{ config, pkgs, ... }:

{
  ########################################
  # AdGuardHome (DNS / DNS-Filter)
  ########################################
  services.adguardhome = {
    enable = true;
    host = "127.0.0.1";
    port = 3000;      # Web-UI
  };

  ########################################
  # Caddy (Reverse Proxy)
  ########################################
  services.caddy = {
    enable = true;
    email = "daniel@lindenfelser.de";
    virtualHosts = {
      "files.home.lindenfelser.de" = {
        extraConfig = ''
          reverse_proxy 10.202.82.6:8080
        '';
      };
      "cloud.home.lindenfelser.de" = {
        extraConfig = ''
          reverse_proxy 10.202.82.6:8080
        '';
      };
      "dns.home.lindenfelser.de" = {
        extraConfig = ''
          reverse_proxy 127.0.0.1:3000
        '';
      };
      "smart.home.lindenfelser.de" = {
        extraConfig = ''
          reverse_proxy 10.202.82.30:8123
        '';
      };
    };
  };

  ########################################
  # Firewall
  ########################################
  networking.firewall.enable = true;
  
  networking.firewall.allowedTCPPorts = [
    22    # SSH
    80    # HTTP (Caddy)
    443   # HTTPS (Caddy)
  ];

  networking.firewall.allowedUDPPorts = [
    53    # DNS (AdGuardHome)
  ];
}