@@ -30,6 +30,10 @@ ];
   nsTLSHostname = "dns.quad9.net";
 in
 {
+  imports = [
+    ../settings/services/adguard-home.nix
+  ];
+
   networking = {
     useDHCP = false;
     hosts = {
@@ -143,8 +147,7 @@ IPv4Forwarding = true;
           MulticastDNS = false;
           DNSDefaultRoute = true;
           DNSOverTLS = true;
-          DNSSEC = true;
-          DNS = map (ns: "${ns}#${nsTLSHostname}") nameservers;
+          DNS = "::1";
         };
         dhcpV4Config = {
           UseDNS = false;
@@ -197,6 +200,14 @@ };
     };
   };
 
+  services.adguardhome.settings = {
+    dns = {
+      upstream_dns = [ "tls://${nsTLSHostname}" ];
+      bootstrap_dns = nameservers;
+      bootstrap_prefer_ipv6 = true;
+    };
+  };
+
   services.resolved = {
     enable = true;
     settings.Resolve = {
@@ -205,8 +216,6 @@ FallbackDNS = map (ns: "${ns}#${nsTLSHostname}") nameservers;
       LLMNR = false;
       MulticastDNS = true;
       DNSOverTLS = "opportunistic";
-      DNSStubListener = false;
-      DNSStubListenerExtra = [ "[::1]:90" ];
     };
   };
   networking.resolvconf.enable = false;
@@ -252,6 +261,7 @@ inherit domain;
       interface = [
         lan
       ];
+      except-interface = [ "lo" ];
       bind-interfaces = true;
       enable-ra = false;
 
@@ -264,7 +274,7 @@ "fd12:d04f:65d:42::10,fd12:d04f:65d:42::ffff,64,48h"
       ];
 
       no-resolv = true;
-      server = [ "::1#90" ];
+      server = [ "::1" ];
       dns-loop-detect = true;
 
       # these next few settings imply trust of the upstream resolver and the path to it

@@ -0,0 +1,49 @@
+{
+  config,
+  ...
+}:
+let
+  inherit (config.networking) domain hostName;
+
+  backend = config.services.adguardhome;
+in
+{
+  services.adguardhome = {
+    enable = true;
+    host = "[::1]";
+
+    mutableSettings = false;
+    settings = {
+      dhcp.enabled = false;
+
+      dns = {
+        bind_hosts = [ "::1" ];
+
+        trusted_proxies = [ "::1" ];
+        enable_dnssec = true;
+        filtering = {
+          protection_enabled = true;
+          filtering_enabled = true;
+          blocking_mode = "refused";
+        };
+      };
+    };
+  };
+
+  services.dnsmasq.settings.cname = [
+    "dns.${domain},${hostName}.${domain}"
+  ];
+  services.caddy.virtualHosts = {
+    "dns.${domain}" = {
+      extraConfig = ''
+        tls {
+          issuer internal {
+            ca home
+          }
+        }
+        encode
+        reverse_proxy http://${backend.host}:${toString backend.port}
+      '';
+    };
+  };
+}