feat(mercury): AdGuard Home DNS adblock + DHCP, forwards to unbound

- services/adguardhome.nix: upstream unbound, .sol local domain, DHCP 50-200 - nix-owned config (mutableSettings=false); adlists + dns declared - mercury imports adguard + unbound; drop the pick-one placeholder block - TODO: bcrypt admin password, jupiter static lease via UI (needs its MAC)
2026-07-13 20:13:01 +02:00
parent 587fcbfa3d
commit 5a23638f75
2 changed files with 74 additions and 23 deletions
@@ -0,0 +1,68 @@
+{ ... }:
+
+# AdGuard Home — network DNS (adblock) + DHCP.
+# Forwards to the local unbound recursive resolver (services/unbound.nix).
+# Config is nix-owned (mutableSettings = false): the web UI can view but not
+# persist changes — edit here and redeploy. EXCEPTION: DHCP static leases live
+# in AdGuard's separate leases.json, so add those in the UI (they persist).
+{
+  services.adguardhome = {
+    enable = true;
+    openFirewall = true;          # opens the web + DNS ports
+    mutableSettings = false;      # AdGuardHome.yaml is authoritative from nix
+    # allowDHCP is implied by settings.dhcp.enabled (grants NET_RAW/NET_BIND).
+
+    settings = {
+      # Web UI on :3000. Admin login — replace with YOUR bcrypt hash:
+      #   nix run nixpkgs#apacheHttpd -- htpasswd -B -n -b admin 'yourpassword'
+      # (take the part after "admin:"). For repo hygiene, move this to sops later.
+      http.address = "0.0.0.0:3000";
+      users = [
+        { name = "admin"; password = "$2y$10$REPLACE-WITH-BCRYPT-HASH"; }
+      ];
+
+      dns = {
+        bind_hosts = [ "0.0.0.0" ];
+        port = 53;
+        # Recursive resolution via local unbound — no public upstream.
+        upstream_dns = [ "127.0.0.1:5335" ];
+        bootstrap_dns = [ "1.1.1.1" "9.9.9.9" ];
+        upstream_mode = "load_balance";
+      };
+
+      filtering.filtering_enabled = true;
+      filters = [
+        {
+          enabled = true;
+          id = 1;
+          name = "AdGuard DNS filter";
+          url = "https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt";
+        }
+        {
+          enabled = true;
+          id = 2;
+          name = "AdAway Default Blocklist";
+          url = "https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt";
+        }
+      ];
+
+      # ---- DHCP (replaces pihole's) ----
+      dhcp = {
+        enabled = true;
+        interface_name = "eth0";
+        local_domain_name = "sol";   # clients resolve as <host>.sol
+        dhcpv4 = {
+          gateway_ip = "10.0.0.1";
+          subnet_mask = "255.255.255.0";
+          range_start = "10.0.0.50";
+          range_end = "10.0.0.200";
+          lease_duration = 86400;
+        };
+      };
+      # Static lease: add jupiter (10.0.0.20) via the UI once — persists in
+      # leases.json. Needs jupiter's eth MAC (`ip link` on jupiter).
+    };
+  };
+
+  networking.firewall.allowedUDPPorts = [ 67 ];   # DHCP (DNS/web via openFirewall)
+}