From ae475a4d89a6278fc020bd86b9f6a71982dd5618 Mon Sep 17 00:00:00 2001
From: Daniel Kempkens <daniel+git@kempkens.io>
Date: Wed, 22 May 2024 22:57:56 +0200
Subject: [PATCH] agh: restructure and reconfigure

---
 .../argon/adguardhome-sync/environment.age    | Bin 589 -> 605 bytes
 secret/hosts/Styx.nix                         | Bin 2002 -> 2005 bytes
 system/hosts/argon.nix                        |   1 +
 system/nixos/acme-argon.nix                   |   5 +++
 system/nixos/acme-mediaserver.nix             |   4 ++
 system/nixos/adguardhome.nix                  |  37 ++++++++++++++++--
 system/nixos/tailscale-argon.nix              |   6 +++
 7 files changed, 49 insertions(+), 4 deletions(-)
 create mode 100644 system/nixos/tailscale-argon.nix

diff --git a/agenix/hosts/argon/adguardhome-sync/environment.age b/agenix/hosts/argon/adguardhome-sync/environment.age
index 8d6555b157bfa2d493e7c98c7ef75148eece33e8..47dffa04106bb3b9612822baa2e0a148f406e1c4 100644
GIT binary patch
delta 572
zcmV-C0>k~y1l<IXEPqf-Q$|#Ed2&WWae78XR#8w{Yf&~aZ8UOLOfye0W=uj+HdR7K
zd1Gr)SqgSDQ*K#WM|e3@STZp$Z&^iBZDUSaYD#rjctb)pMQKx2cylXlSbBA0NeV4K
zAaiqQEoEdfH8n9gATefROjS`JWlKp_W=uh5Xfs1<MMG<4Nq<5zFF{O2b24FdGDmkf
zdQftDZ*XvUOF3?D3Rgi;LrZl<aWh6sR!mnjXhCjHRC8)|S1V3KdUJL&Id)b<L}qkV
zHCAV53N0-yAVNzqVNh>FD@$5sacF05IcGw4aWGMBXmw04D|%~2YEw%_QB7z@VQWcE
z3e|&f5!W<QF@Khaw-&(YSM51;o}~kU0f~>l@dCj{r`E>kBo7*|2uOd^|1kRLy#w-}
zxQE%%PHS@g<ew-UrxX+>;8fPvojD{w0SdWp(B%r*?ZQ&M7<Dx4t>53)RB;RLEQDH*
zatZY<;0x%$D<$;ujTdSw6CqnLOeq~zPtmSj2O^?3z<<T!#|HcN^6MleS8;Yc42Rr*
zR^OY)AZVb+a7Fpz(h_?_s36Hj<*o^iRg(Abl%O8Spm}@<866NX?4lz~`NQypwJ1_G
zKrO15xqB?v>h!1;2pv>D=>xu))cq=Vc>BlCOUqouxU%uY>5IVuWSbjP*Ct0C;Ec}w
z-6DTiCN(B4)Vxw|P~?;lc@(ug%<NA&g_etT7X)-O08K(X^sdwHnRJ3{!U=1XODKZP
K%3(+EUj2)txA4pW

delta 556
zcmV+{0@MB71kD7HEPrZJcxgpqa8WUFOIl4$VpMi*OEP+FN_S^jb4+JLP;^LbOH6H3
zQg<_GSqf@HNpNdYFH=@AF;rtzW@b`2D`z!VO>Rp_NJ&sQPD)~BN>@W+Id?QdcM2^&
zAaiqQEoEdfH8n9gATefROjS`JLRdC=S7>xvHFa8eQ%`9tZhuR9RaHkyY%ouEdRBN^
zZbfE8D{xambaXOJ3Pn&)H*Q8mSz|>vaZgoLIbu~SRZn(#H&QoxP+@OxZcln|X+lYK
zFlkst3N0-yAWTkecvDt)FnKFBR#Qe(O?Gy4R8e$gNN!|xXK`mUcQQjXa$<F9QF>!@
z3hNeaejdq#W`AD44tfD$XC?fhfo7p(o=D(;fS=i~+0y9xxj6MNIS21KJ9g!OW{P9F
zZ{=rY8hnI0wQE$tp=t2(`h^Xz=x^_&=7nhnpJ@y$jVYc~5u-|Gg)*Dm-#_Uj0V-mc
zru!^tu&N}Y<^LMoEf5TPtH7<Ca{k_^SA1mn&*3=Ve}7#ShG)%rXdYD`*)4PN+f!%$
z{_Uc(f#WisIt6EGgiCz$ZHCYagFsHfagVI?u~<}N103J5QJ8-ByTllSmtWVM?C;l1
zY~8NavI_7n&M)<cefj+E{Qc3bsWb9~gLjLiEY3gHYZ4PYU`cfS-H7b9DLZs!zDmP8
udT_WruqAz(=A@%hY0e>-R?fha^%Vk7h&Q9yo;t*7*jg}BdsJ9PvGLB?uk+Xd

diff --git a/secret/hosts/Styx.nix b/secret/hosts/Styx.nix
index 08223016a3496ceaed3ea8a096b578aefff9e5af..8e0d6a347487fb434fa44545af9c435d39e78bb2 100644
GIT binary patch
literal 2005
zcmV;`2P*ggM@dveQdv+`05IYmp6DzQrQfq6k;0vC$xG&AooUa;1+(zq^Nwdko}DV@
z>JO^wEB6oyfX<q<P0K6-0<%i`##`H(Cuhh{3EyGNRfvaS?IQkA=^`faXp(vUcvU^n
z)!n;ZEQU)ObI?QX+7>?!{2J;jzDhW|)s-H&f6%HuST=#KSI*aU%8uDS&neiE43O;>
z>cXyHX>N+unpEK>Wuv8p%?0h<a?V}ZMRD<lkaDs=IhCv2ox=bAnwFP@zAVGzF%0+t
z)fA64;tl5!*>#z7@6+ogUr}B3^fXcvzbwWwYp+gj(l_uI0E2)NUrdVrNVp+&Gn=7Y
z)3?4tNj)TjCB+N^_+<;+o1Ri`EGdEm8yf91TouR;*Y3mErm%+je%^yx$f-c^uIdAe
zO5oO!>m_qnob=MGU4ImB1`?Sogk>C0OWbn_hJ7^I$2gKDDy}qs_hZq(&97<6{<Z~?
z;#T=On;VlUukswA$9q5MR97w$9DEKHOd+3xtSujqe-r~d)bTJY0Gov&wl9SP8t)sA
zjnu_9Qh^Nna1UU*F0tzJYX9C@2{pd+BnVOnUVDxnct@4HVG#0$xM-pqmBL`Av#X4c
z3vLP2O}w}7(?c^cg6jKz#^<fx32Vr%!rNm|{3y?Fc<c(smgyq6h~q>bEBOPf_nb3q
zyn^2rncoF&n04ia^OA|-aJJ<zgP8V+*2($!!p;0@o7{h5hTtPid;wR?7^BX0%AVoD
z)SZe*uF{t-7u!7_DQTe1x_&_Pm;yVgGD|uyacog(5JZ63j3&N~W0NAK9Q^wNoW8ye
zJJlA9v<=5-{nnr7&mS_Qc@y5!6(!lF*idYV6i)Xm7NLH%rZIjj>xd`ji4v$coapL>
z28sN<dVj`mAsBX~>4^nd7lH=yVTe=HS8YXZci_%=cX|bFP6FODB%O4L!7{(e?-Sdx
zqj7tX%4Spg_Q=5ys9T*~urUM<NuZ6{IM*-|ZNSh0Xz1Ur*Yk{e#VLJ}J#<KaM@4S4
zsN@R@CABI0bjx&EPoM-flQrfF&)Fb5OpV@N-qtIHJ<cIE%*QS_UaOD_TgQvzMB(X;
zZT5Bb*G_ft<7&$42Ub2G5$$^nOWO#FWLD3}LyymkJ{478gUrrp1&I5!e@FdMIFmb~
zDaGw^do=6)0X^H+H}REQfV?b-tfAtnKn?~5I#5`!ZT^x1w8dgtaQ{Z<r+~%h(()dx
zBt83Nj*8+NisZ`N6Dk@nG_>YIMpB+`I)#TeUp5E$a|XF>WYH43ld#4HmO-^>w97u8
zVl5rTYl=;F@>_~~7fLv2==xFAWFSlf3g>sf23MDS0o3j3a@u-eTFNhQ0UNledw)-d
zZA`xda+fy*#j~@FKs74fOJh~@C2_^NfepWviNy;wdp?$FK874Z;&3kBeJv@1GBtIj
zeS1Op@c;x8rR-b<KY1+ZvW~h=b90AkdZ5aM@c*6o=3~G5r`g^LQF$+4z91UeBqs8@
z`ds#}y?udk$Z>HhMI#-vX~}C$XHPfuf=brM)~J%;%H5R?9JgV{{t6*>Tfgr-qWdiR
z9U?7DT<N5jX)Br%EE<jL+Jpua@av;6XR2$kF*s3gC3%ngC8fCk@{m)x6Ya-!%3ljr
z<0a0VgA}M7aW>N-0w)W&qlFGywYu$bSJ8Ki`wM0$4{IaH;+)O*srO=*R4~z1MQS1`
z90Rgxu#yyP%0vP^6L1PMxA*}>f&f?v$>%-x9#Lt-yb$P1IlRJXiDTzv1f-YPs@wfx
zrML2nE{T*rd>MibC~$pH2C4ujFi2rE<AyK>1+XJ18V704-`GqdWcIfzI1w}6Fc%w>
zsuG{OwGBls^BFYURK^6^oqEace{X~)!0ST-2QIq()RA+J1o+_oa^vSNEzwbXr<DWb
zip|rS#CH1pYJlvUZjJNi5Fc2_0DIkExWhviLB`*2yeY6Dkf=&X&f*te)v1)CxaNGF
zbeLG_bY>9su9YIC1x>*05S+r#)IfNX4M5k|RZqKu;bQnyx<z?<r3kmlZ)ZqPB5CsJ
zguBG5Os--Y99M78AbH=>4eFuw>I?~V6JWkMo?`wv$Kjbj)25EIED#=*x2;g|QaIG^
zNsvQ~@qwnFK6RF=m#PohOIA+Y)0i2U)0W%S9W#|{zqTNC^7walIxaTb!GX*!8d+;M
z%(GvSewZT<={laBR-xoL*d*8~U(ZU<`)E(A=;sC6RM2;8lH3GTk&RFG-5GE%{U}>?
zpXKDx(x5q^ivJ4VL39aZ6OSgM?;63CiQWEua&~V`y`7`Cf$EvTw}lkE)gY`NQ6x1)
zvWAUn>axzfY$8e0%%Clbb)0Su8VdwpnpxXndt14_q@_L58KzGo&A|QvYs8VMETREZ
zx4h}YS|f@J3|>;d*%QKhLNiF)Tmv`)Si7ET#w|?CWg+sp4lZow`y)`h73nSq-Vhyc
z?HhHA7S@y;UH=_H7Vg{&rHm1#psq)esos&eB9Ap&dXyG%woVBu-dp>SDuN7Az|##j
zT;_yABBNE?S1O2Uq%-U{8o2}pf<Y)H+LiBqjF0Emxf>?7FJ=dAI_gIxKDZPUb_i?M
nWP|_v&_-kfH~GwNio^lV!Zz4pvfx^E(yY>JD#b}dq}rlW8KvSI

literal 2002
zcmV;@2QByjM@dveQdv+`05q2siu}bJWZF_@==bd?`G;COy*^UVlGg_nOK&rkX5blh
z?B(17xKLeW`=;5}W#f>s&TCLh_iqpmiNS3~9#QKq63_SU3@8+wO;5erIn-J%{JPi&
zozg&N1%V3eD%@5QD#bxmYE#v|YZ?7xacx0A`1U&KrLe>El!gbWioeoE@!nmCJs9K7
z6%oMH*E(2LNd`3m&gl_Uml*KAa9R5&6JG-*?@?yZ#)D*{zuU6+Y7bX#u+r%ro(7*|
zR)nx;^b)&1u4Py`*i`{fc3%cl%Cm0Ajb{`4OITe=Pn&T@Gai$-wau0(P7Z*xY@^Q8
zozV2?I_m6L&tGQthGz00K>XHyOGCuOLIppUjUy;0S}Qh08+-8u#o;LjP#<|KwQ%{O
zap238@r3T)p#Z0K)Ru$<wqc+Rh=Z7evYlKSCe6MyN?|3e07JWDEe^rH$k5k;!3i~6
ztK}Tf!}RY*9OoQhJZE?j_6Je7+0b?Cc=s&mtf7B;D_eT+B*Q1T6yins-2+J!JtX{N
zF+57u)0S`ujL8SgpcqU|ur2K0>#E<TDR)APYhK#k*Ba&XL|Aa!+J6Nk(4HZ~5grq-
zzp~rP+IDNeY6<$*4AaSigvooq3G<S)n^oOAl+*o?km(tMDNjA%38scEk0q#=-#n2x
zPbD}i;&58GK(Cglf<Wv(PDhn|MxQd<3ORM_m%NBhaj#*Usto`)>_%fgx1X9`b#*Qt
z$;UamN_&l|1CoepyLWx>c!7q*)}vZKyXBG$^0AnSR5C2}NkiUf3xb6}h(F0Pyjq82
ziy5Sf=6fPL>T4tblLp&Iv8TnuKNvt!joQ>axAkylt1{hPEXSRAqM|zRhB<MW2cn4G
zu^?v7ZWBlgFk12XtnXXk6^z}ane+N9AMlne92ck97HIC`QS7%nIH?wqdANRb+}a3z
zt#Knuq*tLV!7_XS9Y!0KnAqXE<KGsQy>63I3J3_o@Qd2q0k*?~3Y2pt)39#CKd3;O
z%_^KbER@k9mGM%o`L=-uT!kl4T*9QMw;Q89{`DRbTWA<!4>J!1Skxk;`=fb|OjIZX
zB2K|#WqF=wiFA7DT@%Wl8tq7mUWX&WOkV-=(%5U8<!VT;4p}_`$BJXKS528$(Z)P)
z{>-1tQ(BTK<!UNwF|;-kBX}tTeHR1{Z}HLDbqpJUI4Q6(5+PGPEVzu@$7uYzHz!#Z
zmu({@6=>+=@Q&fvM0`lkP|S~5$y%tg#Ns;EP|OCUeICS&CSo0Lqg=?H^FUCLo9I<G
zcfvw-EAD^lKhIAD{6;rj6Lck{3T@9gKf_oD-XzH0XNCA5+0Cc(_HQm5y!%f=;iDpu
z@BsnxgEu7-e*-FR^kmGg5T51uEl8E!u3TDdCglZX`8|)gM;gw%tV6MKm9414X}=is
z<XzHgE<FSM&ogvX)IP>7e6aUZtpx2w!5~8PR^7%1i++Hy(f=4jhDx1Vo-{FiUgwGT
zT>^L1=C$3&BSxfLn8IEohg~OHTE;6OVS5WwR(C{_{OVG8LeN5D$7cPIVTf8sAXGEK
z&ilk3Up0NA@041rX$bSVYE*(U10WU&aPd)S&04G)GBX<f>2^G?Z-I-SqO8FeY4Kco
zT%$CzpVl~&nI1H}f>ubcFaYu*?cQ^o<Z&wPmr~kkoD3JSGaiME0tPKW4})nm;*uw0
z__%@Bu-V-q_vpy--yWss(%xBm6vgHD5x|(`T5d&|uVWZpuTjsG5{pMjzI=GlW#!-#
z^lWy7Mb3yyAL##$si>C6a6HNs!35SeG_T<FJ(|&QSK|gPV22a!x$e~&n$=fMM#S5X
z&tcnQW6#mJ`?ZTR_O-~Eq~PodxZhSj7`W?apl(65Ly3ECtf6Mg)B!*T*@tWZ1D+kR
zJR(}YA<2$E7k|&6Mm0p&2J;9os9z*rj|5&{PCzL=doT=oy}g*$G0Bgw04OPr{K*8A
z+$4gQEdMpDKrRUq%5(DeoYaaX`#lxC+E-lZHvNPrfqlMW0w<l!-9I>kkFl>=D#gw^
z=!P05bO0^2F=aAMR26B5v0EdcQl@73qn2mtKHb#mKL_nbmkDI);@=3x4{S{KbAvRJ
zbQ1>9v~MU&V_pRX%9C=5gC0=TTR@gw-dNa(bo24$J>@$<QhVh?8VUHD{7D%u*<Y*G
zc8J2L3nshcVcVk@HA2#NK=d8~CBvN}>43SKnd0h`l{`KTY!cDAOttSWugEKVFEbx1
zoHDCR-7;14>gpX2Ru|cyfv3sUc8-Hq@)cx+-3G*%3M&5BzZm|3pc2ZFg(P)1{;DzB
zm&RJ6P*<Uo@*S;Ce>~BHq=8ADko<&Kj8L93J7FYW{vw4+FKM}*Hji=)P}y33fW)rX
z9|LSF@6PG+eJ*wa)27Tlv}o)*Nfcu6Z|W4^SnIzp*C!SYw5v4|2~T~9{G)2hNQ%(8
zf9&+InN%)yYQ?Le>&3E6@YGs`7S(a>KCUTCbPqISEUZ!Pw)7!#JnL&;3t$irce+rN
z5dZA}<K&h)j9&+nD3RW6#Dx9hfrqQLQr=_DfnAIPa}TH!-Hz85rCA$&>CiuIfJ(fU
k^RAngG|Yg<ywrYr_)idP{&7}cJ!u(^PkLG6MFWz#Fa^5U_y7O^

diff --git a/system/hosts/argon.nix b/system/hosts/argon.nix
index e6b475f..2c92012 100644
--- a/system/hosts/argon.nix
+++ b/system/hosts/argon.nix
@@ -32,6 +32,7 @@ in
     # ../nixos/telegraf.nix
 
     ../nixos/tailscale.nix
+    ../nixos/tailscale-argon.nix
 
     ../nixos/unbound.nix
 
diff --git a/system/nixos/acme-argon.nix b/system/nixos/acme-argon.nix
index d224cc9..004e4eb 100644
--- a/system/nixos/acme-argon.nix
+++ b/system/nixos/acme-argon.nix
@@ -18,6 +18,11 @@
       "internal.kempkens.network" = {
         domain = "*.internal.kempkens.network";
       };
+
+      "dns.kempkens.network" = {
+        extraDomainNames = [ "*.dns.kempkens.network" ];
+        reloadServices = [ "adguardhome.service" ];
+      };
     };
   };
 }
diff --git a/system/nixos/acme-mediaserver.nix b/system/nixos/acme-mediaserver.nix
index 760b635..58f35ff 100644
--- a/system/nixos/acme-mediaserver.nix
+++ b/system/nixos/acme-mediaserver.nix
@@ -19,6 +19,10 @@
         domain = "*.internal.kempkens.network";
         extraDomainNames = [ "jellyfin.home.kempkens.io" ];
       };
+
+      "dns.kempkens.network" = {
+        extraDomainNames = [ "*.dns.kempkens.network" ];
+      };
     };
   };
 }
diff --git a/system/nixos/adguardhome.nix b/system/nixos/adguardhome.nix
index b3ea7f7..f2a8d3b 100644
--- a/system/nixos/adguardhome.nix
+++ b/system/nixos/adguardhome.nix
@@ -5,7 +5,29 @@
     enable = true;
 
     mutableSettings = true;
-    settings = null;
+    # settings = null;
+
+    settings =
+      let
+        inherit (config.security.acme) certs;
+      in
+      {
+        tls = {
+          enabled = true;
+
+          port_https = 10443;
+          port_dns_over_tls = 1053;
+          port_dns_over_quic = 1053;
+          port_dnscrypt = 0;
+
+          certificate_path = "${certs."dns.kempkens.network".directory}/fullchain.pem";
+          private_key_path = "${certs."dns.kempkens.network".directory}/key.pem";
+
+          server_name = "dns.kempkens.network";
+          allow_unencrypted_doh = true;
+          strict_sni_check = true;
+        };
+      };
 
     # settings = {
     #   schema_version = 20;
@@ -42,6 +64,10 @@
     # };
   };
 
+  systemd.services.adguardhome.serviceConfig = {
+    SupplementaryGroups = [ "nginx" ];
+  };
+
   networking.firewall.interfaces =
     let
       interfaces = lib.mapAttrsToList (_: lib.attrsets.attrByPath [ "matchConfig" "Name" ] null) config.systemd.network.networks ++ [ "tailscale0" ];
@@ -52,8 +78,8 @@
           {
             name = iface;
             value = {
-              allowedTCPPorts = [ 53 9053 ];
-              allowedUDPPorts = [ 53 9053 ];
+              allowedTCPPorts = [ 53 1053 9053 10443 ];
+              allowedUDPPorts = [ 53 1053 9053 10443 ];
             };
           })
         (builtins.filter builtins.isString interfaces));
@@ -74,7 +100,10 @@
     };
 
     virtualHosts."${secret.adguardhome.domain_prefix}.internal.kempkens.network" = {
-      serverAliases = [ "dns.internal.kempkens.network" ];
+      serverAliases = [
+        "${secret.adguardhome.domain_prefix}-direct.internal.kempkens.network"
+        "dns.internal.kempkens.network"
+      ];
 
       listen = [
         {
diff --git a/system/nixos/tailscale-argon.nix b/system/nixos/tailscale-argon.nix
new file mode 100644
index 0000000..e2141a5
--- /dev/null
+++ b/system/nixos/tailscale-argon.nix
@@ -0,0 +1,6 @@
+{
+  services.tailscale.extraUpFlags = [
+    "--accept-dns"
+    "false"
+  ];
+}