Initial skills documentation — 25 categories, all SKILL.md + references + scripts

skills/devops/mikrotik-onboarding/references/dns-logging-onboarding.md

@@ -0,0 +1,32 @@
+# DNS Query Logging — Router Onboarding
+
+Added to the onboarding script after SSH key setup but before heartbeat:
+
+```
+/ip/dns/set allow-remote-requests=yes log-queries=yes log-fwd-queries=yes
+/system/logging/add action=remote topics=dns remote=10.77.0.1:514 remote-log-prefix="rtr-<customer-id>"
+```
+
+## What it captures
+
+| Field | Source |
+|---|---|
+| Domain | Every DNS query from client devices |
+| Client IP | Which internal IP made the query |
+| Time | When the query was made |
+| Record type | A, AAAA, MX, TXT, etc. |
+| Response | Resolved IP or NXDOMAIN |
+
+## Portal display
+
+The router detail page DNS tab shows:
+- Total queries, unique domains, active clients, blocked count
+- Top domains by query count (last 7 days)
+- Top client IPs by query volume
+- Individual query log with time, client, domain, type, response
+
+## Limitations
+
+- **HTTPS content is NOT visible** — only domain names from DNS lookups
+- Search queries (google.com/q=..., etc.) are NOT visible — they're inside HTTPS
+- Only shows queries that go through the router's DNS resolver; devices using external DNS (8.8.8.8) are not logged