diff options
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 36 |
1 files changed, 19 insertions, 17 deletions
@@ -12,8 +12,9 @@ A flake-based, modular NixOS configuration for a personal server running in Euro | https://git.karanj.com | cgit (git repository browser) | All services are reverse-proxied by **Caddy** with automatic TLS via Let's Encrypt. -AdGuard also listens directly on **port 53 (UDP + TCP)** for plain DNS, **853/tcp** for -DNS-over-TLS, and **8443/tcp** for DNS-over-HTTPS - see [AdGuard Home](#adguard-home) below. +AdGuard also listens directly on **853/tcp** for DNS-over-TLS and **8443/tcp** for +DNS-over-HTTPS - see [AdGuard Home](#adguard-home) below. Plain DNS (port 53) is disabled; +see the note there for why. --- @@ -205,16 +206,13 @@ Re-encrypt secrets with the new recipient: sops updatekeys secrets/secrets.yaml ``` -Commit and push `.sops.yaml` and the re-encrypted `secrets/secrets.yaml`, then deploy: +Commit and push `.sops.yaml` and the re-encrypted `secrets/secrets.yaml`, then deploy. Copy +`.env.example` to `.env`, set `SERVER_IP` to the server's Tailscale IP (the server must be +joined to your tailnet first), then: ```bash -nixos-rebuild switch --flake .#eurovm \ - --target-host admin@<server-ipv4> \ - --build-host admin@<server-ipv4> \ - --elevate=sudo +./deploy.sh ``` -If your local machine is also x86_64-linux you can omit `--build-host`. - ### Step 7 - First login to each service | Service | URL | Action | @@ -224,7 +222,8 @@ If your local machine is also x86_64-linux you can omit `--build-host`. | Actual Budget | https://budget.karanj.com | Set a server password in the browser on first visit - no pre-configuration needed | | cgit | https://git.karanj.com | No login needed - public read-only | -To use the server as your device's DNS resolver, point its DNS settings to `<server-ipv4>`. +To use the server as your device's DNS resolver, configure DNS-over-TLS or DNS-over-HTTPS as +described under [AdGuard Home](#adguard-home) below - plain DNS (port 53) is disabled. ### Step 8 - (Optional) enable automatic OS updates @@ -238,13 +237,12 @@ If you push this repo to GitHub/Forgejo/cgit, update the `autoUpgrade.flake` lin ### Deploy updates ```bash -nixos-rebuild switch --flake .#eurovm \ - --target-host admin@<server-ipv4> \ - --build-host admin@<server-ipv4> \ - --elevate=sudo +./deploy.sh ``` -If your local machine is also x86_64-linux you can omit `--build-host`. +Reads `SERVER_IP` from `.env` (copy `.env.example` if you haven't already) and runs +`nixos-rebuild switch` against it over Tailscale, with `--build-host` so the server always +builds its own closure regardless of your local machine's architecture. ### Edit secrets ```bash @@ -280,7 +278,9 @@ To reset the password: # Then: systemctl restart adguardhome ``` -**Encrypted DNS client setup.** Point client devices at: +**Encrypted DNS client setup.** Plain DNS (port 53) is disabled - CERT-Bund/BSI flagged it as +an abusable open resolver (spoofable UDP reflection/amplification DDoS vector). Point client +devices at encrypted DNS instead: - **DNS-over-TLS:** `tls://dns.karanj.com:853` - **DNS-over-HTTPS:** `https://dns.karanj.com:8443/dns-query` @@ -289,6 +289,9 @@ automatically via `security.acme` - see `modules/acme.nix`), independently of Ca certificate for the same domain. Nothing to configure manually; the cert renews on its own and restarts `adguardhome` automatically when it does. +On iOS, an app like **DNS Override** can install the DoT/DoH settings as a signed +configuration profile (Settings -> General -> VPN & Device Management) without needing an MDM. + ### Miniflux To reset the password from the server: @@ -325,7 +328,6 @@ Caddy logs: `journalctl -u caddy -f` | 22 | TCP | SSH (admin + git push) | | 80 | TCP | HTTP (Caddy redirects to HTTPS; also serves the ACME HTTP-01 webroot) | | 443 | TCP | HTTPS (all web services, via Caddy) | -| 53 | TCP + UDP | Plain DNS (AdGuard Home) | | 853 | TCP | DNS-over-TLS (AdGuard Home) | | 8443 | TCP | DNS-over-HTTPS (AdGuard Home) | |