From 290c0692bb394071c470f35e96ceb08ec987f7fe Mon Sep 17 00:00:00 2001
From: Leyla Becker <git@jan-leila.com>
Date: Mon, 20 Oct 2025 20:24:28 -0500
Subject: [PATCH] feat: added block list to crab-hole

---
 .../nixos/defiant/configuration.nix           |  1 +
 .../server/crab-hole/crab-hole.nix            | 21 +++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/configurations/nixos/defiant/configuration.nix b/configurations/nixos/defiant/configuration.nix
index fdf7356..6908eb7 100644
--- a/configurations/nixos/defiant/configuration.nix
+++ b/configurations/nixos/defiant/configuration.nix
@@ -354,6 +354,7 @@
         };
       };
       upstreams.cloudFlare.enable = true;
+      blocklists.ad_malware.enable = true;
     };
 
     qbittorrent = {
diff --git a/modules/nixos-modules/server/crab-hole/crab-hole.nix b/modules/nixos-modules/server/crab-hole/crab-hole.nix
index bde1d76..d76323a 100644
--- a/modules/nixos-modules/server/crab-hole/crab-hole.nix
+++ b/modules/nixos-modules/server/crab-hole/crab-hole.nix
@@ -89,6 +89,23 @@ in {
       default = [];
       description = "List of additional upstream DNS server configurations.";
     };
+
+    blocklists = {
+      ad_malware = {
+        enable = lib.mkEnableOption "Host file for blocking ads and malware";
+        url = lib.mkOption {
+          type = lib.types.str;
+          default = "http://sbc.io/hosts/hosts";
+          description = "URL of the ad and malware blocklist host file";
+        };
+      };
+    };
+
+    extraBlocklists = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [];
+      description = "Additional blocklist URLs to be added to the configuration";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -119,7 +136,11 @@ in {
         };
         downstream = cfg.extraDownstreams;
         upstream.name_servers = cfg.extraUpstreams;
+        blocklist.lists = cfg.extraBlocklists;
       }
+      (lib.mkIf cfg.blocklists.ad_malware.enable {
+        blocklist.lists = [cfg.blocklists.ad_malware.url];
+      })
       (lib.mkIf cfg.downstreams.host.enable {
         downstream = [
           {