- Add internalOnly to AdGuard nginx config
- Add ts-input firewall rule for direct Tailscale access
- Update Netdata to use ts-input chain for consistency
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove `internalOnly = true` flag from Vaultwarden, Forgejo, and AdGuard Home to make them publicly accessible again.
- This also re-exposes the DNS-over-HTTPS (DoH) endpoint on the AdGuard Home domain.
- Add DNS rewrites in AdGuard Home for `*.ashisgreat.xyz` to route to the Tailscale IP (`100.64.0.3`).
- Securely expose the AdGuard Home Web UI to the Tailscale network instead of blocking it completely.
- Configure Headscale to use the VPS Tailscale IP (100.64.0.3) as the global DNS server instead of external providers.
- Add firewall rules to allow DNS requests over the `tailscale0` interface.
- Add iptables PREROUTING rules to redirect standard DNS (port 53) from Tailscale clients to AdGuard Home (port 5353) to resolve port conflicts with `aardvark-dns`.
- Enable DNS-over-TLS (DoT) on port 853 using Nginx's ACME certificates
- Fix an issue where the native NixOS module dropped SOPS client IDs
- Use sops.templates and yq to inject ClientIDs dynamically before start
- Enable allow_unencrypted_doh to fix Nginx proxying DoH correctly
Replace the Podman container and manual YAML templating with the native NixOS module for better system integration and simpler declarative configuration.
AdGuard Home needs write access to working directory.
Config file remains read-only via :ro mount.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
