Avery/NixOS
Avery/NixOS
1
0
Fork 0
Code Activity

feat(adguardhome): Enable encrypted DNS

Browse source
This commit is contained in:
Avery 2025-08-23 23:25:18 +00:00
parent 3bff0ca1d2
commit dffd0593a7
Signed by: Avery
GPG key ID: B684FD451B692E04
2 changed files with 16 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

3
hosts/greatyamada/services/_port-definitions.nix
View file

@ -3,6 +3,8 @@
adguardhome = { adguardhome = {
dns = 53; dns = 53;
http = 3001; http = 3001;
https = 4430;
dns_over_tls = 853;
}; };
forgejo = 3000; forgejo = 3000;
jellyfin = 8096; jellyfin = 8096;
@ -24,6 +26,7 @@
adguardhome = { adguardhome = {
dns = 53; dns = 53;
dhcp = 67; dhcp = 67;
dns_over_quic = 853;
}; };
wireguard = 51820; wireguard = 51820;
}; };

16
hosts/greatyamada/services/adguardhome.nix
View file

@ -4,8 +4,8 @@ let
nginxLocalServiceConfig = import ./nginx-local-config.nix; nginxLocalServiceConfig = import ./nginx-local-config.nix;
in { in {
networking.firewall = { networking.firewall = {
allowedTCPPorts = with ports.tcp.adguardhome; [ dns ]; allowedTCPPorts = with ports.tcp.adguardhome; [ dns dns_over_tls ];
allowedUDPPorts = with ports.udp.adguardhome; [ dns dhcp ]; allowedUDPPorts = with ports.udp.adguardhome; [ dns dhcp dns_over_quic ];
}; };
services = { services = {
adguardhome = { adguardhome = {
@ -27,6 +27,15 @@ in {
bootstrap_dns = bootstrap_dns =
[ "9.9.9.10" "149.112.112.10" "2620:fe::10" "2620:fe::fe:10" ]; [ "9.9.9.10" "149.112.112.10" "2620:fe::10" "2620:fe::fe:10" ];
}; };
tls = {
enabled = true;
server_name = "dns.rcia.dev";
port_https = ports.tcp.adguardhome.https;
port_dns_over_tls = ports.tcp.adguardhome.dns_over_tls;
port_dns_over_quic = ports.udp.adguardhome.dns_over_quic;
certificate_path = "/var/lib/acme/rcia.dev/fullchain.pem";
private_key_path = "/var/lib/acme/rcia.dev/key.pem";
};
dhcp = { dhcp = {
enabled = true; enabled = true;
interface_name = "enp5s0"; interface_name = "enp5s0";
@ -266,9 +275,10 @@ in {
nginx.virtualHosts."dns.rcia.dev" = { nginx.virtualHosts."dns.rcia.dev" = {
forceSSL = true; forceSSL = true;
locations."/".proxyPass = locations."/".proxyPass =
"http://127.0.0.1:${toString ports.tcp.adguardhome.http}"; "https://127.0.0.1:${toString ports.tcp.adguardhome.https}";
extraConfig = nginxLocalServiceConfig; extraConfig = nginxLocalServiceConfig;
useACMEHost = "rcia.dev"; useACMEHost = "rcia.dev";
}; };
}; };
users.groups.nginx.members = [ "adguardhome" ];
} }