erik
5a23638f75
- services/adguardhome.nix: upstream unbound, .sol local domain, DHCP 50-200 - nix-owned config (mutableSettings=false); adlists + dns declared - mercury imports adguard + unbound; drop the pick-one placeholder block - TODO: bcrypt admin password, jupiter static lease via UI (needs its MAC)
69 lines
2.4 KiB
Nix
69 lines
2.4 KiB
Nix
{ ... }:
|
|
|
|
# AdGuard Home — network DNS (adblock) + DHCP.
|
|
# Forwards to the local unbound recursive resolver (services/unbound.nix).
|
|
# Config is nix-owned (mutableSettings = false): the web UI can view but not
|
|
# persist changes — edit here and redeploy. EXCEPTION: DHCP static leases live
|
|
# in AdGuard's separate leases.json, so add those in the UI (they persist).
|
|
{
|
|
services.adguardhome = {
|
|
enable = true;
|
|
openFirewall = true; # opens the web + DNS ports
|
|
mutableSettings = false; # AdGuardHome.yaml is authoritative from nix
|
|
# allowDHCP is implied by settings.dhcp.enabled (grants NET_RAW/NET_BIND).
|
|
|
|
settings = {
|
|
# Web UI on :3000. Admin login — replace with YOUR bcrypt hash:
|
|
# nix run nixpkgs#apacheHttpd -- htpasswd -B -n -b admin 'yourpassword'
|
|
# (take the part after "admin:"). For repo hygiene, move this to sops later.
|
|
http.address = "0.0.0.0:3000";
|
|
users = [
|
|
{ name = "admin"; password = "$2y$10$REPLACE-WITH-BCRYPT-HASH"; }
|
|
];
|
|
|
|
dns = {
|
|
bind_hosts = [ "0.0.0.0" ];
|
|
port = 53;
|
|
# Recursive resolution via local unbound — no public upstream.
|
|
upstream_dns = [ "127.0.0.1:5335" ];
|
|
bootstrap_dns = [ "1.1.1.1" "9.9.9.9" ];
|
|
upstream_mode = "load_balance";
|
|
};
|
|
|
|
filtering.filtering_enabled = true;
|
|
filters = [
|
|
{
|
|
enabled = true;
|
|
id = 1;
|
|
name = "AdGuard DNS filter";
|
|
url = "https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt";
|
|
}
|
|
{
|
|
enabled = true;
|
|
id = 2;
|
|
name = "AdAway Default Blocklist";
|
|
url = "https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt";
|
|
}
|
|
];
|
|
|
|
# ---- DHCP (replaces pihole's) ----
|
|
dhcp = {
|
|
enabled = true;
|
|
interface_name = "eth0";
|
|
local_domain_name = "sol"; # clients resolve as <host>.sol
|
|
dhcpv4 = {
|
|
gateway_ip = "10.0.0.1";
|
|
subnet_mask = "255.255.255.0";
|
|
range_start = "10.0.0.50";
|
|
range_end = "10.0.0.200";
|
|
lease_duration = 86400;
|
|
};
|
|
};
|
|
# Static lease: add jupiter (10.0.0.20) via the UI once — persists in
|
|
# leases.json. Needs jupiter's eth MAC (`ip link` on jupiter).
|
|
};
|
|
};
|
|
|
|
networking.firewall.allowedUDPPorts = [ 67 ]; # DHCP (DNS/web via openFirewall)
|
|
}
|