@@ -0,0 +1,49 @@
+{
+  config,
+  ...
+}:
+let
+  inherit (config.networking) domain hostName;
+
+  backend = config.services.adguardhome;
+in
+{
+  services.adguardhome = {
+    enable = true;
+    host = "[::1]";
+
+    mutableSettings = false;
+    settings = {
+      dhcp.enabled = false;
+
+      dns = {
+        bind_hosts = [ "::1" ];
+
+        trusted_proxies = [ "::1" ];
+        enable_dnssec = true;
+        filtering = {
+          protection_enabled = true;
+          filtering_enabled = true;
+          blocking_mode = "refused";
+        };
+      };
+    };
+  };
+
+  services.dnsmasq.settings.cname = [
+    "dns.${domain},${hostName}.${domain}"
+  ];
+  services.caddy.virtualHosts = {
+    "dns.${domain}" = {
+      extraConfig = ''
+        tls {
+          issuer internal {
+            ca home
+          }
+        }
+        encode
+        reverse_proxy http://${backend.host}:${toString backend.port}
+      '';
+    };
+  };
+}