ulve/nixos-dotfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Pi-hole DNS blocking + TV lockdown, new services, flake upgrade

Browse Source 
- Enable pihole-ftl/pihole-web for network-wide DNS ad-blocking on the
  LAN/Tailscale side, keeping nixserve's own resolution untouched
- Seed a dedicated Pi-hole group that locks the smart TV (by MAC) to
  resolving only *.maybec.at, denying everything else
- Add pingvin-share, frigate, mosquitto, and homeassistant docker services
  with matching nginx vhosts and firewall port for Home Assistant
- Disable immich (unused for now), add proxySsl option to proxyVhost
- Bump flake.lock (nixpkgs/home-manager upgrade)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
ulve
2026-09-29 07:16:27 +02:00
co-authored by Claude Sonnet 5
parent bd1883552e
commit 4045f25aee
3 changed files with 125 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/nixserve/default.nix
+1 -1
View File
@@ -47,7 +47,7 @@
users.groups.media = {};
users.users.jellyfin.extraGroups = [ "media" ];
networking.firewall.allowedTCPPorts = [ 80 443 /* HTTP */ 111 2049 4000 4001 4002 20048 /* NFS */ 3923 /* copyparty */ ];
networking.firewall.allowedTCPPorts = [ 80 443 /* HTTP */ 111 2049 4000 4001 4002 20048 /* NFS */ 3923 /* copyparty */ 8123 /* Home Assistant (LAN devices, e.g. Cast TTS fetch) */ ];
networking.firewall.allowedUDPPorts = [ 111 2049 4000 4001 4002 20048 /* NFS */ ];
networking.firewall.trustedInterfaces = [ "tailscale0" ];