mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-11 07:10:39 +02:00
Code Activity

feat(adguardhome): bind only external interface

Browse source
This commit is contained in:
oddlama 2023-07-06 02:34:07 +02:00
parent 31ef29569d
commit 3f6286ef31
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
7 changed files with 122 additions and 59 deletions
Download patch file Download diff file Expand all files Collapse all files

50
hosts/ward/microvms/adguardhome.nix
View file

@ -2,6 +2,7 @@
config,
lib,
nodes,
pkgs,
utils,
...
}: let
@ -34,23 +35,50 @@ in {
};
};
networking.firewall = {
allowedTCPPorts = [53];
allowedUDPPorts = [53];
};
services.adguardhome = {
enable = true;
mutableSettings = false;
settings = {
bind_host = config.meta.wireguard.proxy-sentinel.ipv4;
bind_port = 3000;
#dns = {
# edns_client_subnet.enabled = false;
# bind_hosts = [ "127.0.0.1" ];
# bootstrap_dns = [
# "8.8.8.8"
# "8.8.4.4"
# "2001:4860:4860::8888"
# "2001:4860:4860::8844"
# ];
#};
dns = {
edns_client_subnet.enabled = false;
bind_hosts = [
# This dummy address passes the configuration check and will
# later be replaced by the actual interface address.
"123.123.123.123"
];
# allowed_clients = [
# ];
#trusted_proxied = [];
ratelimit = 60;
upstream_dns = [
"8.8.8.8"
"8.8.4.4"
"2001:4860:4860::8888"
"2001:4860:4860::8844"
];
bootstrap_dns = [
"8.8.8.8"
"8.8.4.4"
"2001:4860:4860::8888"
"2001:4860:4860::8844"
];
dhcp.enabled = false;
};
};
};
systemd.services.influxdb.after = ["sys-subsystem-net-devices-${utils.escapeSystemdPath "proxy-sentinel"}.device"];
systemd.services.adguardhome = {
after = ["sys-subsystem-net-devices-${utils.escapeSystemdPath "wan"}.device"];
preStart = lib.mkAfter ''
INTERFACE_ADDR=$(${pkgs.iproute2}/bin/ip -family inet -brief addr show wan | grep -o "[0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+")
sed -i -e "s/123.123.123.123/$INTERFACE_ADDR/" "$STATE_DIRECTORY/AdGuardHome.yaml"
'';
};
}