@@ -1,13 +1,47 @@
 {
   config,
+  lib,
   ...
 }:
 let
-  inherit (config.networking) domain fqdn;
+  inherit (config.networking) domain;
+  netlib = import ../../../lib/net.nix { inherit lib; };
 
+  subdomain = "dns.${domain}";
   backend = config.services.adguardhome;
+  cert = config.security.acme.certs.${subdomain};
+
+  addrs = backend.settings.dns.bind_hosts;
+  byFamily = builtins.partition netlib.isv6 addrs;
+  v6s = byFamily.right;
+  v4s = byFamily.wrong;
 in
 {
+  security.acme.certs."${subdomain}" = {
+    inheritDefaults = false;
+    extraDomainNames = addrs;
+
+    server = "https://acme.${domain}/acme/home/directory";
+    listenHTTP = "${netlib.wrapv6 (builtins.head addrs)}:8080";
+
+    group = "adguardhome";
+    reloadServices = [ "adguardhome" ];
+  };
+
+  users.groups.adguardhome = { };
+  users.users.adguardhome = {
+    description = "AdGuard Home user";
+    group = "adguardhome";
+    isSystemUser = true;
+  };
+  systemd.services.adguardhome = {
+    serviceConfig = {
+      DynamicUser = lib.mkForce false;
+      User = "adguardhome";
+      Group = "adguardhome";
+    };
+  };
+
   services.adguardhome = {
     enable = true;
     host = "[::1]";
@@ -18,8 +52,6 @@ settings = {
       dhcp.enabled = false;
 
       dns = {
-        bind_hosts = [ "::" ];
-
         hostsfile_enabled = false;
 
         trusted_proxies = [ "::1" ];
@@ -32,23 +64,38 @@ };
 
         cache_enabled = true;
         cache_optimistic = true;
+      };
+      tls = {
+        enabled = true;
+        server_name = "${subdomain}";
+        port_https = 0; # disabled, not random
+        port_dns_over_tls = 853;
+        port_dns_over_quic = 853;
+        allow_unencrypted_doh = true; # for reverse_proxy usage
+        certificate_path = "${cert.directory}/cert.pem";
+        private_key_path = "${cert.directory}/key.pem";
       };
     };
   };
 
-  services.dnsmasq.settings.cname = [
-    "dns.${domain},${fqdn}"
+  services.dnsmasq.settings.host-record = [
+    "${subdomain},${builtins.head v4s},${builtins.head v6s},${toString (24 * 60 * 60)}"
   ];
   services.caddy.virtualHosts = {
-    "dns.${domain}" = {
+    "${subdomain}" = {
+      listenAddresses = addrs;
+      serverAliases = addrs;
+
       extraConfig = ''
         tls {
           issuer internal {
             ca home
           }
         }
-        encode
-        reverse_proxy http://${backend.host}:${toString backend.port}
+        reverse_proxy /.well-known/acme-challenge/* {
+          to ${cert.listenHTTP}
+        }
+        reverse_proxy * ${backend.host}:${toString backend.port}
       '';
     };
   };