kylekrein/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Adguard Home (Adblocking + Local DNS Rewrite)

Browse source
This commit is contained in:
Aleksandr Lebedev 2025-10-14 00:28:48 +02:00
parent ca80a34135
commit 32e166c762
5 changed files with 108 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

72
systems/x86_64-linux/stargate/services/adguardhome.nix Normal file
View file

@ -0,0 +1,72 @@
{
pkgs,
lib,
config,
...
}: {
services.adguardhome = {
enable = true;
host = "127.0.0.1";
port = 12270;
mutableSettings = false;
settings = {
users = [
# nix shell nixpkgs#mkpasswd --command mkpasswd --method=bcrypt
{
name = "kylekrein";
password = "$2b$05$W03hndNglgdYbbmsgR8Oxe5HaDi.ZeW9AIJvyB9oA9Bn8qDgYKFSy";
}
];
dns = {
bind_hosts = [
"127.0.0.1"
"::1"
"192.168.178.129"
];
upstream_dns = [
"94.140.14.14"
"94.140.15.15"
"1.1.1.1"
];
bootstrap_dns = [
"94.140.14.14"
"94.140.15.15"
"1.1.1.1"
];
};
filtering = {
protection_enabled = true;
filtering_enabled = true;
parental_enabled = false;
safe_search = {enabled = false;};
rewrites =
map (url: {
answer = "192.168.178.129";
domain = url;
}) [
"kylekrein.com"
"*.kylekrein.com"
];
};
filters =
map (url: {
enabled = true;
url = url;
}) [
"https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt" # AdGuard DNS filter
"https://adguardteam.github.io/HostlistsRegistry/assets/filter_9.txt" # Malware
"https://adguardteam.github.io/HostlistsRegistry/assets/filter_11.txt" # Malicious URLs
#https://github.com/hagezi/dns-blocklists
"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.txt" # Pro blocking
"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/tif.txt"
"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/fake.txt"
"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/popupads.txt"
];
};
};
networking.firewall.allowedTCPPorts = [53];
networking.firewall.allowedUDPPorts = [53];
}

25
systems/x86_64-linux/stargate/services/coturn.nix
View file

@ -35,7 +35,32 @@
static-auth-secret-file = config.sops.secrets."services/turn".path;
extraConfig = ''
# for debugging
verbose
# ban private IP ranges
no-multicast-peers
denied-peer-ip=0.0.0.0-0.255.255.255
denied-peer-ip=10.0.0.0-10.255.255.255
denied-peer-ip=100.64.0.0-100.127.255.255
denied-peer-ip=127.0.0.0-127.255.255.255
denied-peer-ip=169.254.0.0-169.254.255.255
denied-peer-ip=172.16.0.0-172.31.255.255
denied-peer-ip=192.0.0.0-192.0.0.255
denied-peer-ip=192.0.2.0-192.0.2.255
denied-peer-ip=192.88.99.0-192.88.99.255
denied-peer-ip=192.168.0.0-192.168.255.255
denied-peer-ip=198.18.0.0-198.19.255.255
denied-peer-ip=198.51.100.0-198.51.100.255
denied-peer-ip=203.0.113.0-203.0.113.255
denied-peer-ip=240.0.0.0-255.255.255.255
denied-peer-ip=::1
denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
'';
};

2
systems/x86_64-linux/stargate/services/nextcloud.nix
View file

@ -16,7 +16,7 @@ with lib.custom; {
sops.secrets."services/nextcloud" = {owner = "nextcloud";};
services.nextcloud = {
enable = true;
package = pkgs.nextcloud32;
package = pkgs.nextcloud31;
database.createLocally = true;
config = {
dbtype = "pgsql";

8
systems/x86_64-linux/stargate/services/nginx.nix
View file

@ -58,6 +58,14 @@ in {
};
};
"dns.kylekrein.com" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://${config.services.adguardhome.host}:${builtins.toString config.services.adguardhome.port}";
};
};
"music.kylekrein.com" = {
enableACME = true;
forceSSL = true;