nixos/system/services/adguardhome.nix

{ ... }:
{
  services.adguardhome = {
    enable = true;
    port = 3200;
    mutableSettings = false;
    openFirewall = true;
    settings = rec {
      dns = {
        bind_hosts = [
          "127.0.0.1"
          "192.168.0.31"
        ];
        bootstrap_dns = [
          "9.9.9.9"
          "149.112.112.10"
        ];
        ratelimit = 0;
        safe_search.enabled = true;
        rewrites = [
          {
            domain = "xenia.me.uk";
            answer = "192.168.0.31";
          }
          {
            domain = "*.xenia.me.uk";
            answer = "A"; # "192.168.1.230";
          }
        ];
        blocked_services.ids = [ ];
      };
      filtering = {
        inherit (dns) safe_search rewrites blocked_services;
      };
      querylog.ignored = [
        "discovery.syncthing.net"
        "discovery-v6.syncthing.net"
      ];
      statistics = {
        inherit (querylog) ignored;
      };
    };
  };
  networking.firewall = {
    allowedTCPPorts = [ 53 ];
    allowedUDPPorts = [ 53 ];
  };
}