Simplify config and add AdGuard DoH/DoT support

- Replace the hand-rolled Podman OCI container for Actual Budget with the
  native services.actual module (available in the pinned nixpkgs release);
  the container never actually had a backend enabled, so it likely never ran.
- Collapse cgit's Caddy routing to a single reverse proxy - the smart-HTTP
  git backend was already served on the same nginx vhost/port as cgit
  itself, so the separate /git/* -> 8085 route was dead and pointed at a
  port nothing listened on.
- Drop the unused kvm-intel kernel module from the guest hardware profile,
  and rename disko's misleadingly-named ESP partition (it's ext4, not a
  real EFI System Partition).
- Point common.nix's disabled autoUpgrade flake URL at this repo's own
  cgit hosting instead of a generic GitHub placeholder.
- Add AdGuard Home DNS-over-TLS (853) and DNS-over-HTTPS (8443) support,
  backed by an independent ACME certificate (modules/acme.nix) issued via
  a webroot Caddy serves on port 80.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 10 insertions, 4 deletions

diff --git a/modules/common.nix b/modules/common.nix
index e5c38d4..e27d276 100644
--- a/modules/common.nix
+++ b/modules/common.nix
@@ -15,10 +15,13 @@
     };
   };
 
-  # Firewall: only allow SSH, HTTP, HTTPS, and DNS (for AdGuard)
+  # Firewall: SSH, HTTP/HTTPS (Caddy), plain DNS, and AdGuard's own
+  # DNS-over-TLS (853) + DNS-over-HTTPS (8443) listeners.
+  # Port 3000 (AdGuard's plain-HTTP web UI) is deliberately NOT opened here -
+  # see modules/adguard.nix for why it still binds 0.0.0.0 anyway.
   networking.firewall = {
     enable = true;
-    allowedTCPPorts = [ 22 80 443 53 ];
+    allowedTCPPorts = [ 22 80 443 53 853 8443 ];
     allowedUDPPorts = [ 53 ];
   };
 
@@ -47,10 +50,13 @@
     sops
   ];
 
-  # Automatic security updates for the OS
+  # Automatic security updates for the OS.
+  # This repo is self-hosted via cgit (modules/cgit.nix), so the flake URL
+  # below points at this same server rather than GitHub - update the repo
+  # name if you push this config somewhere else.
   system.autoUpgrade = {
     enable = false; # set to true once you are comfortable with unattended reboots
-    flake = "github:YOUR_USERNAME/nix#eurovm"; # update to your actual flake URL
+    flake = "git+https://git.karanj.com/feynman.git#eurovm";
     flags = [ "--update-input" "nixpkgs" ];
   };
 }