From 711a3da7a6b3437be9d7c440ddada52e8767366d Mon Sep 17 00:00:00 2001
From: alexion <contact@alexion.dev>
Date: Wed, 21 Oct 2026 18:37:46 -0400
Subject: [PATCH] refactor(nixos): derive AdGuard proxy rewrites

---
 configs/nixos/guests/adguard.nix               |  2 ++
 configs/nixos/modules/services/adguardhome.nix | 14 +++++++-------
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/configs/nixos/guests/adguard.nix b/configs/nixos/guests/adguard.nix
index cd44a5c..c04d337 100644
--- a/configs/nixos/guests/adguard.nix
+++ b/configs/nixos/guests/adguard.nix
@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  registry,
   ...
 }:
 let
@@ -34,6 +35,7 @@ in
         modules.services.adguardhome = {
           enable = true;
           inherit (cfg) adminPasswordHash;
+          reverseProxyAddress = registry.address.${config.networking.hostName}."reverse-proxy";
         };
 
         services.resolved.settings.Resolve.DNSStubListener = false;
diff --git a/configs/nixos/modules/services/adguardhome.nix b/configs/nixos/modules/services/adguardhome.nix
index b3ed247..d1a70b2 100644
--- a/configs/nixos/modules/services/adguardhome.nix
+++ b/configs/nixos/modules/services/adguardhome.nix
@@ -10,6 +10,11 @@ in
       type = lib.types.str;
       description = "Bcrypt verifier for the AdGuard Home administrator password.";
     };
+
+    reverseProxyAddress = lib.mkOption {
+      type = lib.types.str;
+      description = "IP address of the guest that handles internal HTTP requests.";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -204,19 +209,14 @@ in
           parental_block_host = "family-block.dns.adguard.com";
           safebrowsing_block_host = "standard-block.dns.adguard.com";
           rewrites = [
-            {
-              domain = "*.home";
-              answer = "10.23.20.32";
-              enabled = true;
-            }
             {
               domain = "*.alexion.dev";
-              answer = "10.23.20.109";
+              answer = cfg.reverseProxyAddress;
               enabled = true;
             }
             {
               domain = "home";
-              answer = "10.23.20.109";
+              answer = cfg.reverseProxyAddress;
               enabled = true;
             }
           ];