Adguard Home (Adblocking + Local DNS Rewrite)

flake.nix

@@ -163,9 +163,9 @@
         inherit (inputs) self;
         overrides = {
           user = "root";
-          kylekrein-server.hostname = "kylekrein.com";
+          stargate.hostname = "kylekrein.com";
         };
-        exclude = ["kylekrein-wsl-wm"];
+        exclude = ["kylekrein-wsl-wm" "kylekrein-server"];
       };
 
       outputs-builder = channels: {

systems/x86_64-linux/stargate/services/adguardhome.nix

@@ -0,0 +1,72 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: {
+  services.adguardhome = {
+    enable = true;
+    host = "127.0.0.1";
+    port = 12270;
+    mutableSettings = false;
+    settings = {
+      users = [
+        # nix shell nixpkgs#mkpasswd --command mkpasswd --method=bcrypt
+        {
+          name = "kylekrein";
+          password = "$2b$05$W03hndNglgdYbbmsgR8Oxe5HaDi.ZeW9AIJvyB9oA9Bn8qDgYKFSy";
+        }
+      ];
+      dns = {
+        bind_hosts = [
+          "127.0.0.1"
+          "::1"
+          "192.168.178.129"
+        ];
+        upstream_dns = [
+          "94.140.14.14"
+          "94.140.15.15"
+          "1.1.1.1"
+        ];
+        bootstrap_dns = [
+          "94.140.14.14"
+          "94.140.15.15"
+          "1.1.1.1"
+        ];
+      };
+
+      filtering = {
+        protection_enabled = true;
+        filtering_enabled = true;
+
+        parental_enabled = false;
+        safe_search = {enabled = false;};
+        rewrites =
+          map (url: {
+            answer = "192.168.178.129";
+            domain = url;
+          }) [
+            "kylekrein.com"
+            "*.kylekrein.com"
+          ];
+      };
+
+      filters =
+        map (url: {
+          enabled = true;
+          url = url;
+        }) [
+          "https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt" # AdGuard DNS filter
+          "https://adguardteam.github.io/HostlistsRegistry/assets/filter_9.txt" # Malware
+          "https://adguardteam.github.io/HostlistsRegistry/assets/filter_11.txt" # Malicious URLs
+          #https://github.com/hagezi/dns-blocklists
+          "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.txt" # Pro blocking
+          "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/tif.txt"
+          "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/fake.txt"
+          "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/popupads.txt"
+        ];
+    };
+  };
+  networking.firewall.allowedTCPPorts = [53];
+  networking.firewall.allowedUDPPorts = [53];
+}

systems/x86_64-linux/stargate/services/coturn.nix

@@ -35,7 +35,32 @@
     static-auth-secret-file = config.sops.secrets."services/turn".path;
 
     extraConfig = ''
+      # for debugging
+      verbose
+      # ban private IP ranges
       no-multicast-peers
+      denied-peer-ip=0.0.0.0-0.255.255.255
+      denied-peer-ip=10.0.0.0-10.255.255.255
+      denied-peer-ip=100.64.0.0-100.127.255.255
+      denied-peer-ip=127.0.0.0-127.255.255.255
+      denied-peer-ip=169.254.0.0-169.254.255.255
+      denied-peer-ip=172.16.0.0-172.31.255.255
+      denied-peer-ip=192.0.0.0-192.0.0.255
+      denied-peer-ip=192.0.2.0-192.0.2.255
+      denied-peer-ip=192.88.99.0-192.88.99.255
+      denied-peer-ip=192.168.0.0-192.168.255.255
+      denied-peer-ip=198.18.0.0-198.19.255.255
+      denied-peer-ip=198.51.100.0-198.51.100.255
+      denied-peer-ip=203.0.113.0-203.0.113.255
+      denied-peer-ip=240.0.0.0-255.255.255.255
+      denied-peer-ip=::1
+      denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
+      denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
+      denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
+      denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
     '';
   };
 

systems/x86_64-linux/stargate/services/nextcloud.nix

@@ -16,7 +16,7 @@ with lib.custom; {
   sops.secrets."services/nextcloud" = {owner = "nextcloud";};
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud32;
+    package = pkgs.nextcloud31;
     database.createLocally = true;
     config = {
       dbtype = "pgsql";

systems/x86_64-linux/stargate/services/nginx.nix

@@ -58,6 +58,14 @@ in {
         };
       };
 
+      "dns.kylekrein.com" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://${config.services.adguardhome.host}:${builtins.toString config.services.adguardhome.port}";
+        };
+      };
+
       "music.kylekrein.com" = {
         enableACME = true;
         forceSSL = true;