Order network jobs after DNS readiness

services/adguard.nix

@@ -1,5 +1,27 @@
 # services/adguard.nix — AdGuard Home network-wide DNS ad blocker
 { config, lib, pkgs, ... }:
+let
+  # AdGuard Home uses Type=simple, so systemd considers it started before its
+  # DNS listeners are necessarily accepting queries.  Network-dependent units
+  # ordered after adguardhome.service need a stronger readiness boundary.
+  waitForDns = pkgs.writeShellScript "wait-for-adguard-dns" ''
+    attempt=0
+    while [ "$attempt" -lt 30 ]; do
+      # dnsmasq may answer on loopback while AdGuard is still starting, so
+      # probe AdGuard's exclusive LAN listener instead.
+      if answer="$(${pkgs.dnsutils}/bin/dig +short +time=1 +tries=1 @10.0.0.1 example.com A 2>/dev/null)"; then
+        if [ -n "$answer" ]; then
+          exit 0
+        fi
+      fi
+      attempt=$((attempt + 1))
+      ${pkgs.coreutils}/bin/sleep 1
+    done
+
+    echo "AdGuard Home did not provide working upstream DNS within 30 seconds" >&2
+    exit 1
+  '';
+in
 {
   config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
 
@@ -45,6 +67,10 @@
       };
     };
 
+    # Delay completion of adguardhome.service startup until DNS is genuinely
+    # usable, rather than merely until the AdGuard process has been spawned.
+    systemd.services.adguardhome.serviceConfig.ExecStartPost = [ waitForDns ];
+
     # LAN clients reach :53 via the nftables "LAN trusted" rule in router.nix;
     # WAN:53 is dropped there.
   };