diff --git a/playbooks/update_exclusions.yml b/playbooks/update_exclusions.yml
new file mode 100644
index 0000000..1353227
--- /dev/null
+++ b/playbooks/update_exclusions.yml
@@ -0,0 +1,63 @@
+---
+- name: Update AdGuard VPN exclusions
+  hosts: your_nuc
+  gather_facts: no
+  vars:
+    exclusions_url: "https://raw.githubusercontent.com/lib4u/amnezia-tunneling-ru/main/amnezia.json"
+    # альтернативный список: https://raw.githubusercontent.com/Internet-Helper/Unblock-for-Russia/main/for-AGH.txt
+    telegram_token: "{{ telegram_token }}"   # задать в AWX как extra_var или credential
+    telegram_chat_id: "{{ telegram_chat_id }}"
+  tasks:
+    - name: Download current exclusion list
+      ansible.builtin.uri:
+        url: "{{ exclusions_url }}"
+        return_content: yes
+      register: exclusions_raw
+
+    - name: Extract domains from JSON (if JSON)
+      ansible.builtin.set_fact:
+        domains: "{{ exclusions_raw.content | from_json | json_query('domains') }}"
+      when: exclusions_raw.content | from_json | type_debug == 'dict'
+      ignore_errors: yes
+
+    - name: Extract domains from plain text (if not JSON)
+      ansible.builtin.set_fact:
+        domains: "{{ exclusions_raw.content | split('\n') | reject('match', '^#') | reject('match', '^$') | list }}"
+      when: domains is not defined
+
+    - name: Count domains
+      ansible.builtin.debug:
+        msg: "Found {{ domains | length }} domains to exclude"
+
+    - name: Clear existing exclusions
+      ansible.builtin.command:
+        cmd: adguardvpn-cli site-exclusions clear
+      changed_when: true
+
+    - name: Set exclusion mode to GENERAL
+      ansible.builtin.command:
+        cmd: adguardvpn-cli site-exclusions mode general
+      changed_when: true
+
+    - name: Add each domain as exclusion
+      ansible.builtin.command:
+        cmd: "adguardvpn-cli site-exclusions add {{ item }}"
+      loop: "{{ domains }}"
+      when: domains | length > 0
+      loop_control:
+        pause: 0.1   # небольшая задержка, чтобы не перегрузить CLI
+      changed_when: true
+
+    - name: Restart VPN to apply changes
+      ansible.builtin.command:
+        cmd: "adguardvpn-cli disconnect && adguardvpn-cli connect"
+      changed_when: true
+
+    - name: Send Telegram notification
+      community.general.telegram:
+        token: "{{ telegram_token }}"
+        api_args:
+          chat_id: "{{ telegram_chat_id }}"
+          text: "✅ Список исключений обновлён. Добавлено {{ domains | length }} доменов."
+      delegate_to: localhost
+      when: telegram_token is defined and telegram_chat_id is defined
\ No newline at end of file