feat: add adguard

.env

@@ -115,6 +115,7 @@ CLOUDFLARE_API_TOKEN=
 # You can modify these values to suit your needs, but ensure that they are unique and do not conflict with other services.
 ACTUAL_BUDGET_HOSTNAME=actual-budget.${DOMAIN?}
 ADDON_MANAGER_HOSTNAME=addon-manager.${DOMAIN?}
+ADGUARD_HOSTNAME=adguard.${DOMAIN?}
 AIOLISTS_HOSTNAME=aiolists.${DOMAIN?}
 AIOSTREAMS_HOSTNAME=aiostreams.${DOMAIN}
 AIOSTREMIO_HOSTNAME=aiostremio.${DOMAIN}

apps/adguard/.env

@@ -0,0 +1,24 @@
+# To get adguard to work, follow these steps:
+
+# 1. Ensure port 853 is open on your firewall. (Oracle users: add an ingress rule for port 853 on your security list)
+# 2. You should be able to now start this container and complete the setup
+# 3. After setting it up, change the value of ADGUARD_PORT below to 80
+ADGUARD_PORT=3000
+# 4. You now need to edit the configuration file to enable TLS. First, set the permissions to allow writing:
+#    sudo chown ${PGID}:${PUID} /opt/docker/apps/adguard/config/AdGuardHome.yaml
+# 5. Open the file and make the following changes:
+#    - Set `tls.enabled` to true
+#    - Set `tls.server_name` to your domain name - adguard.${DOMAIN} (e.g. adguard.example.com)
+#    - Set `tls.allow_unencrypted_doh` to true
+#    Save the file.
+# 6. Now, recreate the container with `docker compose up -d adguard` (in /opt/docker)
+
+# Limitations:
+
+# Plain DNS (port 53) is not enabled by default. It is recommended that you use DNS over TLS (DoT) or DNS over HTTPS (DoH) instead.
+# If you want to enable plain DNS, uncomment the ports section in the compose file and ensure that port 53 is open on your firewall.
+# Depending on your system, you may also need to stop/remove any existing DNS services on the host such as systemd-resolved.
+# Remember that this means all services on the host also use Adguard and if it goes down/is not running, DNS resolution will fail for all apps. 
+#
+# Since all DNS requests are routed through Traefik, all client IPs will appear as the IP of the Traefik container, rather than the actual client IPs.
+# You may try resolving this using `dns.trusted_proxies` in the AdGuard configuration file.

apps/adguard/compose.yaml

@@ -0,0 +1,39 @@
+services:
+  adguard:
+    image: adguard/adguardhome:latest
+    container_name: adguard
+    restart: unless-stopped
+    environment:
+      - TZ=${TZ:-UTC}
+    expose:
+      - 80
+      - 53
+      - 853
+    # Uncomment the following lines if you want to expose plain DNS. 
+    # You will also need to open the ports in your firewall.
+    # May need to stop/remove any existing DNS services on the host such as systemd-resolved.
+    # ports:
+    #   - "53:53/udp"
+    #   - "53:53/tcp"
+    volumes:
+      - ${DOCKER_DATA_DIR}/adguard/work:/opt/adguardhome/work
+      - ./config:/opt/adguardhome/conf
+    labels:
+      - "traefik.enable=true"
+
+      - "traefik.http.routers.adguard.entrypoints=web"  
+      - "traefik.http.routers.adguard.rule=Host(`${ADGUARD_HOSTNAME}`)"
+
+      - "traefik.http.routers.adguard-secure.entrypoints=websecure"
+      - "traefik.http.routers.adguard-secure.rule=Host(`${ADGUARD_HOSTNAME}`)" 
+      - "traefik.http.routers.adguard-secure.tls=true"
+      - "traefik.http.routers.adguard-secure.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.adguard-secure.service=adguard-secure"
+      - "traefik.http.services.adguard-secure.loadbalancer.server.port=${ADGUARD_PORT}"
+
+      - "traefik.tcp.routers.adguard-tls.rule=HostSNI(`${ADGUARD_HOSTNAME}`)"
+      - "traefik.tcp.routers.adguard-tls.tls=true"  
+      - "traefik.tcp.routers.adguard-tls.entrypoints=dot"
+      - "traefik.tcp.routers.adguard-tls.tls.certresolver=letsencrypt"
+      - "traefik.tcp.routers.adguard-tls.service=adguard-tls"
+      - "traefik.tcp.services.adguard-tls.loadbalancer.server.port=53"

apps/cloudflare-ddns/compose.yaml

@@ -14,6 +14,7 @@ services:
       DOMAINS: >
         ${ACTUAL_BUDGET_HOSTNAME},
         ${ADDON_MANAGER_HOSTNAME},
+        ${ADGUARD_HOSTNAME},
         ${AIOLISTS_HOSTNAME},
         ${AIOSTREAMS_HOSTNAME},
         ${AIOSTREMIO_HOSTNAME},

apps/traefik/compose.yaml

@@ -8,6 +8,7 @@ services:
     ports:
       - 443:443
       - 80:80
+      - 853:853
     command:
       - "--ping"
       - '--api=true'
@@ -23,6 +24,7 @@ services:
   
       - "--entryPoints.web.address=:80"
       - "--entryPoints.websecure.address=:443"
+      - "--entryPoints.dot.address=:853"
       
       
       - "--entryPoints.web.forwardedHeaders.insecure=false"

compose.yaml

@@ -1,6 +1,7 @@
 include:
   - apps/actual-budget/compose.yaml
   - apps/addon-manager/compose.yaml
+  - apps/adguard/compose.yaml
   - apps/aiolists/compose.yaml
   - apps/aiostreams/compose.yaml
   - apps/aiostremio/compose.yaml