- Enable pihole-ftl/pihole-web for network-wide DNS ad-blocking on the
LAN/Tailscale side, keeping nixserve's own resolution untouched
- Seed a dedicated Pi-hole group that locks the smart TV (by MAC) to
resolving only *.maybec.at, denying everything else
- Add pingvin-share, frigate, mosquitto, and homeassistant docker services
with matching nginx vhosts and firewall port for Home Assistant
- Disable immich (unused for now), add proxySsl option to proxyVhost
- Bump flake.lock (nixpkgs/home-manager upgrade)
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
ulveandClaude Sonnet 5
4045f25aee