containers: add adguardhome

Signed-off-by: Myned <dev@bjork.tech>

options/custom/containers/adguardhome.nix

@@ -0,0 +1,56 @@
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.custom.containers.adguardhome;
+in {
+  options = {
+    custom.containers.adguardhome.enable = mkOption {default = false;};
+  };
+
+  config = mkIf cfg.enable {
+    #?? arion-adguardhome pull
+    environment.shellAliases.arion-adguardhome = "sudo arion --prebuilt-file ${config.virtualisation.arion.projects.adguardhome.settings.out.dockerComposeYaml}";
+
+    virtualisation.arion.projects.adguardhome.settings.services = {
+      # https://github.com/AdguardTeam/AdGuardHome
+      # https://adguard-dns.io/kb/adguard-home/overview/
+      adguardhome.service = {
+        container_name = "adguardhome";
+        image = "adguard/adguardhome:v0.107.56";
+
+        ports = [
+          "53:53" # DNS
+          "853:853" # DNS-over-TLS
+          "3003:80" # Admin panel
+          "8443:443" # DNS-over-HTTPS
+        ];
+
+        restart = "unless-stopped";
+
+        volumes = [
+          "${config.custom.containers.directory}/adguardhome/config:/opt/adguardhome/conf"
+          "${config.custom.containers.directory}/adguardhome/data:/opt/adguardhome/data"
+        ];
+      };
+    };
+
+    # https://github.com/AdguardTeam/AdGuardHome/wiki/Encryption
+    networking.firewall = {
+      allowedTCPPorts = [
+        853 # DNS-over-TLS
+      ];
+
+      allowedUDPPorts = [
+        53 # DNS
+      ];
+    };
+
+    # https://adguard-dns.io/kb/adguard-home/faq/#bindinuse
+    services.resolved.extraConfig = ''
+      DNSStubListener=false
+    '';
+  };
+}

profiles/server/default.nix

@@ -11,6 +11,7 @@
       enable = true;
       boot = true;
       actualbudget.enable = true;
+      adguardhome.enable = true;
       conduwuit.enable = true;
       coturn.enable = true;
       forgejo.enable = true;