From bf2ec739831b8244cd195e65d442eba28c1eb32c Mon Sep 17 00:00:00 2001
From: Will Anderson <andersonwilliam85@gmail.com>
Date: Mon, 23 Mar 2026 10:29:42 -0500
Subject: [PATCH] Expose AdGuard DoH at dns.neuralplatform.ai

---
 servers/legion/adguard.tf        | 2 ++
 servers/legion/apps/adguard.yaml | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/servers/legion/adguard.tf b/servers/legion/adguard.tf
index ef6d8d0..f769b63 100644
--- a/servers/legion/adguard.tf
+++ b/servers/legion/adguard.tf
@@ -88,6 +88,8 @@ resource "kubernetes_config_map" "adguard_defaults" {
           url: https://easylist.to/easylist/easyprivacy.txt
           name: EasyPrivacy
           id: 5
+      tls:
+        allow_unencrypted_doh: true
       filtering:
         filtering_enabled: true
         rewrites:
diff --git a/servers/legion/apps/adguard.yaml b/servers/legion/apps/adguard.yaml
index 9691869..e5c4e82 100644
--- a/servers/legion/apps/adguard.yaml
+++ b/servers/legion/apps/adguard.yaml
@@ -57,6 +57,9 @@ spec:
                       else:
                           cfg.setdefault("filters", []).append(df)
 
+                  # Enforce allow_unencrypted_doh
+                  cfg.setdefault("tls", {})["allow_unencrypted_doh"] = True
+
                   # Fix/ensure rewrites
                   cfg.setdefault("filtering", {})
                   existing_rw = {rw["domain"]: rw for rw in cfg["filtering"].get("rewrites", [])}