diff options
| author | Karan Jayachandra <mail@karanjayachandra.com> | 2026-07-26 19:38:56 +0200 |
|---|---|---|
| committer | Karan Jayachandra <mail@karanjayachandra.com> | 2026-07-26 19:38:56 +0200 |
| commit | abfbee7c9b2632dcbd07e7940f8805942a93d14c (patch) | |
| tree | 2ea958cf222b29f5e9361e3bb11f70ee82833aae | |
| parent | e82575c6cd1c32385f239475674bc6605c9d6cff (diff) | |
Updated the README
| -rw-r--r-- | README.md | 38 |
1 files changed, 19 insertions, 19 deletions
@@ -4,12 +4,12 @@ A flake-based, modular NixOS configuration for a personal server running in Euro ## Services -| URL | Service | -|-----|---------| -| https://dns.karanj.com | AdGuard Home (DNS ad-blocker + resolver) | -| https://rss.karanj.com | Miniflux (RSS/Atom reader) | -| https://budget.karanj.com | Actual Budget (personal finance) | -| https://git.karanj.com | cgit (git repository browser) | +| URL | Service | +| ------------------------- | ---------------------------------------- | +| https://dns.karanj.com | AdGuard Home (DNS ad-blocker + resolver) | +| https://rss.karanj.com | Miniflux (RSS/Atom reader) | +| https://budget.karanj.com | Actual Budget (personal finance) | +| https://git.karanj.com | cgit (git repository browser) | All services are reverse-proxied by **Caddy** with automatic TLS via Let's Encrypt. AdGuard also listens directly on **port 53 (UDP + TCP)** for plain DNS, **853/tcp** for @@ -217,12 +217,12 @@ If your local machine is also x86_64-linux you can omit `--build-host`. ### Step 7 - First login to each service -| Service | URL | Action | -|---------|-----|--------| -| AdGuard Home | https://dns.karanj.com | Log in with `admin` + the password you set in Step 2 | -| Miniflux | https://rss.karanj.com | Log in with `admin` (or your `ADMIN_USERNAME`) + your sops password | +| Service | URL | Action | +| ------------- | ------------------------- | --------------------------------------------------------------------------------- | +| AdGuard Home | https://dns.karanj.com | Log in with `admin` + the password you set in Step 2 | +| Miniflux | https://rss.karanj.com | Log in with `admin` (or your `ADMIN_USERNAME`) + your sops password | | Actual Budget | https://budget.karanj.com | Set a server password in the browser on first visit - no pre-configuration needed | -| cgit | https://git.karanj.com | No login needed - public read-only | +| cgit | https://git.karanj.com | No login needed - public read-only | To use the server as your device's DNS resolver, point its DNS settings to `<server-ipv4>`. @@ -320,14 +320,14 @@ Caddy logs: `journalctl -u caddy -f` ## Firewall Summary -| Port | Protocol | Purpose | -|------|----------|---------| -| 22 | TCP | SSH (admin + git push) | -| 80 | TCP | HTTP (Caddy redirects to HTTPS; also serves the ACME HTTP-01 webroot) | -| 443 | TCP | HTTPS (all web services, via Caddy) | -| 53 | TCP + UDP | Plain DNS (AdGuard Home) | -| 853 | TCP | DNS-over-TLS (AdGuard Home) | -| 8443 | TCP | DNS-over-HTTPS (AdGuard Home) | +| Port | Protocol | Purpose | +| ---- | --------- | --------------------------------------------------------------------- | +| 22 | TCP | SSH (admin + git push) | +| 80 | TCP | HTTP (Caddy redirects to HTTPS; also serves the ACME HTTP-01 webroot) | +| 443 | TCP | HTTPS (all web services, via Caddy) | +| 53 | TCP + UDP | Plain DNS (AdGuard Home) | +| 853 | TCP | DNS-over-TLS (AdGuard Home) | +| 8443 | TCP | DNS-over-HTTPS (AdGuard Home) | All other ports are closed at the firewall. App-level ports (5006, 8080, 8086) are bound to 127.0.0.1 and never exposed directly. AdGuard's web UI (3000) binds all interfaces (required |