working (except for adguard.mydomain.tld). The certificate is being read correctly by adguard-home, and it’s valid.
I haven’t changed anything in the router’s routing rules or any other AdGuard Home settings. And once again, it was working this morning before I messed it up
I’m at a loss – can anyone here point me in the right direction?
