From d7657e191dd69567d8eb339e62b19947826fdbb4 Mon Sep 17 00:00:00 2001
From: rope <fredrik@nordhammer.it>
Date: Mon, 13 Jul 2026 22:37:46 +0100
Subject: [PATCH] acme: use public DNS resolver for lego zone detection

---
 services/nginx.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/services/nginx.nix b/services/nginx.nix
index f718a92..1a70a18 100644
--- a/services/nginx.nix
+++ b/services/nginx.nix
@@ -62,6 +62,8 @@ in
         domain = "*.nordhammer.it";
         extraDomainNames = [ "nordhammer.it" ];
         dnsProvider = "cloudflare";
+        # AdGuard's local rewrite swallows SOA lookups, breaking lego's zone detection
+        dnsResolver = "1.1.1.1:53";
         credentialFiles = {
           "CF_DNS_API_TOKEN_FILE" = "/var/secrets/cloudflare-token";
         };