From 2fb269858b147e9c78f39facc4c3b97eb0cbf580 Mon Sep 17 00:00:00 2001 From: Viren070 Date: Mon, 14 Jul 2025 18:05:34 +0100 Subject: [PATCH] feat: add adguard --- .env | 1 + apps/adguard/.env | 24 +++++++++++++++++++ apps/adguard/compose.yaml | 39 +++++++++++++++++++++++++++++++ apps/cloudflare-ddns/compose.yaml | 1 + apps/traefik/compose.yaml | 2 ++ compose.yaml | 1 + 6 files changed, 68 insertions(+) create mode 100644 apps/adguard/.env create mode 100644 apps/adguard/compose.yaml diff --git a/.env b/.env index 19a1dc9..033f805 100644 --- a/.env +++ b/.env @@ -115,6 +115,7 @@ CLOUDFLARE_API_TOKEN= # You can modify these values to suit your needs, but ensure that they are unique and do not conflict with other services. ACTUAL_BUDGET_HOSTNAME=actual-budget.${DOMAIN?} ADDON_MANAGER_HOSTNAME=addon-manager.${DOMAIN?} +ADGUARD_HOSTNAME=adguard.${DOMAIN?} AIOLISTS_HOSTNAME=aiolists.${DOMAIN?} AIOSTREAMS_HOSTNAME=aiostreams.${DOMAIN} AIOSTREMIO_HOSTNAME=aiostremio.${DOMAIN} diff --git a/apps/adguard/.env b/apps/adguard/.env new file mode 100644 index 0000000..253e740 --- /dev/null +++ b/apps/adguard/.env @@ -0,0 +1,24 @@ +# To get adguard to work, follow these steps: + +# 1. Ensure port 853 is open on your firewall. (Oracle users: add an ingress rule for port 853 on your security list) +# 2. You should be able to now start this container and complete the setup +# 3. After setting it up, change the value of ADGUARD_PORT below to 80 +ADGUARD_PORT=3000 +# 4. You now need to edit the configuration file to enable TLS. First, set the permissions to allow writing: +# sudo chown ${PGID}:${PUID} /opt/docker/apps/adguard/config/AdGuardHome.yaml +# 5. Open the file and make the following changes: +# - Set `tls.enabled` to true +# - Set `tls.server_name` to your domain name - adguard.${DOMAIN} (e.g. adguard.example.com) +# - Set `tls.allow_unencrypted_doh` to true +# Save the file. +# 6. Now, recreate the container with `docker compose up -d adguard` (in /opt/docker) + +# Limitations: + +# Plain DNS (port 53) is not enabled by default. It is recommended that you use DNS over TLS (DoT) or DNS over HTTPS (DoH) instead. +# If you want to enable plain DNS, uncomment the ports section in the compose file and ensure that port 53 is open on your firewall. +# Depending on your system, you may also need to stop/remove any existing DNS services on the host such as systemd-resolved. +# Remember that this means all services on the host also use Adguard and if it goes down/is not running, DNS resolution will fail for all apps. +# +# Since all DNS requests are routed through Traefik, all client IPs will appear as the IP of the Traefik container, rather than the actual client IPs. +# You may try resolving this using `dns.trusted_proxies` in the AdGuard configuration file. \ No newline at end of file diff --git a/apps/adguard/compose.yaml b/apps/adguard/compose.yaml new file mode 100644 index 0000000..7f4ddde --- /dev/null +++ b/apps/adguard/compose.yaml @@ -0,0 +1,39 @@ +services: + adguard: + image: adguard/adguardhome:latest + container_name: adguard + restart: unless-stopped + environment: + - TZ=${TZ:-UTC} + expose: + - 80 + - 53 + - 853 + # Uncomment the following lines if you want to expose plain DNS. + # You will also need to open the ports in your firewall. + # May need to stop/remove any existing DNS services on the host such as systemd-resolved. + # ports: + # - "53:53/udp" + # - "53:53/tcp" + volumes: + - ${DOCKER_DATA_DIR}/adguard/work:/opt/adguardhome/work + - ./config:/opt/adguardhome/conf + labels: + - "traefik.enable=true" + + - "traefik.http.routers.adguard.entrypoints=web" + - "traefik.http.routers.adguard.rule=Host(`${ADGUARD_HOSTNAME}`)" + + - "traefik.http.routers.adguard-secure.entrypoints=websecure" + - "traefik.http.routers.adguard-secure.rule=Host(`${ADGUARD_HOSTNAME}`)" + - "traefik.http.routers.adguard-secure.tls=true" + - "traefik.http.routers.adguard-secure.tls.certresolver=letsencrypt" + - "traefik.http.routers.adguard-secure.service=adguard-secure" + - "traefik.http.services.adguard-secure.loadbalancer.server.port=${ADGUARD_PORT}" + + - "traefik.tcp.routers.adguard-tls.rule=HostSNI(`${ADGUARD_HOSTNAME}`)" + - "traefik.tcp.routers.adguard-tls.tls=true" + - "traefik.tcp.routers.adguard-tls.entrypoints=dot" + - "traefik.tcp.routers.adguard-tls.tls.certresolver=letsencrypt" + - "traefik.tcp.routers.adguard-tls.service=adguard-tls" + - "traefik.tcp.services.adguard-tls.loadbalancer.server.port=53" \ No newline at end of file diff --git a/apps/cloudflare-ddns/compose.yaml b/apps/cloudflare-ddns/compose.yaml index ffa89c1..d0858a6 100644 --- a/apps/cloudflare-ddns/compose.yaml +++ b/apps/cloudflare-ddns/compose.yaml @@ -14,6 +14,7 @@ services: DOMAINS: > ${ACTUAL_BUDGET_HOSTNAME}, ${ADDON_MANAGER_HOSTNAME}, + ${ADGUARD_HOSTNAME}, ${AIOLISTS_HOSTNAME}, ${AIOSTREAMS_HOSTNAME}, ${AIOSTREMIO_HOSTNAME}, diff --git a/apps/traefik/compose.yaml b/apps/traefik/compose.yaml index ccf3a1d..c7ea5b6 100644 --- a/apps/traefik/compose.yaml +++ b/apps/traefik/compose.yaml @@ -8,6 +8,7 @@ services: ports: - 443:443 - 80:80 + - 853:853 command: - "--ping" - '--api=true' @@ -23,6 +24,7 @@ services: - "--entryPoints.web.address=:80" - "--entryPoints.websecure.address=:443" + - "--entryPoints.dot.address=:853" - "--entryPoints.web.forwardedHeaders.insecure=false" diff --git a/compose.yaml b/compose.yaml index 01c7dac..5df5452 100644 --- a/compose.yaml +++ b/compose.yaml @@ -1,6 +1,7 @@ include: - apps/actual-budget/compose.yaml - apps/addon-manager/compose.yaml + - apps/adguard/compose.yaml - apps/aiolists/compose.yaml - apps/aiostreams/compose.yaml - apps/aiostremio/compose.yaml