From 9ceddb33272e5fca6382c1b4dec2074bd1167738 Mon Sep 17 00:00:00 2001 From: Karan Jayachandra Date: Sat, 18 Jul 2026 23:04:53 +0200 Subject: Simplify config and add AdGuard DoH/DoT support - Replace the hand-rolled Podman OCI container for Actual Budget with the native services.actual module (available in the pinned nixpkgs release); the container never actually had a backend enabled, so it likely never ran. - Collapse cgit's Caddy routing to a single reverse proxy - the smart-HTTP git backend was already served on the same nginx vhost/port as cgit itself, so the separate /git/* -> 8085 route was dead and pointed at a port nothing listened on. - Drop the unused kvm-intel kernel module from the guest hardware profile, and rename disko's misleadingly-named ESP partition (it's ext4, not a real EFI System Partition). - Point common.nix's disabled autoUpgrade flake URL at this repo's own cgit hosting instead of a generic GitHub placeholder. - Add AdGuard Home DNS-over-TLS (853) and DNS-over-HTTPS (8443) support, backed by an independent ACME certificate (modules/acme.nix) issued via a webroot Caddy serves on port 80. Co-Authored-By: Claude Sonnet 5 --- modules/caddy.nix | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) (limited to 'modules/caddy.nix') diff --git a/modules/caddy.nix b/modules/caddy.nix index c2c41e4..f82c7f0 100644 --- a/modules/caddy.nix +++ b/modules/caddy.nix @@ -9,10 +9,17 @@ virtualHosts = { - # AdGuard Home web UI + # AdGuard Home web UI, plus the HTTP-01 webroot for the independent + # ACME cert AdGuard uses for its own DoH/DoT TLS (modules/acme.nix). "dns.karanj.com" = { extraConfig = '' - reverse_proxy 127.0.0.1:3000 + handle /.well-known/acme-challenge/* { + root * /var/lib/acme/acme-challenge + file_server + } + handle { + reverse_proxy 127.0.0.1:3000 + } ''; }; @@ -30,17 +37,13 @@ ''; }; - # cgit - public read-only git viewer + smart HTTP for git clone/pull + # cgit - public read-only git viewer + smart HTTP for git clone/pull. + # Both cgit browsing and git-http-backend (clone/pull) are served by + # the same nginx vhost on 8086 - nginx itself routes between them by + # matching the request path, so a single proxy here covers both. "git.karanj.com" = { extraConfig = '' - # Smart HTTP git (clone/pull only - no push exposed) - handle /git/* { - reverse_proxy 127.0.0.1:8085 - } - # cgit web UI - handle { - reverse_proxy 127.0.0.1:8086 - } + reverse_proxy 127.0.0.1:8086 ''; }; -- cgit v1.3.1