ediblerope
8aeb8e2de7
DoH-only sequential upstreams made first-time lookups slow. Add plain UDP 1.1.1.1/9.9.9.9 alongside DoH and set upstream_mode=parallel so AdGuard queries all four simultaneously and uses the fastest response. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
45 lines
1.6 KiB
Nix
45 lines
1.6 KiB
Nix
# services/adguard.nix — AdGuard Home network-wide DNS ad blocker
|
|
{ config, lib, pkgs, ... }:
|
|
{
|
|
config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
|
|
|
|
services.adguardhome = {
|
|
enable = true;
|
|
# Web UI bound to localhost; nginx reverse-proxies at adguard.nordhammer.it
|
|
host = "127.0.0.1";
|
|
port = 3000;
|
|
# Allow UI changes (blocklists, rules, clients) to persist
|
|
mutableSettings = true;
|
|
settings = {
|
|
dns = {
|
|
bind_hosts = [ "0.0.0.0" ];
|
|
port = 53;
|
|
# Query all upstreams in parallel; take the fastest response
|
|
upstream_mode = "parallel";
|
|
# Mix of DoH (encrypted) and plain UDP (low-latency) upstreams
|
|
upstream_dns = [
|
|
"https://dns.cloudflare.com/dns-query"
|
|
"https://dns.quad9.net/dns-query"
|
|
"1.1.1.1"
|
|
"9.9.9.9"
|
|
];
|
|
bootstrap_dns = [ "1.1.1.1" "9.9.9.9" ];
|
|
cache_size = 4194304;
|
|
cache_ttl_min = 60;
|
|
};
|
|
filters = [
|
|
{ enabled = true; id = 1; name = "AdGuard DNS filter";
|
|
url = "https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt"; }
|
|
{ enabled = true; id = 2; name = "AdAway Default Blocklist";
|
|
url = "https://adaway.org/hosts.txt"; }
|
|
{ enabled = true; id = 3; name = "OISD Big";
|
|
url = "https://big.oisd.nl/"; }
|
|
];
|
|
};
|
|
};
|
|
|
|
# LAN DNS — router blocks WAN:53 so this is effectively LAN-only
|
|
networking.firewall.allowedTCPPorts = [ 53 ];
|
|
networking.firewall.allowedUDPPorts = [ 53 ];
|
|
};
|
|
}
|