Add native DNS-over-TLS (DoT) on dot.nook.family:853

- ddclient.tf: dynamic DNS daemon that keeps dot.nook.family A record pointing at the home public IP via Cloudflare API (updates every 5m) - adguard.tf: cert-manager Certificate for dot.nook.family via DNS-01, updated TLS config block with DoT paths and port 853 - apps/adguard.yaml: mount adguard-dot-tls secret, expose port 853, init container enforces TLS/DoT settings on every restart - adguard.tf: fix stale neuralplatform.dev → neuralplatform.ai rewrite Android Private DNS: set to dot.nook.family Router: forward TCP 853 → 192.168.68.77
2026-03-24 09:27:21 -05:00
parent 3518620360
commit 087c5a79f4
3 changed files with 131 additions and 4 deletions
@@ -0,0 +1,81 @@
+# ddclient — dynamic DNS daemon that keeps dot.nook.family pointing at the home public IP
+# Updates Cloudflare A record every 5 minutes; required for DoT (port 853) which can't use Cloudflare proxy
+
+resource "kubernetes_secret" "ddclient_config" {
+  metadata {
+    name      = "ddclient-config"
+    namespace = kubernetes_namespace.dns.metadata[0].name
+  }
+
+  data = {
+    "ddclient.conf" = <<-EOT
+      daemon=300
+      syslog=yes
+      pid=/var/run/ddclient/ddclient.pid
+      use=web, web=https://api.ipify.org
+
+      protocol=cloudflare
+      zone=nook.family
+      ttl=120
+      login=${var.cloudflare_email}
+      password=${var.cloudflare_api_key}
+      dot.nook.family
+    EOT
+  }
+}
+
+resource "kubernetes_deployment" "ddclient" {
+  metadata {
+    name      = "ddclient"
+    namespace = kubernetes_namespace.dns.metadata[0].name
+    labels    = { app = "ddclient" }
+  }
+
+  spec {
+    replicas = 1
+    selector {
+      match_labels = { app = "ddclient" }
+    }
+    template {
+      metadata {
+        labels = { app = "ddclient" }
+      }
+      spec {
+        container {
+          name  = "ddclient"
+          image = "ghcr.io/linuxserver/ddclient:latest"
+
+          env {
+            name  = "PUID"
+            value = "1000"
+          }
+          env {
+            name  = "PGID"
+            value = "1000"
+          }
+
+          volume_mount {
+            name       = "config"
+            mount_path = "/config/ddclient.conf"
+            sub_path   = "ddclient.conf"
+            read_only  = true
+          }
+
+          resources {
+            requests = { memory = "32Mi", cpu = "10m" }
+            limits   = { memory = "64Mi" }
+          }
+        }
+
+        volume {
+          name = "config"
+          secret {
+            secret_name = kubernetes_secret.ddclient_config.metadata[0].name
+          }
+        }
+      }
+    }
+  }
+
+  depends_on = [kubernetes_namespace.dns]
+}