From d19d535d851eedc73a56f562e7cdf652f43891ca Mon Sep 17 00:00:00 2001
From: Leyla Becker <git@jan-leila.com>
Date: Mon, 20 Oct 2025 20:01:07 -0500
Subject: [PATCH 1/4] fix: made crab-hole dns accessible from other devices

---
 .../nixos/defiant/configuration.nix           |  2 +-
 .../server/crab-hole/crab-hole.nix            | 44 +++++++++++++++----
 2 files changed, 37 insertions(+), 9 deletions(-)

diff --git a/configurations/nixos/defiant/configuration.nix b/configurations/nixos/defiant/configuration.nix
index c2b8fc5..fdf7356 100644
--- a/configurations/nixos/defiant/configuration.nix
+++ b/configurations/nixos/defiant/configuration.nix
@@ -348,7 +348,7 @@
       openFirewall = true;
       show_doc = true;
       downstreams = {
-        loopback = {
+        host = {
           enable = true;
           openFirewall = true;
         };
diff --git a/modules/nixos-modules/server/crab-hole/crab-hole.nix b/modules/nixos-modules/server/crab-hole/crab-hole.nix
index 58ff660..bde1d76 100644
--- a/modules/nixos-modules/server/crab-hole/crab-hole.nix
+++ b/modules/nixos-modules/server/crab-hole/crab-hole.nix
@@ -27,9 +27,19 @@ in {
     show_doc = lib.mkEnableOption "OpenAPI documentation (loads content from third party websites)";
 
     downstreams = {
-      loopback = {
-        enable = lib.mkEnableOption "loopback downstream DNS server on localhost:53";
-        openFirewall = lib.mkEnableOption "automatic port forwarding for the loopback downstream";
+      host = {
+        enable = lib.mkEnableOption "host downstream DNS server accessible from network on all interfaces";
+        port = lib.mkOption {
+          type = lib.types.port;
+          default = 53;
+          description = "Port for the host downstream DNS server to listen on.";
+        };
+        openFirewall = lib.mkEnableOption "automatic port forwarding for the host downstream";
+        disableSystemdResolved = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = "Whether to automatically disable systemd-resolved when using port 53. Set to false if you want to handle the conflict manually.";
+        };
       };
     };
 
@@ -82,6 +92,24 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
+    # Assertions for proper configuration
+    assertions = [
+      {
+        assertion = !(cfg.downstreams.host.enable && cfg.downstreams.host.port == 53 && config.services.resolved.enable && cfg.downstreams.host.disableSystemdResolved);
+        message = "crab-hole host downstream cannot use port 53 while systemd-resolved is enabled. Either disable systemd-resolved or use a different port.";
+      }
+      {
+        assertion = !(cfg.downstreams.host.enable && cfg.downstreams.host.port == 53 && !cfg.downstreams.host.disableSystemdResolved && config.services.resolved.enable);
+        message = "crab-hole host downstream is configured to use port 53 but systemd-resolved is still enabled and disableSystemdResolved is false. Set disableSystemdResolved = true or manually disable systemd-resolved.";
+      }
+    ];
+
+    # Automatically disable systemd-resolved if using port 53
+    services.resolved.enable = lib.mkIf (cfg.downstreams.host.enable && cfg.downstreams.host.port == 53 && cfg.downstreams.host.disableSystemdResolved) (lib.mkForce false);
+
+    # Configure DNS nameservers when disabling systemd-resolved
+    networking.nameservers = lib.mkIf (cfg.downstreams.host.enable && cfg.downstreams.host.port == 53 && cfg.downstreams.host.disableSystemdResolved) (lib.mkDefault ["127.0.0.1" "1.1.1.1" "8.8.8.8"]);
+
     services.crab-hole.settings = lib.mkMerge [
       {
         api = {
@@ -92,12 +120,12 @@ in {
         downstream = cfg.extraDownstreams;
         upstream.name_servers = cfg.extraUpstreams;
       }
-      (lib.mkIf cfg.downstreams.loopback.enable {
+      (lib.mkIf cfg.downstreams.host.enable {
         downstream = [
           {
             protocol = "udp";
-            listen = "localhost";
-            port = 53;
+            listen = "0.0.0.0";
+            port = cfg.downstreams.host.port;
           }
         ];
       })
@@ -136,8 +164,8 @@ in {
       (lib.mkIf cfg.openFirewall {
         allowedTCPPorts = [cfg.port];
       })
-      (lib.mkIf (cfg.downstreams.loopback.enable && cfg.downstreams.loopback.openFirewall) {
-        allowedUDPPorts = [53];
+      (lib.mkIf (cfg.downstreams.host.enable && cfg.downstreams.host.openFirewall) {
+        allowedUDPPorts = [cfg.downstreams.host.port];
       })
     ];
   };

From 290c0692bb394071c470f35e96ceb08ec987f7fe Mon Sep 17 00:00:00 2001
From: Leyla Becker <git@jan-leila.com>
Date: Mon, 20 Oct 2025 20:24:28 -0500
Subject: [PATCH 2/4] feat: added block list to crab-hole

---
 .../nixos/defiant/configuration.nix           |  1 +
 .../server/crab-hole/crab-hole.nix            | 21 +++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/configurations/nixos/defiant/configuration.nix b/configurations/nixos/defiant/configuration.nix
index fdf7356..6908eb7 100644
--- a/configurations/nixos/defiant/configuration.nix
+++ b/configurations/nixos/defiant/configuration.nix
@@ -354,6 +354,7 @@
         };
       };
       upstreams.cloudFlare.enable = true;
+      blocklists.ad_malware.enable = true;
     };
 
     qbittorrent = {
diff --git a/modules/nixos-modules/server/crab-hole/crab-hole.nix b/modules/nixos-modules/server/crab-hole/crab-hole.nix
index bde1d76..d76323a 100644
--- a/modules/nixos-modules/server/crab-hole/crab-hole.nix
+++ b/modules/nixos-modules/server/crab-hole/crab-hole.nix
@@ -89,6 +89,23 @@ in {
       default = [];
       description = "List of additional upstream DNS server configurations.";
     };
+
+    blocklists = {
+      ad_malware = {
+        enable = lib.mkEnableOption "Host file for blocking ads and malware";
+        url = lib.mkOption {
+          type = lib.types.str;
+          default = "http://sbc.io/hosts/hosts";
+          description = "URL of the ad and malware blocklist host file";
+        };
+      };
+    };
+
+    extraBlocklists = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [];
+      description = "Additional blocklist URLs to be added to the configuration";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -119,7 +136,11 @@ in {
         };
         downstream = cfg.extraDownstreams;
         upstream.name_servers = cfg.extraUpstreams;
+        blocklist.lists = cfg.extraBlocklists;
       }
+      (lib.mkIf cfg.blocklists.ad_malware.enable {
+        blocklist.lists = [cfg.blocklists.ad_malware.url];
+      })
       (lib.mkIf cfg.downstreams.host.enable {
         downstream = [
           {

From f21777b1fbe69d747e84f0a7bd5eed85a62f576e Mon Sep 17 00:00:00 2001
From: Leyla Becker <git@jan-leila.com>
Date: Mon, 20 Oct 2025 20:55:35 -0500
Subject: [PATCH 3/4] fix: fixed pre and post commit hook behavior

---
 .hooks/post-commit      | 10 +++++++++-
 .hooks/post-merge       | 26 ++++++++++++++++++++------
 .hooks/pre-commit       | 24 +++++++++++++++++-------
 .hooks/pre-merge-commit |  4 ++--
 4 files changed, 48 insertions(+), 16 deletions(-)

diff --git a/.hooks/post-commit b/.hooks/post-commit
index 56c439d..03a160d 100755
--- a/.hooks/post-commit
+++ b/.hooks/post-commit
@@ -3,4 +3,12 @@
 
 echo "restoring stashed changes"
 
-git stash pop -q
+# Find the most recent pre-commit stash and restore it
+recent_stash=$(git stash list | grep "pre-commit-stash-" | head -n 1 | cut -d: -f1)
+
+if [ -n "$recent_stash" ]; then
+    echo "Found recent pre-commit stash: $recent_stash"
+    git stash pop -q "$recent_stash"
+else
+    echo "No pre-commit stash found to restore"
+fi
diff --git a/.hooks/post-merge b/.hooks/post-merge
index 11fb20c..06fabc3 100755
--- a/.hooks/post-merge
+++ b/.hooks/post-merge
@@ -4,14 +4,28 @@
 # Get current branch name
 current_branch=$(git branch --show-current)
 
-# Only restore stash if we're on main branch and a merge just completed
+# Only perform actions if we're on main branch and a merge just completed
 if [ "$current_branch" = "main" ]; then
-    # Check if there are any stashes to restore
-    if git stash list | grep -q "stash@"; then
-        echo "Post-merge: restoring stashed changes on main branch"
-        git stash pop -q
+    echo "Post-merge on main branch - running nix flake check"
+    
+    # Run nix flake check after merge into main
+    nix flake check
+    
+    if [ ! $? -eq 0 ]; then
+        echo "Warning: nix flake check failed after merge into main"
+        echo "Please fix the issues as soon as possible"
     else
-        echo "Post-merge: no stash to restore on main branch"
+        echo "nix flake check passed after merge"
+    fi
+    
+    # Check if there are any pre-commit stashes to restore
+    recent_stash=$(git stash list | grep "pre-commit-stash-" | head -n 1 | cut -d: -f1)
+    
+    if [ -n "$recent_stash" ]; then
+        echo "Post-merge: restoring pre-commit stash on main branch"
+        git stash pop -q "$recent_stash"
+    else
+        echo "Post-merge: no pre-commit stash to restore on main branch"
     fi
 else
     echo "Post-merge: no action needed on branch '$current_branch'"
diff --git a/.hooks/pre-commit b/.hooks/pre-commit
index f98c64f..74cbc64 100755
--- a/.hooks/pre-commit
+++ b/.hooks/pre-commit
@@ -1,14 +1,24 @@
 #!/usr/bin/env nix-shell
 #! nix-shell -i bash ../shell.nix
 
-echo "stashing all uncommitted changes"
-git stash -q --keep-index
+# Get current branch name
+current_branch=$(git branch --show-current)
 
-echo "checking flakes all compile"
-nix flake check
+echo "stashing all uncommitted changes with named stash (excluding hooks)"
+git stash push -q --keep-index -m "pre-commit-stash-$(date +%s)" -- ':!.hooks/'
 
-if [ ! $? -eq 0 ]; then
-    exit 1
+# Only run nix flake check if we're on main branch
+if [ "$current_branch" = "main" ]; then
+    echo "On main branch - checking flakes all compile"
+    nix flake check
+
+    if [ ! $? -eq 0 ]; then
+        echo "Error: nix flake check failed on main branch"
+        exit 1
+    fi
+    echo "nix flake check passed"
+else
+    echo "Not on main branch - skipping nix flake check"
 fi
 
 echo "running linter"
@@ -19,4 +29,4 @@ RESULT=$?
 echo "adding lint changes to commit"
 git add -u
 
-exit $RESULT
\ No newline at end of file
+exit $RESULT
diff --git a/.hooks/pre-merge-commit b/.hooks/pre-merge-commit
index 9edaf92..9b7b41d 100755
--- a/.hooks/pre-merge-commit
+++ b/.hooks/pre-merge-commit
@@ -17,8 +17,8 @@ fi
 if [ "$target_branch" = "main" ]; then
     echo "Merging into main branch - running nix flake check..."
     
-    echo "stashing all uncommitted changes"
-    git stash -q --keep-index
+    echo "stashing all uncommitted changes with named stash (excluding hooks)"
+    git stash push -q --keep-index -m "pre-merge-stash-$(date +%s)" -- ':!.hooks/'
 
     echo "checking flakes all compile"
     nix flake check

From 539af51473126cf2a715803d80d21b5a7bfdcd13 Mon Sep 17 00:00:00 2001
From: Leyla Becker <git@jan-leila.com>
Date: Tue, 21 Oct 2025 18:52:38 -0500
Subject: [PATCH 4/4] disabled crab-hole

---
 configurations/nixos/defiant/configuration.nix          | 2 +-
 modules/nixos-modules/server/crab-hole/impermanence.nix | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/configurations/nixos/defiant/configuration.nix b/configurations/nixos/defiant/configuration.nix
index 6908eb7..6d2925a 100644
--- a/configurations/nixos/defiant/configuration.nix
+++ b/configurations/nixos/defiant/configuration.nix
@@ -343,7 +343,7 @@
     };
 
     crab-hole = {
-      enable = true;
+      enable = false;
       port = 8085;
       openFirewall = true;
       show_doc = true;
diff --git a/modules/nixos-modules/server/crab-hole/impermanence.nix b/modules/nixos-modules/server/crab-hole/impermanence.nix
index 455e593..8e1182c 100644
--- a/modules/nixos-modules/server/crab-hole/impermanence.nix
+++ b/modules/nixos-modules/server/crab-hole/impermanence.nix
@@ -5,7 +5,7 @@
 }: let
   workingDirectory = "/var/lib/private/crab-hole";
 in {
-  config = lib.mkIf (config.services.immich.enable && config.host.impermanence.enable) {
+  config = lib.mkIf (config.services.crab-hole.enable && config.host.impermanence.enable) {
     assertions = [
       {
         assertion =