Simplify config and add AdGuard DoH/DoT support

- Replace the hand-rolled Podman OCI container for Actual Budget with the
  native services.actual module (available in the pinned nixpkgs release);
  the container never actually had a backend enabled, so it likely never ran.
- Collapse cgit's Caddy routing to a single reverse proxy - the smart-HTTP
  git backend was already served on the same nginx vhost/port as cgit
  itself, so the separate /git/* -> 8085 route was dead and pointed at a
  port nothing listened on.
- Drop the unused kvm-intel kernel module from the guest hardware profile,
  and rename disko's misleadingly-named ESP partition (it's ext4, not a
  real EFI System Partition).
- Point common.nix's disabled autoUpgrade flake URL at this repo's own
  cgit hosting instead of a generic GitHub placeholder.
- Add AdGuard Home DNS-over-TLS (853) and DNS-over-HTTPS (8443) support,
  backed by an independent ACME certificate (modules/acme.nix) issued via
  a webroot Caddy serves on port 80.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 14 insertions, 11 deletions

diff --git a/modules/caddy.nix b/modules/caddy.nix
index c2c41e4..f82c7f0 100644
--- a/modules/caddy.nix
+++ b/modules/caddy.nix
@@ -9,10 +9,17 @@
 
     virtualHosts = {
 
-      # AdGuard Home web UI
+      # AdGuard Home web UI, plus the HTTP-01 webroot for the independent
+      # ACME cert AdGuard uses for its own DoH/DoT TLS (modules/acme.nix).
       "dns.karanj.com" = {
         extraConfig = ''
-          reverse_proxy 127.0.0.1:3000
+          handle /.well-known/acme-challenge/* {
+            root * /var/lib/acme/acme-challenge
+            file_server
+          }
+          handle {
+            reverse_proxy 127.0.0.1:3000
+          }
         '';
       };
 
@@ -30,17 +37,13 @@
         '';
       };
 
-      # cgit - public read-only git viewer + smart HTTP for git clone/pull
+      # cgit - public read-only git viewer + smart HTTP for git clone/pull.
+      # Both cgit browsing and git-http-backend (clone/pull) are served by
+      # the same nginx vhost on 8086 - nginx itself routes between them by
+      # matching the request path, so a single proxy here covers both.
       "git.karanj.com" = {
         extraConfig = ''
-          # Smart HTTP git (clone/pull only - no push exposed)
-          handle /git/* {
-            reverse_proxy 127.0.0.1:8085
-          }
-          # cgit web UI
-          handle {
-            reverse_proxy 127.0.0.1:8086
-          }
+          reverse_proxy 127.0.0.1:8086
         '';
       };