Simplify config and add AdGuard DoH/DoT support

- Replace the hand-rolled Podman OCI container for Actual Budget with the
  native services.actual module (available in the pinned nixpkgs release);
  the container never actually had a backend enabled, so it likely never ran.
- Collapse cgit's Caddy routing to a single reverse proxy - the smart-HTTP
  git backend was already served on the same nginx vhost/port as cgit
  itself, so the separate /git/* -> 8085 route was dead and pointed at a
  port nothing listened on.
- Drop the unused kvm-intel kernel module from the guest hardware profile,
  and rename disko's misleadingly-named ESP partition (it's ext4, not a
  real EFI System Partition).
- Point common.nix's disabled autoUpgrade flake URL at this repo's own
  cgit hosting instead of a generic GitHub placeholder.
- Add AdGuard Home DNS-over-TLS (853) and DNS-over-HTTPS (8443) support,
  backed by an independent ACME certificate (modules/acme.nix) issued via
  a webroot Caddy serves on port 80.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 32 insertions, 0 deletions

diff --git a/modules/acme.nix b/modules/acme.nix
new file mode 100644
index 0000000..23c995f
--- /dev/null
+++ b/modules/acme.nix
@@ -0,0 +1,32 @@
+{ ... }:
+
+# Shared ACME (Let's Encrypt) infrastructure for services that need their own
+# certificate rather than being fronted by Caddy - currently just AdGuard
+# Home's DNS-over-HTTPS/DNS-over-TLS listener (modules/adguard.nix), which
+# terminates TLS itself on its own ports rather than through Caddy.
+#
+# Challenge type: HTTP-01 via a shared webroot that Caddy serves on port 80
+# for dns.karanj.com (see modules/caddy.nix) - no DNS provider API
+# credentials needed. This is a separate Let's Encrypt certificate from the
+# one Caddy obtains for its own reverse-proxied HTTPS on the same domain;
+# issuing two independent certs for one domain is fine and well within
+# Let's Encrypt's rate limits.
+{
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "me@karanj.com";
+
+    certs."dns.karanj.com" = {
+      webroot = "/var/lib/acme/acme-challenge";
+      # Owns the issued cert/key files by the adguardhome group so the
+      # service can read them without running as root.
+      group = "adguardhome";
+      # Restart (not just reload) so AdGuard re-reads the cert on renewal.
+      reloadServices = [ "adguardhome.service" ];
+    };
+  };
+
+  # Make sure Caddy (which serves the HTTP-01 webroot) is already up before
+  # the first issuance attempt.
+  systemd.services."acme-dns.karanj.com".after = [ "caddy.service" ];
+}