adguardhome.nix

{
  config,
  globals,
  lib,
  ...
}:
let
  adguardhomeDomain = "adguardhome.${globals.domains.me}";
in
{
  wireguard.proxy-sentinel = {
    client.via = "sentinel";
    firewallRuleForNode.sentinel.allowedTCPPorts = [ config.services.adguardhome.port ];
  };

  # Allow home-assistant to access it directly
  wireguard.proxy-home = {
    client.via = "ward";
    firewallRuleForNode.sausebiene.allowedTCPPorts = [ config.services.adguardhome.port ];
  };

  globals.services.adguardhome.domain = adguardhomeDomain;
  globals.monitoring.dns.adguardhome = {
    server = globals.net.home-lan.vlans.services.hosts.ward-adguardhome.ipv4;
    domain = ".";
    network = "home-lan.vlans.services";
  };

  nodes.sentinel = {
    services.nginx = {
      upstreams.adguardhome = {
        servers."${config.wireguard.proxy-sentinel.ipv4}:${toString config.services.adguardhome.port}" =
          { };
        extraConfig = ''
          zone adguardhome 64k;
          keepalive 2;
        '';
        monitoring = {
          enable = true;
          expectedBodyRegex = "AdGuard Home";
        };
      };
      virtualHosts.${adguardhomeDomain} = {
        forceSSL = true;
        useACMEWildcardHost = true;
        oauth2.enable = true;
        oauth2.allowedGroups = [ "access_adguardhome" ];
        locations."/" = {
          proxyPass = "http://adguardhome";
          proxyWebsockets = true;
        };
      };
    };
  };

  environment.persistence."/persist".directories = [
    {
      directory = "/var/lib/private/AdGuardHome";
      mode = "0700";
    }
  ];

  networking.firewall = {
    allowedTCPPorts = [ 53 ];
    allowedUDPPorts = [ 53 ];
  };

  topology.self.services.adguardhome.info = "https://" + adguardhomeDomain;
  services.adguardhome = {
    enable = true;
    mutableSettings = false;
    host = "0.0.0.0";
    port = 3000;
    settings = {
      dns = {
        bind_hosts = [ globals.net.home-lan.vlans.services.hosts.ward-adguardhome.ipv4 ];
        # allowed_clients = [
        # ];
        #trusted_proxies = [];
        ratelimit = 300;
        upstream_dns = [
          "https://dns.cloudflare.com/dns-query"
          "https://dns.google/dns-query"
          "https://doh.mullvad.net/dns-query"
        ];
        bootstrap_dns = [
          "1.1.1.1"
          # FIXME: enable ipv6 "2606:4700:4700::1111"
          "8.8.8.8"
          # FIXME: enable ipv6 "2001:4860:4860::8844"
        ];
        dhcp.enabled = false;
      };
      filtering.rewrites =
        [
          # Undo the /etc/hosts entry so we don't answer with the internal
          # wireguard address for influxdb
          {
            inherit (globals.services.influxdb) domain;
            answer = globals.domains.me;
          }
        ]
        # Use the local mirror-proxy for some services (not necessary, just for speed)
        ++
          map
            (domain: {
              inherit domain;
              answer = globals.net.home-lan.vlans.services.hosts.ward-web-proxy.ipv4;
            })
            [
              # FIXME: dont hardcode, filter global service domains by internal state
              globals.services.grafana.domain
              globals.services.immich.domain
              globals.services.influxdb.domain
              globals.services.loki.domain
              globals.services.paperless.domain
              globals.services.esphome.domain
              globals.services.home-assistant.domain
              "fritzbox.${globals.domains.personal}"
            ];
      filters = [
        {
          name = "AdGuard DNS filter";
          url = "https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt";
          enabled = true;
        }
        {
          name = "AdAway Default Blocklist";
          url = "https://adaway.org/hosts.txt";
          enabled = true;
        }
        {
          name = "OISD (Big)";
          url = "https://big.oisd.nl";
          enabled = true;
        }
      ];
    };
  };

  systemd.services.adguardhome.serviceConfig.RestartSec = lib.mkForce "60"; # Retry every minute
}