1 files changed, 86 insertions, 0 deletions
diff --git a/modules/adguard.nix b/modules/adguard.nix
new file mode 100644
index 0000000..6c49b28
--- /dev/null
+++ b/modules/adguard.nix
@@ -0,0 +1,86 @@
+{ config, pkgs, lib, ... }:
+
+# AdGuard Home - DNS resolver + optional network-wide ad blocker.
+#
+# DNS listens on port 53 (udp/tcp) directly on the public IP.
+# The web UI listens on 127.0.0.1:3000 and is fronted by Caddy.
+#
+# Admin password is seeded from a sops secret containing a bcrypt hash.
+# To generate the hash on your local machine:
+#   htpasswd -nB admin
+# Copy the hash portion (everything after "admin:") into secrets.yaml.
+{
+  services.adguardhome = {
+    enable = true;
+    mutableSettings = false; # declarative mode - config comes from Nix only
+
+    settings = {
+      http = {
+        address = "127.0.0.1:3000";
+      };
+
+      dns = {
+        bind_hosts = [ "0.0.0.0" ];
+        port = 53;
+        # Upstream DNS resolvers (privacy-respecting)
+        upstream_dns = [
+          "https://dns.quad9.net/dns-query"
+          "https://cloudflare-dns.com/dns-query"
+        ];
+        bootstrap_dns = [
+          "9.9.9.9"
+          "1.1.1.1"
+        ];
+        enable_dnssec = true;
+      };
+
+      # Users block: username "admin", password from sops secret at activation.
+      # The activation script below writes the hash into the config before
+      # AdGuard starts, because mutableSettings=false uses a static config file
+      # but the password hash must be injected at runtime (it contains a secret).
+      users = [
+        {
+          name = "admin";
+          # Placeholder - replaced at activation time by the script below
+          password = "REPLACED_AT_ACTIVATION";
+        }
+      ];
+
+      # Basic filtering
+      filtering = {
+        enabled = true;
+        update_interval = 24;
+      };
+
+      # Block lists
+      filters = [
+        {
+          enabled = true;
+          url = "https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt";
+          name = "AdGuard DNS filter";
+          id = 1;
+        }
+        {
+          enabled = true;
+          url = "https://adaway.org/hosts.txt";
+          name = "AdAway Default Blocklist";
+          id = 2;
+        }
+      ];
+    };
+  };
+
+  # At activation: inject the bcrypt password hash from the sops secret into
+  # the AdGuard config so the declarative config has the real hash.
+  system.activationScripts.adguard-password = {
+    deps = [ "sops" ];
+    text = ''
+      HASH_FILE="${config.sops.secrets."adguard/password_hash".path}"
+      CFG="/var/lib/AdGuardHome/AdGuardHome.yaml"
+      if [ -f "$HASH_FILE" ] && [ -f "$CFG" ]; then
+        HASH=$(cat "$HASH_FILE")
+        ${pkgs.gnused}/bin/sed -i "s|REPLACED_AT_ACTIVATION|$HASH|g" "$CFG"
+      fi
+    '';
+  };
+}