Skip to main content

Integrations

Docker installations can connect optional services from Settings > Integrations. Every integration is disabled by default, and secrets are kept write-only in API responses.

At a glance​

IntegrationWhat it addsData handling
AdGuard HomeNetwork-wide and per-device DNS destinations and blocked totalsStores aggregate counters, not raw DNS responses
Pi-hole v6DNS destinations, blocked totals, and DHCP client discoveryStores aggregate counters and current lease identity data, not raw DNS responses
Technitium DNS Server v15+DNS destinations and blocked totals, with optional DHCP enrichmentStores aggregate counters and selected lease identity data, not raw DNS responses
Speedtest TrackerLatest internet result and health on the dashboardStores settings and latest processed health state, not result history
HomeBoxSearch and link an existing inventory item to a deviceStores the linked item ID; does not synchronize inventory
Docker inventoryRunning containers, health, addresses, restarts, and published portsReads the local Docker engine from the scheduler

Docker inventory​

LanGuard can inventory running containers on the same Docker engine that runs its scheduler. It reads metadata only; LanGuard does not provide start, stop, restart, logs, terminal, deployment, or configuration actions. Remote Docker hosts are not supported by this integration.

Docker socket access​

The current Compose file mounts the local Docker socket into the scheduler service:

services:
  scanner:
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

Existing installations must add this volume and recreate the scheduler container. A Docker socket is highly privileged even when the bind mount is marked read-only because API calls control access, not filesystem write permissions. LanGuard limits its implementation to GET requests and mounts the socket only into the scheduler. Do not expose unauthenticated Docker TCP port 2375.

Configure inventory​

  1. Make sure the Docker server already exists as a LanGuard device.
  2. Open Settings > Integrations > Docker inventory.
  3. Select that device, enter a display name, choose the synchronization interval, and save.
  4. The scheduler queues the first synchronization automatically. Sync now requests another run within the scheduler's next one-minute check.
  5. Open Docker from the main navigation to inspect containers and published ports across the configured host.

The scheduler checks once per minute and synchronizes when the configured interval is due. Newly discovered containers and newly published host ports are recorded in device history.

Bridge and host-network containers remain associated with their Docker host. Containers attached through macvlan or ipvlan receive independent LAN addresses; when an address matches a LanGuard device, the container is linked to that device automatically.

Port mappings distinguish the host port from the internal container port. For example, Host 8080 → Container 80 means connections to port 8080 on the Docker host are forwarded to port 80 inside the container. A check mark means the LanGuard network scanner also found that host port reachable; it is confirmation of the mapping, not a deployment warning. Docker metadata and LAN reachability do not prove Internet exposure.

AdGuard Home​

  1. Enable query logging in AdGuard Home.
  2. Enable AdGuard Home in LanGuard.
  3. Enter its URL and credentials, then select Test connection.
  4. Save and select Sync now for the first import.
  5. Open the central DNS Activity page or a device's DNS activity tab.

The scheduler imports aggregated counters per device, domain, and query type. Each query is matched against the device that owned the client IPv4 address at the query time, so later DHCP changes or address reuse do not move activity between devices. Queries without one reliable historical owner remain in unmatched-client diagnostics instead of being guessed.

The configured retention period removes old DNS aggregates. IP assignment history is independent of event and DNS retention and remains available for the lifetime of the device. After upgrading from an older LanGuard release, current assignments begin when the migration runs; LanGuard does not infer earlier ownership that it did not observe.

Device attribution: AdGuard Home must record the originating device IP. If all requests reach it through the router, LanGuard can associate the activity only with that router. Configure DHCP or clients to use AdGuard Home directly when device-level attribution is required.

Pi-hole​

Pi-hole v6 is supported as an alternative to AdGuard Home. Only one DNS activity provider can be enabled at a time so the same query is not counted twice.

  1. In Pi-hole, create an application password under Settings > Web interface / API.
  2. Enable Pi-hole in Settings > Integrations > Network services.
  3. Enter the Pi-hole URL and application password, then select Test connection.
  4. Save and select Sync now for the first import.
  5. Open the central DNS Activity page or a device's DNS activity tab.

LanGuard uses the supported Pi-hole v6 API. It imports aggregated DNS counters and can optionally read current DHCP leases; it does not mount Pi-hole databases or configuration files. Queries are attributed using LanGuard's historical IP ownership at the query time. Sync DHCP leases enriches existing devices by MAC address. Create devices from leases is a separate opt-in for adding unmatched valid leases as Unknown devices. A known device's name, hostname, icon, and other user-managed identity remain protected.

Pi-hole is not a presence monitor. A lease can be active while a device is away, and a missing lease does not prove that a device is offline. LanGuard therefore never marks a device offline merely because it is absent from Pi-hole.

Device attribution: Pi-hole must see each originating client IP. DNS requests forwarded by a router are attributed to that router rather than guessed. Pi-hole DHCP discovery is available only when Pi-hole itself has active lease data.

Technitium DNS Server​

Technitium DNS Server v15 or later is supported as an alternative to AdGuard Home and Pi-hole. Only one DNS activity provider can be enabled at a time.

  1. Install and enable a compatible Query Logs app in Technitium. LanGuard discovers the active query-log implementation dynamically, so SQLite, PostgreSQL, MySQL, and SQL Server-backed apps are supported when they expose Technitium's Query Logs API.
  2. Create a Technitium API token with Logs: View permission. Add DHCP: View only when DHCP lease synchronization is required.
  3. Enable Technitium DNS Server in Settings > Integrations > Network services.
  4. Enter the Technitium web-console URL and API token, then select Test connection.
  5. Save and select Sync now for the first import.

LanGuard sends the token only in the Authorization: Bearer header. Use HTTPS when Technitium is reached across an untrusted network; plain HTTP should be limited to a trusted local network. The integration is read-only and does not change zones, server settings, DHCP scopes, or DNS applications.

DNS queries are imported incrementally and attributed using LanGuard's historical IP ownership at query time. Queries that cannot be assigned reliably remain in unmatched-client diagnostics. Optional DHCP synchronization can update the current IP and hostname of an existing unknown device by MAC address without changing user-managed known-device identity or presence. Creating Unknown devices from leases is a separate opt-in setting, and lease data never marks a device online or offline.

Speedtest Tracker​

  1. Create a Speedtest Tracker API token with the results:read ability.
  2. Enable Speedtest Tracker in LanGuard.
  3. Enter its URL and token, test the connection, and save.

LanGuard displays download, upload, ping, packet loss, health, and test time. Dashboard responses use a five-minute in-memory cache; a manual dashboard refresh requests fresh data. When health notifications are enabled, the scheduler checks for a newly scored result every five minutes.

Configure thresholds in Speedtest Tracker first. Unscored results and temporary connection failures do not send a health-change notification.

HomeBox​

LanGuard supports the /api/v1/entities API used by HomeBox v0.26.2. Releases that expose only the older /items API are not supported.

  1. Create a HomeBox API key for an account with access to the intended inventory.
  2. Enable HomeBox, enter its URL and API key, test, and save.
  3. Open a LanGuard device, select Edit device, search for a HomeBox item, and save.
  4. Use Open in HomeBox from the device page.

Search is proxied through the backend and requires device-edit permission. LanGuard does not create or update HomeBox items, and it does not copy documents, purchase records, or warranties. Clearing the selected item removes only the link.

Automation webhook​

The generic webhook channel can deliver enabled events to n8n, Home Assistant, or another HTTPS endpoint. It belongs to notification settings because it follows the same event rules, quiet hours, history, and retry policy as user-facing channels.

See Notifications for the payload and signature format.