1 files changed, 33 insertions, 3 deletions
diff --git a/os/srv/dns.nix b/os/srv/dns.nix
index f0c50a6..2da4c66 100644
--- a/os/srv/dns.nix
+++ b/os/srv/dns.nix
@@ -1,10 +1,22 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  masterDomain,
+  securityTemplates,
+  ...
+}:
 let
   cfg = config.os.srv.dns;
   unboundPort = 5335;
 in
 {
-  options.os.srv.dns.enable = lib.mkEnableOption "enables dns scanning";
+  options.os.srv.dns = {
+    enable = lib.mkEnableOption "enables dns scanning";
+    adguardProxyConfig = lib.mkOption {
+      type = lib.types.attrs;
+      default = { };
+    };
+  };
   config = lib.mkIf cfg.enable {
     services.unbound = {
       enable = true;
@@ -63,11 +75,17 @@ in
             config.os.core.network.wg.ip
             config.os.core.network.hs.ip
           ];
+          rewrites = [
+            {
+              domain = "router.local";
+              answer = config.os.core.network.ips.vm1-opnsense;
+            }
+          ];
           port = 53;
           upstream_dns = [ "127.0.0.1:${toString unboundPort}" ];
           bootstrap_dns = [ "9.9.9.9" ];
           cache_size = 536870912;
-          # anonymize_client_ip = true;
+          anonymize_client_ip = true;
         };
 
         filtering = {
@@ -239,6 +257,18 @@ in
       };
     };
 
+    os.srv.dns.adguardProxyConfig = {
+      "adguard.${masterDomain}" = {
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/" = {
+          proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000";
+          extraConfig = securityTemplates.restrictToInternal;
+        };
+      };
+    };
+
     networking.firewall = {
       allowedUDPPorts = [ 53 ];
       allowedTCPPorts = [ 53 ];