all repos — nixfiles @ 042e38e627e15c6a392de76f2b463fff5660e0b3

System and user configuration, managed by nix and home-manager

adguard-home: init module

Alin
commit

042e38e627e15c6a392de76f2b463fff5660e0b3

parent

1b98db1da74f80ed17291477caf06e62ea50dcd6

1 file changed, 15 insertions(+), 5 deletions(-)

changed files
M system/roles/router.nix → system/roles/router.nix
@@ -30,6 +30,10 @@ ];
   nsTLSHostname = "dns.quad9.net";
 in
 {
+  imports = [
+    ../settings/services/adguard-home.nix
+  ];
+
   networking = {
     useDHCP = false;
     hosts = {

@@ -143,8 +147,7 @@ IPv4Forwarding = true;
           MulticastDNS = false;
           DNSDefaultRoute = true;
           DNSOverTLS = true;
-          DNSSEC = true;
-          DNS = map (ns: "${ns}#${nsTLSHostname}") nameservers;
+          DNS = "::1";
         };
         dhcpV4Config = {
           UseDNS = false;

@@ -197,6 +200,14 @@ };
     };
   };
 
+  services.adguardhome.settings = {
+    dns = {
+      upstream_dns = [ "tls://${nsTLSHostname}" ];
+      bootstrap_dns = nameservers;
+      bootstrap_prefer_ipv6 = true;
+    };
+  };
+
   services.resolved = {
     enable = true;
     settings.Resolve = {

@@ -205,8 +216,6 @@ FallbackDNS = map (ns: "${ns}#${nsTLSHostname}") nameservers;
       LLMNR = false;
       MulticastDNS = true;
       DNSOverTLS = "opportunistic";
-      DNSStubListener = false;
-      DNSStubListenerExtra = [ "[::1]:90" ];
     };
   };
   networking.resolvconf.enable = false;

@@ -252,6 +261,7 @@ inherit domain;
       interface = [
         lan
       ];
+      except-interface = [ "lo" ];
       bind-interfaces = true;
       enable-ra = false;
 

@@ -264,7 +274,7 @@ "fd12:d04f:65d:42::10,fd12:d04f:65d:42::ffff,64,48h"
       ];
 
       no-resolv = true;
-      server = [ "::1#90" ];
+      server = [ "::1" ];
       dns-loop-detect = true;
 
       # these next few settings imply trust of the upstream resolver and the path to it