nixserve: stop Tailscale from hijacking DNS resolution

Tailscale's stub resolver (100.100.100.100) intermittently times out
or SERVFAILs under bursty concurrent lookups (a known upstream issue,
e.g. tailscale/tailscale#6850, #10768, #8829), which was breaking HACS
updates in the Home Assistant container (network_mode: host, so it
inherits nixserve's own resolv.conf). Point nixserve at the local
Pi-hole instead and disable Tailscale's accept-dns so it can't
override it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

flake.lock

@@ -2,15 +2,17 @@
   "nodes": {
     "herdr": {
       "inputs": {
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1790589489,
-        "narHash": "sha256-Sn9W64W4KOga829nzathqymFvtwZsb/klyQFS/3Nq1A=",
+        "lastModified": 1792105523,
+        "narHash": "sha256-DGj+1Z+3zHwyi+Wh6SQqY1ya9kUElF1xVNg3V054X0s=",
         "owner": "ogulcancelik",
         "repo": "herdr",
-        "rev": "7f89b11a11160874ba89f3be7c64b29960bd2df3",
+        "rev": "143bf5fd4781d164260c63fe28e7dc08054ad32f",
         "type": "github"
       },
       "original": {
@@ -26,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790215976,
-        "narHash": "sha256-VkR1rMGyjU9jtw8ISFx5uqR9e+LEaOlhHwrseFkiIVk=",
+        "lastModified": 1792438572,
+        "narHash": "sha256-5mQQOcggBRBXB7NlzUxO0dbvQN4euJOISjNybrtfxPk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a6631107a83ceab5872f298a2ea710859c80c4cb",
+        "rev": "24f8f8e786f87d6a818e1746cb2389bf922afdab",
         "type": "github"
       },
       "original": {
@@ -42,27 +44,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1779911860,
-        "narHash": "sha256-ubcLAcKBDCZjhxw/kH5DL5GdBZQdzLqpkTe7HonvJVs=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "c0a89c379b4ac67c7b13b051ddbd4e0dbc9b0eaf",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1790533781,
-        "narHash": "sha256-hzJtu90JIQXnmgxKeP23CAx86G4L+dcQ+GHB1JK04qA=",
-        "rev": "cf5e76507c6e23b59f7e0ffcc7baa2a39ddd8442",
+        "lastModified": 1792503283,
+        "narHash": "sha256-OtQ9jaQ9aXZDm61TqykPLZdXJa2NMykYG3d0tbT683U=",
+        "rev": "cd4ea8d57de16f4810bc5f14207bac45fbf19f67",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.10769.cf5e76507c6e/nixexprs.tar.zst"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.12297.cd4ea8d57de1/nixexprs.tar.zst"
       },
       "original": {
         "id": "nixpkgs",
@@ -74,7 +60,7 @@
       "inputs": {
         "herdr": "herdr",
         "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs",
         "rssdownloader-src": "rssdownloader-src"
       }
     },

flake.nix

@@ -8,7 +8,10 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    herdr.url = "github:ogulcancelik/herdr";
+    herdr = {
+      url = "github:ogulcancelik/herdr";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     rssdownloader-src = {
       url = "git+https://codeberg.org/ulve/rssdownloader";

hosts/fractalus/default.nix

@@ -144,6 +144,7 @@
   environment.systemPackages = with pkgs; [
     wget
     curl
+    google-chrome
   ];
  
   fonts.packages = with pkgs; [

hosts/nixserve/default.nix

@@ -9,6 +9,11 @@
   networking.hostName = "nixserve";
   networking.hostId = "941b956b";
   networking.networkmanager.enable = true;
+  # nixserve's own DNS lookups (e.g. HACS/docker pulls) go to the local Pi-hole
+  # first instead of detouring through Tailscale's DNS proxy -> home router,
+  # which was timing out under HACS's bursty concurrent lookups. Tailscale's
+  # MagicDNS resolver (100.100.100.100) stays as a fallback nameserver.
+  networking.nameservers = [ "127.0.0.1" ];
 
   boot.supportedFilesystems = [ "zfs" ];
   boot.zfs.forceImportRoot = false;
@@ -47,8 +52,8 @@
   users.groups.media = {};
   users.users.jellyfin.extraGroups = [ "media" ];
 
-  networking.firewall.allowedTCPPorts = [ 80 443 /* HTTP */ 111 2049 4000 4001 4002 20048 /* NFS */ 3923 /* copyparty */ 8123 /* Home Assistant (LAN devices, e.g. Cast TTS fetch) */ ];
-  networking.firewall.allowedUDPPorts = [ 111 2049 4000 4001 4002 20048 /* NFS */ ];
+  networking.firewall.allowedTCPPorts = [ 80 443 /* HTTP */ 111 2049 4000 4001 4002 20048 /* NFS */ 3923 /* copyparty */ 8123 /* Home Assistant (LAN devices, e.g. Cast TTS fetch) */ 8095 8097 /* Music Assistant (web UI + stream server) */ ];
+  networking.firewall.allowedUDPPorts = [ 111 2049 4000 4001 4002 20048 /* NFS */ 5353 /* mDNS - Chromecast discovery */ ];
   networking.firewall.trustedInterfaces = [ "tailscale0" ];
 
   programs.zsh.enable = true;

hosts/nixserve/services.nix

@@ -52,10 +52,27 @@ in
 
   services.jellyfin.enable = true;
 
+  services.paperless = {
+    enable = true;
+    dataDir = "/media/apps/paperless";
+    address = "127.0.0.1";
+    port = 28981;
+    domain = "paperless.maybec.at";
+    settings = {
+      PAPERLESS_OCR_LANGUAGE = "eng+swe";
+    };
+  };
+
   services.tailscale = {
     enable = true;
     openFirewall = true;
     useRoutingFeatures = "server";
+    # Don't let Tailscale take over nixserve's own DNS resolution: its stub
+    # resolver (100.100.100.100) intermittently times out under bursty lookups
+    # (a known upstream issue, e.g. tailscale/tailscale#6850, #10768, #8829),
+    # which broke HACS updates. nixserve resolves via local Pi-hole instead
+    # (see networking.nameservers in hosts/nixserve/default.nix).
+    extraSetFlags = [ "--accept-dns=false" ];
   };
 
   services.syncthing = {
@@ -313,5 +330,6 @@ virtualHosts."aftersummer.maybec.at"  = proxyVhost { upstream = "http://127.0.0.
     virtualHosts."share.maybec.at"       = proxyVhost { upstream = "http://127.0.0.1:8090"; maxBodySize = "10g"; };
     virtualHosts."cam.maybec.at"         = proxyVhost { upstream = "https://127.0.0.1:8971"; proxySsl = true; };
     virtualHosts."home.maybec.at"        = proxyVhost { upstream = "http://127.0.0.1:8123"; };
+    virtualHosts."paperless.maybec.at"   = proxyVhost { upstream = "http://127.0.0.1:28981"; };
   };
 }

modules/home-common.nix

@@ -253,6 +253,10 @@
         User = "ulve";
         IdentityFile = "~/.ssh/id_ed25519_nixserve";
       };
+      "Host ssh.dev.azure.com" = {
+        User = "git";
+        IdentityFile = "~/.ssh/id_rsa_azuredevops";
+      };
     };
   };