From 9ceddb33272e5fca6382c1b4dec2074bd1167738 Mon Sep 17 00:00:00 2001 From: Karan Jayachandra Date: Sat, 18 Jul 2026 23:04:53 +0200 Subject: Simplify config and add AdGuard DoH/DoT support - Replace the hand-rolled Podman OCI container for Actual Budget with the native services.actual module (available in the pinned nixpkgs release); the container never actually had a backend enabled, so it likely never ran. - Collapse cgit's Caddy routing to a single reverse proxy - the smart-HTTP git backend was already served on the same nginx vhost/port as cgit itself, so the separate /git/* -> 8085 route was dead and pointed at a port nothing listened on. - Drop the unused kvm-intel kernel module from the guest hardware profile, and rename disko's misleadingly-named ESP partition (it's ext4, not a real EFI System Partition). - Point common.nix's disabled autoUpgrade flake URL at this repo's own cgit hosting instead of a generic GitHub placeholder. - Add AdGuard Home DNS-over-TLS (853) and DNS-over-HTTPS (8443) support, backed by an independent ACME certificate (modules/acme.nix) issued via a webroot Caddy serves on port 80. Co-Authored-By: Claude Sonnet 5 --- modules/acme.nix | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 modules/acme.nix (limited to 'modules/acme.nix') diff --git a/modules/acme.nix b/modules/acme.nix new file mode 100644 index 0000000..23c995f --- /dev/null +++ b/modules/acme.nix @@ -0,0 +1,32 @@ +{ ... }: + +# Shared ACME (Let's Encrypt) infrastructure for services that need their own +# certificate rather than being fronted by Caddy - currently just AdGuard +# Home's DNS-over-HTTPS/DNS-over-TLS listener (modules/adguard.nix), which +# terminates TLS itself on its own ports rather than through Caddy. +# +# Challenge type: HTTP-01 via a shared webroot that Caddy serves on port 80 +# for dns.karanj.com (see modules/caddy.nix) - no DNS provider API +# credentials needed. This is a separate Let's Encrypt certificate from the +# one Caddy obtains for its own reverse-proxied HTTPS on the same domain; +# issuing two independent certs for one domain is fine and well within +# Let's Encrypt's rate limits. +{ + security.acme = { + acceptTerms = true; + defaults.email = "me@karanj.com"; + + certs."dns.karanj.com" = { + webroot = "/var/lib/acme/acme-challenge"; + # Owns the issued cert/key files by the adguardhome group so the + # service can read them without running as root. + group = "adguardhome"; + # Restart (not just reload) so AdGuard re-reads the cert on renewal. + reloadServices = [ "adguardhome.service" ]; + }; + }; + + # Make sure Caddy (which serves the HTTP-01 webroot) is already up before + # the first issuance attempt. + systemd.services."acme-dns.karanj.com".after = [ "caddy.service" ]; +} -- cgit v1.3.1