From 32e166c762148957c5c0a2f893dc61639fba6c81 Mon Sep 17 00:00:00 2001 From: Aleksandr Lebedev Date: Tue, 14 Oct 2025 00:28:48 +0200 Subject: [PATCH] Adguard Home (Adblocking + Local DNS Rewrite) --- flake.nix | 4 +- .../stargate/services/adguardhome.nix | 72 +++++++++++++++++++ .../x86_64-linux/stargate/services/coturn.nix | 25 +++++++ .../stargate/services/nextcloud.nix | 2 +- .../x86_64-linux/stargate/services/nginx.nix | 8 +++ 5 files changed, 108 insertions(+), 3 deletions(-) create mode 100644 systems/x86_64-linux/stargate/services/adguardhome.nix diff --git a/flake.nix b/flake.nix index 3b89bf4..5c253ba 100644 --- a/flake.nix +++ b/flake.nix @@ -163,9 +163,9 @@ inherit (inputs) self; overrides = { user = "root"; - kylekrein-server.hostname = "kylekrein.com"; + stargate.hostname = "kylekrein.com"; }; - exclude = ["kylekrein-wsl-wm"]; + exclude = ["kylekrein-wsl-wm" "kylekrein-server"]; }; outputs-builder = channels: { diff --git a/systems/x86_64-linux/stargate/services/adguardhome.nix b/systems/x86_64-linux/stargate/services/adguardhome.nix new file mode 100644 index 0000000..e4e5eda --- /dev/null +++ b/systems/x86_64-linux/stargate/services/adguardhome.nix @@ -0,0 +1,72 @@ +{ + pkgs, + lib, + config, + ... +}: { + services.adguardhome = { + enable = true; + host = "127.0.0.1"; + port = 12270; + mutableSettings = false; + settings = { + users = [ + # nix shell nixpkgs#mkpasswd --command mkpasswd --method=bcrypt + { + name = "kylekrein"; + password = "$2b$05$W03hndNglgdYbbmsgR8Oxe5HaDi.ZeW9AIJvyB9oA9Bn8qDgYKFSy"; + } + ]; + dns = { + bind_hosts = [ + "127.0.0.1" + "::1" + "192.168.178.129" + ]; + upstream_dns = [ + "94.140.14.14" + "94.140.15.15" + "1.1.1.1" + ]; + bootstrap_dns = [ + "94.140.14.14" + "94.140.15.15" + "1.1.1.1" + ]; + }; + + filtering = { + protection_enabled = true; + filtering_enabled = true; + + parental_enabled = false; + safe_search = {enabled = false;}; + rewrites = + map (url: { + answer = "192.168.178.129"; + domain = url; + }) [ + "kylekrein.com" + "*.kylekrein.com" + ]; + }; + + filters = + map (url: { + enabled = true; + url = url; + }) [ + "https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt" # AdGuard DNS filter + "https://adguardteam.github.io/HostlistsRegistry/assets/filter_9.txt" # Malware + "https://adguardteam.github.io/HostlistsRegistry/assets/filter_11.txt" # Malicious URLs + #https://github.com/hagezi/dns-blocklists + "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.txt" # Pro blocking + "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/tif.txt" + "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/fake.txt" + "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/popupads.txt" + ]; + }; + }; + networking.firewall.allowedTCPPorts = [53]; + networking.firewall.allowedUDPPorts = [53]; +} diff --git a/systems/x86_64-linux/stargate/services/coturn.nix b/systems/x86_64-linux/stargate/services/coturn.nix index 36487e3..bfe966b 100644 --- a/systems/x86_64-linux/stargate/services/coturn.nix +++ b/systems/x86_64-linux/stargate/services/coturn.nix @@ -35,7 +35,32 @@ static-auth-secret-file = config.sops.secrets."services/turn".path; extraConfig = '' + # for debugging + verbose + # ban private IP ranges no-multicast-peers + denied-peer-ip=0.0.0.0-0.255.255.255 + denied-peer-ip=10.0.0.0-10.255.255.255 + denied-peer-ip=100.64.0.0-100.127.255.255 + denied-peer-ip=127.0.0.0-127.255.255.255 + denied-peer-ip=169.254.0.0-169.254.255.255 + denied-peer-ip=172.16.0.0-172.31.255.255 + denied-peer-ip=192.0.0.0-192.0.0.255 + denied-peer-ip=192.0.2.0-192.0.2.255 + denied-peer-ip=192.88.99.0-192.88.99.255 + denied-peer-ip=192.168.0.0-192.168.255.255 + denied-peer-ip=198.18.0.0-198.19.255.255 + denied-peer-ip=198.51.100.0-198.51.100.255 + denied-peer-ip=203.0.113.0-203.0.113.255 + denied-peer-ip=240.0.0.0-255.255.255.255 + denied-peer-ip=::1 + denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff + denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255 + denied-peer-ip=100::-100::ffff:ffff:ffff:ffff + denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff + denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff + denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff ''; }; diff --git a/systems/x86_64-linux/stargate/services/nextcloud.nix b/systems/x86_64-linux/stargate/services/nextcloud.nix index 096e2b4..0781118 100644 --- a/systems/x86_64-linux/stargate/services/nextcloud.nix +++ b/systems/x86_64-linux/stargate/services/nextcloud.nix @@ -16,7 +16,7 @@ with lib.custom; { sops.secrets."services/nextcloud" = {owner = "nextcloud";}; services.nextcloud = { enable = true; - package = pkgs.nextcloud32; + package = pkgs.nextcloud31; database.createLocally = true; config = { dbtype = "pgsql"; diff --git a/systems/x86_64-linux/stargate/services/nginx.nix b/systems/x86_64-linux/stargate/services/nginx.nix index d774e23..f553d0b 100644 --- a/systems/x86_64-linux/stargate/services/nginx.nix +++ b/systems/x86_64-linux/stargate/services/nginx.nix @@ -58,6 +58,14 @@ in { }; }; + "dns.kylekrein.com" = { + enableACME = true; + forceSSL = true; + locations."/" = { + proxyPass = "http://${config.services.adguardhome.host}:${builtins.toString config.services.adguardhome.port}"; + }; + }; + "music.kylekrein.com" = { enableACME = true; forceSSL = true;