@@ -9,7 +9,6 @@ netlib = import ../../../lib/net.nix { inherit lib; };
 
   subdomain = "dns.${domain}";
   backend = config.services.adguardhome;
-  cert = config.security.acme.certs.${subdomain};
 
   addrs = backend.settings.dns.bind_hosts;
   byFamily = builtins.partition netlib.isv6 addrs;
@@ -17,32 +16,6 @@ v6s = byFamily.right;
   v4s = byFamily.wrong;
 in
 {
-  security.acme.certs.${subdomain} = {
-    inheritDefaults = false;
-    extraDomainNames = addrs;
-
-    server = "https://acme.${domain}/acme/home/directory";
-    listenHTTP = ":8080";
-
-    group = "adguardhome";
-    ## updates are picked up automatically
-    # reloadServices = [ "adguardhome" ];
-  };
-
-  users.groups.adguardhome = { };
-  users.users.adguardhome = {
-    description = "AdGuard Home user";
-    group = "adguardhome";
-    isSystemUser = true;
-  };
-  systemd.services.adguardhome = {
-    serviceConfig = {
-      DynamicUser = lib.mkForce false;
-      User = "adguardhome";
-      Group = "adguardhome";
-    };
-  };
-
   services.adguardhome = {
     enable = true;
     host = "[::1]";
@@ -73,11 +46,7 @@ tls = {
         enabled = true;
         server_name = subdomain;
         port_https = 0; # disabled, not random
-        port_dns_over_tls = 853;
-        port_dns_over_quic = 853;
         allow_unencrypted_doh = true; # for reverse_proxy usage
-        certificate_path = "${cert.directory}/cert.pem";
-        private_key_path = "${cert.directory}/key.pem";
       };
     };
   };
@@ -94,9 +63,6 @@ tls {
           issuer internal {
             ca home
           }
-        }
-        reverse_proxy /.well-known/acme-challenge/* {
-          to localhost${cert.listenHTTP}
         }
         reverse_proxy * ${backend.host}:${toString backend.port}
       '';