hosts/srv-core/configuration.nix

@@ -17,11 +17,10 @@
     };
 
     services = {
-      blocking-nameserver = {
+      recursive-nameserver = {
         enable = true;
-        gui.domain = "adguard.${config.custom.networking.overlay.fqdn}";
+        blockAds = true;
       };
-      recursive-nameserver.enable = true;
       private-nameserver.enable = true;
 
       syncthing = {

hosts/vps-ns/configuration.nix

@@ -1,4 +1,4 @@
-{ config, self, ... }:
+{ self, ... }:
 {
   imports = [ self.nixosModules.server-profile ];
 
@@ -21,11 +21,10 @@
     };
 
     services = {
-      blocking-nameserver = {
+      recursive-nameserver = {
         enable = true;
-        gui.domain = "adguard.${config.custom.networking.overlay.fqdn}";
+        blockAds = true;
       };
-      recursive-nameserver.enable = true;
       private-nameserver.enable = true;
       public-nameserver = {
         enable = true;

modules/nixos/networking/overlay.nix

@@ -6,24 +6,6 @@
 }:
 let
   cfg = config.custom.networking.overlay;
-
-  blocking-nameservers =
-    allHosts
-    |> lib.attrValues
-    |> lib.filter (host: host.config.custom.services.blocking-nameserver.enable)
-    |> lib.map (
-      host:
-      "${host.config.custom.networking.overlay.address}:${toString host.config.custom.services.blocking-nameserver.port}"
-    );
-
-  recursive-nameservers =
-    allHosts
-    |> lib.attrValues
-    |> lib.filter (host: host.config.custom.services.recursive-nameserver.enable)
-    |> lib.map (
-      host:
-      "${host.config.custom.networking.overlay.address}:${toString host.config.custom.services.recursive-nameserver.port}"
-    );
 in
 {
   options.custom.networking.overlay = {
@@ -78,7 +60,14 @@ in
 
     dnsServers = lib.mkOption {
       type = lib.types.listOf lib.types.nonEmptyStr;
-      default = if (blocking-nameservers != [ ]) then blocking-nameservers else recursive-nameservers;
+      default =
+        allHosts
+        |> lib.attrValues
+        |> lib.filter (host: host.config.custom.services.recursive-nameserver.enable)
+        |> lib.map (
+          host:
+          "${host.config.custom.networking.overlay.address}:${toString host.config.custom.services.recursive-nameserver.port}"
+        );
     };
 
     implementation = lib.mkOption {

modules/nixos/services/nameservers/blocking.nix

@@ -1,95 +0,0 @@
-{
-  config,
-  lib,
-  allHosts,
-  ...
-}:
-let
-  cfg = config.custom.services.blocking-nameserver;
-  netCfg = config.custom.networking;
-
-  recursiveNameservers =
-    allHosts
-    |> lib.attrValues
-    |> lib.filter (host: host.config.custom.services.recursive-nameserver.enable)
-    |> lib.map (
-      host:
-      "${host.config.custom.networking.overlay.address}:${toString host.config.custom.services.recursive-nameserver.port}"
-    );
-in
-{
-  options.custom.services.blocking-nameserver = {
-    enable = lib.mkEnableOption "";
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 53;
-    };
-    gui = {
-      domain = lib.mkOption {
-        type = lib.types.nonEmptyStr;
-        default = "";
-      };
-      port = lib.mkOption {
-        type = lib.types.port;
-        default = 58479;
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services = {
-      adguardhome = {
-        enable = true;
-        mutableSettings = false;
-
-        host = "127.0.0.1";
-        inherit (cfg.gui) port;
-
-        settings = {
-          dns = {
-            bind_hosts = [ netCfg.overlay.address ];
-            inherit (cfg) port;
-
-            upstream_dns =
-              if (recursiveNameservers != [ ]) then recursiveNameservers else [ "9.9.9.9#dns.quad9.net" ];
-            upstream_mode = "parallel";
-            bootstrap_dns = [
-              "1.1.1.1"
-              "8.8.8.8"
-            ];
-          };
-
-          filtering = {
-            protection_enabled = true;
-            filtering_enabled = true;
-          };
-          filters = lib.singleton {
-            enabled = true;
-            url = "https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt";
-          };
-        };
-      };
-
-      nebula.networks.mesh.firewall.inbound = lib.singleton {
-        inherit (cfg) port;
-        proto = "any";
-        host = "any";
-      };
-    };
-
-    systemd.services.adguardhome = {
-      enableStrictShellChecks = false;
-      requires = [ netCfg.overlay.systemdUnit ];
-      after = [ netCfg.overlay.systemdUnit ];
-    };
-
-    custom = {
-      services.caddy.virtualHosts.${cfg.gui.domain}.port = lib.mkIf (cfg.gui.domain != null) cfg.gui.port;
-
-      meta.sites.${cfg.gui.domain} = lib.mkIf (cfg.gui.domain != null) {
-        title = "Adguard Home";
-        icon = "sh:adguard-home";
-      };
-    };
-  };
-}

modules/nixos/services/nameservers/recursive.nix

@@ -1,5 +1,7 @@
 {
   config,
+  inputs,
+  pkgs,
   lib,
   allHosts,
   ...
@@ -8,21 +10,27 @@ let
   cfg = config.custom.services.recursive-nameserver;
   netCfg = config.custom.networking;
 
+  blocklist =
+    pkgs.runCommand "blocklist.conf" { } ''
+      echo "server:" > $out
+      cat ${inputs.blocklist}/hosts \
+        | grep '^0.0.0.0 ' \
+        | awk '$2 != "0.0.0.0" {print "  local-zone: \"" $2 "\" refuse"}' \
+        >> $out
+    ''
+    |> toString;
+
   privateNameservers =
     allHosts
     |> lib.attrValues
-    |> lib.filter (host: host.config.custom.services.private-nameserver.enable)
-    |> lib.map (
-      host:
-      "${host.config.custom.networking.overlay.address}@${toString host.config.custom.services.private-nameserver.port}"
-    );
+    |> lib.filter (host: host.config.custom.services.private-nameserver.enable);
 in
 {
   options.custom.services.recursive-nameserver = {
     enable = lib.mkEnableOption "";
     port = lib.mkOption {
       type = lib.types.port;
-      default = 5336;
+      default = 53;
     };
     blockAds = lib.mkEnableOption "";
   };
@@ -33,11 +41,14 @@ in
         services = {
           unbound = {
             enable = true;
-            settings.server = {
+            settings = {
+              server = {
                 interface = [ "${netCfg.overlay.address}@${toString cfg.port}" ];
                 access-control = [ "${toString netCfg.overlay.networkCidr} allow" ];
                 prefetch = true;
               };
+              include-toplevel = lib.mkIf cfg.blockAds blocklist;
+            };
           };
 
           nebula.networks.mesh.firewall.inbound = lib.singleton {
@@ -62,7 +73,12 @@ in
 
           stub-zone = lib.singleton {
             name = netCfg.overlay.domain;
-            stub-addr = privateNameservers;
+            stub-addr =
+              privateNameservers
+              |> lib.map (
+                host:
+                "${host.config.custom.networking.overlay.address}@${toString host.config.custom.services.private-nameserver.port}"
+              );
           };
         };
       })

modules/nixos/web-services/glance.nix

@@ -8,33 +8,18 @@
 let
   cfg = config.custom.web-services.glance;
 
-  perHostDomains =
-    perHostSitesWidget.widgets |> lib.concatMap (widget: widget.sites) |> lib.map (site: site.domain);
+  observabilityTitles = [
+    "Alloy"
+    "Prometheus"
+    "Alertmanager"
+  ];
 
-  perHostSitesWidget =
-    allHosts
-    |> lib.attrValues
-    |> lib.map (host: {
-      type = "monitor";
-      cache = "1m";
-      title = host.config.networking.hostName;
-      sites =
-        host.config.custom.meta.sites
-        |> lib.attrValues
-        |> lib.filter (site: site.domain |> lib.hasSuffix host.config.custom.networking.overlay.fqdn);
-    })
-    |> lib.filter ({ sites, ... }: sites != [ ])
-    |> (widgets: {
-      type = "split-column";
-      max-columns = widgets |> lib.length;
-      inherit widgets;
-    });
+  hosts = allHosts |> lib.attrValues;
 
   applicationSitesWidget =
-    allHosts
-    |> lib.attrValues
+    hosts
     |> lib.concatMap (host: host.config.custom.meta.sites |> lib.attrValues)
-    |> lib.filter (service: !lib.elem service.domain perHostDomains)
+    |> lib.filter (service: !lib.elem service.title observabilityTitles)
     |> lib.groupBy (
       service:
       service.domain |> self.lib.isPrivateDomain |> (isPrivate: if isPrivate then "Private" else "Public")
@@ -53,6 +38,24 @@ let
       inherit widgets;
     });
 
+  observabilitySitesWidget =
+    hosts
+    |> lib.map (host: {
+      type = "monitor";
+      cache = "1m";
+      title = host.config.networking.hostName;
+      sites =
+        host.config.custom.meta.sites
+        |> lib.attrValues
+        |> lib.filter (service: lib.elem service.title observabilityTitles);
+    })
+    |> lib.filter ({ sites, ... }: sites != [ ])
+    |> (widgets: {
+      type = "split-column";
+      max-columns = widgets |> lib.length;
+      inherit widgets;
+    });
+
   githubWorkflowFiles =
     "${self}/.github/workflows"
     |> builtins.readDir
@@ -126,7 +129,7 @@ in
                   autofocus = false;
                 }
                 applicationSitesWidget
-                perHostSitesWidget
+                observabilitySitesWidget
               ];
             }
             {

tests/overlay/default.nix

@@ -105,7 +105,7 @@
       client2.wait_for_unit("${client2NetCfg.overlay.systemdUnit}")
 
       lighthouse.wait_for_unit("unbound.service")
-      lighthouse.wait_for_open_port(${toString nodes.lighthouse.custom.services.recursive-nameserver.port}, "${lighthouseNetCfg.overlay.address}")
+      lighthouse.wait_for_open_port(53, "${lighthouseNetCfg.overlay.address}")
 
       server.wait_for_unit("sshd.service")
       client2.wait_for_unit("sshd.service")