77 lines
3 KiB
Nix
77 lines
3 KiB
Nix
# services/adguard.nix — AdGuard Home network-wide DNS ad blocker
|
|
{ config, lib, pkgs, ... }:
|
|
let
|
|
# AdGuard Home uses Type=simple, so systemd considers it started before its
|
|
# DNS listeners are necessarily accepting queries. Network-dependent units
|
|
# ordered after adguardhome.service need a stronger readiness boundary.
|
|
waitForDns = pkgs.writeShellScript "wait-for-adguard-dns" ''
|
|
attempt=0
|
|
while [ "$attempt" -lt 30 ]; do
|
|
# dnsmasq may answer on loopback while AdGuard is still starting, so
|
|
# probe AdGuard's exclusive LAN listener instead.
|
|
if answer="$(${pkgs.dnsutils}/bin/dig +short +time=1 +tries=1 @10.0.0.1 example.com A 2>/dev/null)"; then
|
|
if [ -n "$answer" ]; then
|
|
exit 0
|
|
fi
|
|
fi
|
|
attempt=$((attempt + 1))
|
|
${pkgs.coreutils}/bin/sleep 1
|
|
done
|
|
|
|
echo "AdGuard Home did not provide working upstream DNS within 30 seconds" >&2
|
|
exit 1
|
|
'';
|
|
in
|
|
{
|
|
config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
|
|
|
|
services.adguardhome = {
|
|
enable = true;
|
|
# Web UI bound to localhost; nginx reverse-proxies at adguard.nordhammer.it
|
|
host = "127.0.0.1";
|
|
port = 3000;
|
|
# Nix is authoritative: settings below overwrite UI-made changes on rebuild
|
|
mutableSettings = false;
|
|
settings = {
|
|
dns = {
|
|
bind_hosts = [ "10.0.0.1" "127.0.0.1" ];
|
|
port = 53;
|
|
# Query all upstreams in parallel; take the fastest response
|
|
upstream_mode = "parallel";
|
|
# Mix of DoH (encrypted) and plain UDP (low-latency) upstreams
|
|
upstream_dns = [
|
|
"https://dns.cloudflare.com/dns-query"
|
|
"https://dns.quad9.net/dns-query"
|
|
"1.1.1.1"
|
|
"9.9.9.9"
|
|
];
|
|
bootstrap_dns = [ "1.1.1.1" "9.9.9.9" ];
|
|
cache_size = 4194304;
|
|
cache_ttl_min = 60;
|
|
};
|
|
filters = [
|
|
{ enabled = true; id = 1; name = "AdGuard DNS filter";
|
|
url = "https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt"; }
|
|
{ enabled = true; id = 2; name = "AdAway Default Blocklist";
|
|
url = "https://adaway.org/hosts.txt"; }
|
|
{ enabled = true; id = 3; name = "OISD Big";
|
|
url = "https://big.oisd.nl/"; }
|
|
];
|
|
# Resolve our own hostnames to the router's LAN IP so LAN clients
|
|
# bypass any NAT reflection. `enabled` was added in AdGuard's recent
|
|
# schema and defaults to false — must be set explicitly.
|
|
filtering.rewrites = [
|
|
{ domain = "nordhammer.it"; answer = "10.0.0.1"; enabled = true; }
|
|
{ domain = "*.nordhammer.it"; answer = "10.0.0.1"; enabled = true; }
|
|
];
|
|
};
|
|
};
|
|
|
|
# Delay completion of adguardhome.service startup until DNS is genuinely
|
|
# usable, rather than merely until the AdGuard process has been spawned.
|
|
systemd.services.adguardhome.serviceConfig.ExecStartPost = [ waitForDns ];
|
|
|
|
# LAN clients reach :53 via the nftables "LAN trusted" rule in router.nix;
|
|
# WAN:53 is dropped there.
|
|
};
|
|
}
|