diff options
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 29 |
1 files changed, 22 insertions, 7 deletions
@@ -12,7 +12,8 @@ A flake-based, modular NixOS configuration for a personal server running in Euro | https://git.karanj.com | cgit (git repository browser) | All services are reverse-proxied by **Caddy** with automatic TLS via Let's Encrypt. -AdGuard also listens directly on **port 53 (UDP + TCP)** for DNS. +AdGuard also listens directly on **port 53 (UDP + TCP)** for plain DNS, **853/tcp** for +DNS-over-TLS, and **8443/tcp** for DNS-over-HTTPS - see [AdGuard Home](#adguard-home) below. --- @@ -29,8 +30,9 @@ hosts/eurovm/ modules/ common.nix SSH hardening, firewall, timezone, nix settings sops.nix sops-nix wiring (age key from SSH host key) + acme.nix independent ACME cert for AdGuard's own DoH/DoT TLS caddy.nix reverse proxy + HTTPS virtual hosts - adguard.nix AdGuard Home DNS + web UI + adguard.nix AdGuard Home DNS + DoH/DoT + web UI miniflux.nix Miniflux + PostgreSQL actual.nix Actual Budget cgit.nix cgit + fcgiwrap + git push user @@ -278,6 +280,15 @@ To reset the password: # Then: systemctl restart adguardhome ``` +**Encrypted DNS client setup.** Point client devices at: +- **DNS-over-TLS:** `tls://dns.karanj.com:853` +- **DNS-over-HTTPS:** `https://dns.karanj.com:8443/dns-query` + +These are served by AdGuard itself with its own Let's Encrypt certificate (obtained +automatically via `security.acme` - see `modules/acme.nix`), independently of Caddy's +certificate for the same domain. Nothing to configure manually; the cert renews on its own +and restarts `adguardhome` automatically when it does. + ### Miniflux To reset the password from the server: @@ -312,9 +323,13 @@ Caddy logs: `journalctl -u caddy -f` | Port | Protocol | Purpose | |------|----------|---------| | 22 | TCP | SSH (admin + git push) | -| 80 | TCP | HTTP (Caddy redirects to HTTPS) | -| 443 | TCP | HTTPS (all web services) | -| 53 | TCP + UDP | DNS (AdGuard Home) | +| 80 | TCP | HTTP (Caddy redirects to HTTPS; also serves the ACME HTTP-01 webroot) | +| 443 | TCP | HTTPS (all web services, via Caddy) | +| 53 | TCP + UDP | Plain DNS (AdGuard Home) | +| 853 | TCP | DNS-over-TLS (AdGuard Home) | +| 8443 | TCP | DNS-over-HTTPS (AdGuard Home) | -All other ports are closed. App-level ports (3000, 5006, 8080, 8086) are bound to -127.0.0.1 and never exposed directly. +All other ports are closed at the firewall. App-level ports (5006, 8080, 8086) are bound to +127.0.0.1 and never exposed directly. AdGuard's web UI (3000) binds all interfaces (required +so its DoH/DoT listener - which shares the same bind host - reaches the public interface), +but stays unreachable externally because the firewall never opens port 3000. |