From 9ceddb33272e5fca6382c1b4dec2074bd1167738 Mon Sep 17 00:00:00 2001 From: Karan Jayachandra Date: Sat, 18 Jul 2026 23:04:53 +0200 Subject: Simplify config and add AdGuard DoH/DoT support - Replace the hand-rolled Podman OCI container for Actual Budget with the native services.actual module (available in the pinned nixpkgs release); the container never actually had a backend enabled, so it likely never ran. - Collapse cgit's Caddy routing to a single reverse proxy - the smart-HTTP git backend was already served on the same nginx vhost/port as cgit itself, so the separate /git/* -> 8085 route was dead and pointed at a port nothing listened on. - Drop the unused kvm-intel kernel module from the guest hardware profile, and rename disko's misleadingly-named ESP partition (it's ext4, not a real EFI System Partition). - Point common.nix's disabled autoUpgrade flake URL at this repo's own cgit hosting instead of a generic GitHub placeholder. - Add AdGuard Home DNS-over-TLS (853) and DNS-over-HTTPS (8443) support, backed by an independent ACME certificate (modules/acme.nix) issued via a webroot Caddy serves on port 80. Co-Authored-By: Claude Sonnet 5 --- modules/common.nix | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'modules/common.nix') diff --git a/modules/common.nix b/modules/common.nix index e5c38d4..e27d276 100644 --- a/modules/common.nix +++ b/modules/common.nix @@ -15,10 +15,13 @@ }; }; - # Firewall: only allow SSH, HTTP, HTTPS, and DNS (for AdGuard) + # Firewall: SSH, HTTP/HTTPS (Caddy), plain DNS, and AdGuard's own + # DNS-over-TLS (853) + DNS-over-HTTPS (8443) listeners. + # Port 3000 (AdGuard's plain-HTTP web UI) is deliberately NOT opened here - + # see modules/adguard.nix for why it still binds 0.0.0.0 anyway. networking.firewall = { enable = true; - allowedTCPPorts = [ 22 80 443 53 ]; + allowedTCPPorts = [ 22 80 443 53 853 8443 ]; allowedUDPPorts = [ 53 ]; }; @@ -47,10 +50,13 @@ sops ]; - # Automatic security updates for the OS + # Automatic security updates for the OS. + # This repo is self-hosted via cgit (modules/cgit.nix), so the flake URL + # below points at this same server rather than GitHub - update the repo + # name if you push this config somewhere else. system.autoUpgrade = { enable = false; # set to true once you are comfortable with unattended reboots - flake = "github:YOUR_USERNAME/nix#eurovm"; # update to your actual flake URL + flake = "git+https://git.karanj.com/feynman.git#eurovm"; flags = [ "--update-input" "nixpkgs" ]; }; } -- cgit v1.3.1