dns: use coredns for https records

hosts/architect/dns.nix

@@ -1,40 +1,49 @@
-{ config, pkgs, lib, ... }:
+{ config, lib, ... }:
 
 let
-  domain = "adguard.architect.devs.giugl.io";
+  # Function to generate CoreDNS config for a single vhost
+  generateCoreDNSConfigForVhost = domain: conf:
+    let
+      # Retrieve architect's IP on each interface
+      interfaceConfigs = builtins.map
+        (iface:
+          let
+            architectIP = config.architect.networks.${iface}.devices.architect.address;
+            interfaceNet = config.architect.networks.${iface}.net;
+          in
+          ''
+            ${domain} {
+              view ${iface} {
+                expr incidr(client_ip(), '${interfaceNet}')
+              }
+
+              template IN A ${domain} {
+                answer "${domain}. 60 IN A ${architectIP}"
+              }
+              template IN HTTPS ${domain} {
+                answer "${domain}. 60 IN HTTPS 1 . ipv4hint=\"${architectIP}\""
+              }
+              cache
+              log
+            }
+          ''
+        )
+        conf.dnsInterfaces;
+    in
+    lib.concatStringsSep "\n" interfaceConfigs;
 in
 {
-  architect = {
-    firewall.openUDPVPN = [ 53 ];
-
-    vhost.${domain} = {
-      dnsInterfaces = [ "lan" "tailscale" ];
-
-      locations."/" = with config; {
-        port = services.adguardhome.settings.bind_port;
-        allow = with architect.networks; [ lan.net tailscale.net ];
-        deny = [
-          architect.networks."lan".devices.router.address
-        ];
-      };
-    };
-  };
-
   services = {
-    dnsmasq = {
+    coredns = {
       enable = true;
-      settings = {
+      config = ''
-        server = [ "127.0.0.1#${toString config.services.adguardhome.settings.dns.port}" ];
+        ${lib.concatStringsSep "\n" (lib.mapAttrsToList generateCoreDNSConfigForVhost config.architect.vhost)}
-        localise-queries = true;
+          
-        min-cache-ttl = 120;
+        . {
-        max-cache-ttl = 2400;
+          cache
-        domain = [
+          forward . 127.0.0.1:${toString config.services.adguardhome.settings.dns.port}
-          "runas.rocks"
+        }
-          "giugl.io"
+      '';
-          "devs.runas.rocks"
-          "devs.giugl.io"
-        ];
-      };
     };
 
     adguardhome = {