add adguardhome

hosts/apu/configuration.nix

@@ -2,7 +2,7 @@
 # your system. Help is availanodev";
 # https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
 
-{ ssh, pkgs, config, ... }:
+{ ssh, pkgs, config, lib, ... }:
 {
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/sda";
@@ -183,9 +183,33 @@
 
   services.resolved.enable = false;
 
-  services.nextdns = {
+  services.unbound = {
     enable = true;
-    arguments = [ "-profile" "9c4ac9" "-setup-router" "-mdns" "koti" ];
+    settings = {
+      server = {
+        interface = (lib.map
+          (name: config.systemd.network.networks."30-${name}".dhcpServerConfig.DNS)
+          (lib.attrNames config.modules.vlans.networks)
+        ) ++ [
+          "127.0.0.1"
+          "::1"
+        ];
+        access-control = [
+          "10.0.0.0/8 allow"
+          "127.0.0.0/8 allow"
+          "::1/128 allow"
+        ];
+        verbosity = 2;
+      };
+
+      forward-zone = [
+        {
+          name = ".";
+          forward-addr = "100.84.105.63#dns.freun.dev";
+          forward-tls-upstream = true;
+        }
+      ];
+    };
   };
 
   services.home-assistant = {

hosts/freun-dev/services.nix

@@ -170,5 +170,11 @@ in
       };
       environmentFile = secrets.dnote.path;
     };
+
+    tailscaledAdguardhome = {
+      enable = true;
+      subdomain = "dns";
+      port = 3006;
+    };
   };
 }

hosts/radish/configuration.nix

@@ -14,7 +14,7 @@
   };
 
   networking.extraHosts = ''
-    10.10.0.1 warden.apu.repomaa.com
+    100.84.105.63 dns.freun.dev
   '';
 
   networking.nftables.enable = true;

modules/firewall.nix

@@ -3,7 +3,7 @@ let
   services = {
     ssh = { tcp = [ 22 ]; };
     dhcp = { udp = [ 67 68 ]; };
-    dns = { udp = [ 53 ]; };
+    dns = { udp = [ 53 853 ]; tcp = [ 53 853 ]; };
     web = { tcp = [ 80 443 ]; };
   };
 

modules/services/adguardhome.nix

@@ -0,0 +1,63 @@
+{ config, lib, ... }:
+let
+  cfg = config.services.tailscaledAdguardhome;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+  tailscaleIps = [
+    "100.84.105.63"
+    "fd7a:115c:a1e0::7901:693f"
+  ];
+  acme = config.security.acme;
+in
+{
+  imports = [
+    (lib.mkAliasOptionModule
+      [ "services" "tailscaledAdguardhome" "settings" ]
+      [ "services" "adguardhome" "settings" ]
+    )
+    (lib.mkAliasOptionModule
+      [ "services" "tailscaledAdguardhome" "port" ]
+      [ "services" "adguardhome" "port" ]
+    )
+  ];
+
+  options.services.tailscaledAdguardhome = {
+    enable = lib.mkEnableOption "Enable tailscaled adguardhome";
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.tailscale.enable = true;
+    modules.firewall.interfaces.${config.services.tailscale.interfaceName} = [ "dns" ];
+
+    systemd.services.adguardhome.serviceConfig.LoadCredential = [
+      "fullchain.pem:${acme.certs.${fqdn}.directory}/fullchain.pem"
+      "key.pem:${acme.certs.${fqdn}.directory}/key.pem"
+    ];
+
+    services.adguardhome = {
+      enable = cfg.enable;
+      settings = {
+        tls = {
+          enabled = true;
+          server_name = fqdn;
+          port_https = 4443;
+          certificate_chain = "/run/credentials/adguardhome.service/fullchain.pem";
+          private_key = "/run/credentials/adguardhome.service/key.pem";
+        };
+        dns.bind_hosts = tailscaleIps;
+      };
+    };
+
+    systemd.services.adguardhome = {
+      requires = [ "tailscaled.service" ];
+      after = [ "tailscaled.service" ];
+    };
+
+    services.webserver.vHosts.${fqdn} = {
+      tailscaleAuth = true;
+      locations."/".proxyPort = cfg.port;
+    };
+  };
+}

modules/services/default.nix

@@ -18,5 +18,6 @@
     ./donetick.nix
     ./dnote.nix
     ./octodns.nix
+    ./adguardhome.nix
   ];
 }

modules/services/webserver.nix

@@ -25,9 +25,17 @@ let
         locations = lib.mkOption {
           type = lib.types.attrsOf types.location;
         };
+        tailscaleAuth = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
         };
       };
     };
+  };
+
+  tailscaleAuthVhosts = lib.attrNames (
+    lib.filterAttrs (name: { tailscaleAuth, ... }: tailscaleAuth) cfg.vHosts
+  );
 in
 {
   options.services.webserver = {
@@ -56,8 +64,13 @@ in
         recommendedZstdSettings = true;
         recommendedOptimisation = true;
 
+        tailscaleAuth = {
+          enable = (lib.length tailscaleAuthVhosts) > 0;
+          virtualHosts = tailscaleAuthVhosts;
+        };
+
         virtualHosts = lib.mapAttrs
-          (_: { proxyBuffering, locations }: {
+          (_: { proxyBuffering, locations, ... }: {
             forceSSL = true;
             enableACME = true;
             http2 = true;