From 9ceddb33272e5fca6382c1b4dec2074bd1167738 Mon Sep 17 00:00:00 2001 From: Karan Jayachandra Date: Sat, 18 Jul 2026 23:04:53 +0200 Subject: Simplify config and add AdGuard DoH/DoT support - Replace the hand-rolled Podman OCI container for Actual Budget with the native services.actual module (available in the pinned nixpkgs release); the container never actually had a backend enabled, so it likely never ran. - Collapse cgit's Caddy routing to a single reverse proxy - the smart-HTTP git backend was already served on the same nginx vhost/port as cgit itself, so the separate /git/* -> 8085 route was dead and pointed at a port nothing listened on. - Drop the unused kvm-intel kernel module from the guest hardware profile, and rename disko's misleadingly-named ESP partition (it's ext4, not a real EFI System Partition). - Point common.nix's disabled autoUpgrade flake URL at this repo's own cgit hosting instead of a generic GitHub placeholder. - Add AdGuard Home DNS-over-TLS (853) and DNS-over-HTTPS (8443) support, backed by an independent ACME certificate (modules/acme.nix) issued via a webroot Caddy serves on port 80. Co-Authored-By: Claude Sonnet 5 --- README.md | 31 +++++++++++++++++++++++-------- 1 file changed, 23 insertions(+), 8 deletions(-) (limited to 'README.md') diff --git a/README.md b/README.md index 5fa57b3..f714059 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,8 @@ A flake-based, modular NixOS configuration for a personal server running in Euro | https://git.karanj.com | cgit (git repository browser) | All services are reverse-proxied by **Caddy** with automatic TLS via Let's Encrypt. -AdGuard also listens directly on **port 53 (UDP + TCP)** for DNS. +AdGuard also listens directly on **port 53 (UDP + TCP)** for plain DNS, **853/tcp** for +DNS-over-TLS, and **8443/tcp** for DNS-over-HTTPS - see [AdGuard Home](#adguard-home) below. --- @@ -29,8 +30,9 @@ hosts/eurovm/ modules/ common.nix SSH hardening, firewall, timezone, nix settings sops.nix sops-nix wiring (age key from SSH host key) + acme.nix independent ACME cert for AdGuard's own DoH/DoT TLS caddy.nix reverse proxy + HTTPS virtual hosts - adguard.nix AdGuard Home DNS + web UI + adguard.nix AdGuard Home DNS + DoH/DoT + web UI miniflux.nix Miniflux + PostgreSQL actual.nix Actual Budget cgit.nix cgit + fcgiwrap + git push user @@ -278,6 +280,15 @@ To reset the password: # Then: systemctl restart adguardhome ``` +**Encrypted DNS client setup.** Point client devices at: +- **DNS-over-TLS:** `tls://dns.karanj.com:853` +- **DNS-over-HTTPS:** `https://dns.karanj.com:8443/dns-query` + +These are served by AdGuard itself with its own Let's Encrypt certificate (obtained +automatically via `security.acme` - see `modules/acme.nix`), independently of Caddy's +certificate for the same domain. Nothing to configure manually; the cert renews on its own +and restarts `adguardhome` automatically when it does. + ### Miniflux To reset the password from the server: @@ -312,9 +323,13 @@ Caddy logs: `journalctl -u caddy -f` | Port | Protocol | Purpose | |------|----------|---------| | 22 | TCP | SSH (admin + git push) | -| 80 | TCP | HTTP (Caddy redirects to HTTPS) | -| 443 | TCP | HTTPS (all web services) | -| 53 | TCP + UDP | DNS (AdGuard Home) | - -All other ports are closed. App-level ports (3000, 5006, 8080, 8086) are bound to -127.0.0.1 and never exposed directly. +| 80 | TCP | HTTP (Caddy redirects to HTTPS; also serves the ACME HTTP-01 webroot) | +| 443 | TCP | HTTPS (all web services, via Caddy) | +| 53 | TCP + UDP | Plain DNS (AdGuard Home) | +| 853 | TCP | DNS-over-TLS (AdGuard Home) | +| 8443 | TCP | DNS-over-HTTPS (AdGuard Home) | + +All other ports are closed at the firewall. App-level ports (5006, 8080, 8086) are bound to +127.0.0.1 and never exposed directly. AdGuard's web UI (3000) binds all interfaces (required +so its DoH/DoT listener - which shares the same bind host - reaches the public interface), +but stays unreachable externally because the firewall never opens port 3000. -- cgit v1.3.1