@@ -48,6 +48,9 @@ mainProvider = dnsProviders.quad9;
 
   lanCfg = config.systemd.network.networks."40-${lan}";
   myAddresses = map netlib.removeMask lanCfg.address;
+  dnsAddresses = map netlib.removeMask (
+    lib.filter (a: a ? Label && a.Label == "dns") lanCfg.addresses
+  );
 in
 {
   imports = [
@@ -133,6 +136,22 @@ {
             Address = "fe80::1/64";
             Scope = "link";
           }
+          {
+            Address = "10.0.0.53/32";
+            Label = "dns";
+          }
+          {
+            Address = "${ulaPrefix}::53/48";
+            AddPrefixRoute = false;
+            Label = "dns"; # ignored in networkd, used for filtering here
+          }
+        ];
+        routes = [
+          {
+            Destination = "${ulaPrefix}::/48";
+            Metric = 128;
+            PreferredSource = "${ulaPrefix}:42::1";
+          }
         ];
         networkConfig = {
           IPv6AcceptRA = false;
@@ -142,7 +161,7 @@ MulticastDNS = true;
           Domains = [ config.networking.domain ];
           LinkLocalAddressing = "ipv6"; # required for networkd RA despite fe80::1 static assignment
           DNSOverTLS = false;
-          DNS = map (a: "${netlib.wrapv6 a}:${toString config.services.dnsmasq.settings.port}") myAddresses;
+          DNS = map netlib.wrapv6 myAddresses;
           DNSDefaultRoute = false;
           IPv6SendRA = true;
         };
@@ -156,7 +175,7 @@ };
         ipv6SendRAConfig = {
           Managed = true;
           OtherInformation = true;
-          DNS = builtins.filter netlib.isv6 myAddresses ++ [ "_link_local" ];
+          DNS = builtins.filter netlib.isv6 dnsAddresses;
         };
         ipv6Prefixes = [
           {
@@ -230,12 +249,13 @@ };
 
   services.adguardhome.settings =
     let
-      mkHostPort = (addr: "${netlib.wrapv6 addr}:${toString config.services.dnsmasq.settings.port}");
-      dnsmasqAddrs = map mkHostPort (builtins.filter netlib.isv6 myAddresses);
+      dnsmasqAddrs = map netlib.wrapv6 myAddresses;
       mkTLSHost = p: "tls://${p.hostname}";
     in
     {
       dns = {
+        bind_hosts = dnsAddresses;
+
         upstream_dns = (map mkTLSHost allProviders) ++ [
           # [/domain1/domain2/domainN/]upstreamString
           "[/${domain}/]${lib.strings.join " " dnsmasqAddrs}"
@@ -297,11 +317,9 @@ enable = true;
     alwaysKeepRunning = true;
     resolveLocalQueries = false;
     settings = {
-      domain = "${domain}";
-      interface = [
-        lan
-      ];
-      port = 5553;
+      domain = domain;
+      listen-address = myAddresses;
+      bind-interfaces = true;
       enable-ra = false;
 
       dhcp-fqdn = true;
@@ -322,14 +340,23 @@ addn-hosts = [ "/etc/dnsmasq-hosts" ];
 
       dhcp-option = [
         # 0.0.0.0 means the address of the system running dnsmasq
-        "option:dns-server,0.0.0.0"
-        "option:ntp-server,0.0.0.0"
-
         # [::] means the *global* address of the system running dnsmasq
         # [fd00::] refers to a ULA
         # [fe80::] refers to a link-local address
-        "option6:dns-server,[fd00::],[fe80::]"
-      ];
+        "option:ntp-server,0.0.0.0"
+      ]
+      ++ (
+        if config.services.adguardhome.enable then
+          [
+            "option:dns-server,10.0.0.53"
+            "option6:dns-server,[${ulaPrefix}::53]"
+          ]
+        else
+          [
+            "option:dns-server,0.0.0.0"
+            "option6:dns-server,[fd00::],[fe80::]"
+          ]
+      );
 
       no-resolv = true;
       dns-loop-detect = true;

@@ -1,13 +1,47 @@
 {
   config,
+  lib,
   ...
 }:
 let
-  inherit (config.networking) domain fqdn;
+  inherit (config.networking) domain;
+  netlib = import ../../../lib/net.nix { inherit lib; };
 
+  subdomain = "dns.${domain}";
   backend = config.services.adguardhome;
+  cert = config.security.acme.certs.${subdomain};
+
+  addrs = backend.settings.dns.bind_hosts;
+  byFamily = builtins.partition netlib.isv6 addrs;
+  v6s = byFamily.right;
+  v4s = byFamily.wrong;
 in
 {
+  security.acme.certs."${subdomain}" = {
+    inheritDefaults = false;
+    extraDomainNames = addrs;
+
+    server = "https://acme.${domain}/acme/home/directory";
+    listenHTTP = "${netlib.wrapv6 (builtins.head addrs)}:8080";
+
+    group = "adguardhome";
+    reloadServices = [ "adguardhome" ];
+  };
+
+  users.groups.adguardhome = { };
+  users.users.adguardhome = {
+    description = "AdGuard Home user";
+    group = "adguardhome";
+    isSystemUser = true;
+  };
+  systemd.services.adguardhome = {
+    serviceConfig = {
+      DynamicUser = lib.mkForce false;
+      User = "adguardhome";
+      Group = "adguardhome";
+    };
+  };
+
   services.adguardhome = {
     enable = true;
     host = "[::1]";
@@ -18,8 +52,6 @@ settings = {
       dhcp.enabled = false;
 
       dns = {
-        bind_hosts = [ "::" ];
-
         hostsfile_enabled = false;
 
         trusted_proxies = [ "::1" ];
@@ -32,23 +64,38 @@ };
 
         cache_enabled = true;
         cache_optimistic = true;
+      };
+      tls = {
+        enabled = true;
+        server_name = "${subdomain}";
+        port_https = 0; # disabled, not random
+        port_dns_over_tls = 853;
+        port_dns_over_quic = 853;
+        allow_unencrypted_doh = true; # for reverse_proxy usage
+        certificate_path = "${cert.directory}/cert.pem";
+        private_key_path = "${cert.directory}/key.pem";
       };
     };
   };
 
-  services.dnsmasq.settings.cname = [
-    "dns.${domain},${fqdn}"
+  services.dnsmasq.settings.host-record = [
+    "${subdomain},${builtins.head v4s},${builtins.head v6s},${toString (24 * 60 * 60)}"
   ];
   services.caddy.virtualHosts = {
-    "dns.${domain}" = {
+    "${subdomain}" = {
+      listenAddresses = addrs;
+      serverAliases = addrs;
+
       extraConfig = ''
         tls {
           issuer internal {
             ca home
           }
         }
-        encode
-        reverse_proxy http://${backend.host}:${toString backend.port}
+        reverse_proxy /.well-known/acme-challenge/* {
+          to ${cert.listenHTTP}
+        }
+        reverse_proxy * ${backend.host}:${toString backend.port}
       '';
     };
   };