AdGuard Home running behind a WireGuard VPN using Gluetun with Traefik and DuckDNS as a reverse proxy

[eiqnepm]

I thought I would share my workflow for running a filtered DNS server as privately as possible without compromising on speed and customization.

With this you are able to use popular upstream DNS servers while knowing the IP address they are presented with is not identifiable to you.

Traefik will manage the certificates and Watchtower will update the containers so it is a setup and forget configuration.

docker-compose.yaml

services:
  traefik:
    command:
      - --providers.docker=true
      - --providers.docker.exposedByDefault=false

      - --experimental.http3=true

      - --entryPoints.web.address=:80
      - --entryPoints.web.http.redirections.entryPoint.to=websecure

      - --entryPoints.websecure.address=:443
      - --entryPoints.websecure.http3
      - --entrypoints.websecure.http.tls.certResolver=duckdns
      - --entrypoints.websecure.http.tls.domains[0].main=👀.duckdns.org
      - --entrypoints.websecure.http.tls.domains[0].sans=*.👀.duckdns.org,*.dns.👀.duckdns.org

      - --certificatesResolvers.duckdns.acme.email=webmaster@letsencrypt.org
      - --certificatesResolvers.duckdns.acme.storage=/letsencrypt/duckdns.json
      - --certificatesResolvers.duckdns.acme.dnsChallenge=true
      - --certificatesResolvers.duckdns.acme.dnsChallenge.provider=duckdns
    container_name: traefik
    environment:
      - DUCKDNS_TOKEN=👀
    image: traefik:v2.10
    networks:
      - traefik
      - gluetun
    ports:
      - 80:80 # HTTP
      - 443:443 # HTTPS
      - 443:443/udp # HTTP/3
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

      - ./traefik/letsencrypt:/letsencrypt

  duckdns:
    container_name: duckdns
    environment:
      - SUBDOMAINS=👀
      - TOKEN=👀
    image: lscr.io/linuxserver/duckdns
    networks:
      - duckdns
    restart: unless-stopped

  traefik-certs-dumper:
    command: file --version v2 --watch --source /letsencrypt/acme.json --dest /data
    container_name: traefik-certs-dumper
    image: ldez/traefik-certs-dumper
    network_mode: none
    volumes:
      - ./traefik/letsencrypt/duckdns.json:/letsencrypt/acme.json:ro

      - ./traefik-certs-dumper:/data

  adguardhome:
    container_name: adguardhome
    image: adguard/adguardhome
    network_mode: service:gluetun
    restart: unless-stopped
    volumes:
      - ./adguardhome/work:/opt/adguardhome/work
      - ./adguardhome/conf:/opt/adguardhome/conf

      - ./traefik-certs-dumper:/certs:ro

  gluetun:
    cap_add:
      - NET_ADMIN
    container_name: gluetun
    devices:
      - /dev/net/tun:/dev/net/tun
    environment:
      - SERVER_HOSTNAMES=👀.prod.surfshark.com
      - VPN_SERVICE_PROVIDER=surfshark
      - VPN_TYPE=wireguard
      - WIREGUARD_ADDRESSES=👀
      - WIREGUARD_PRIVATE_KEY=👀
    image: ghcr.io/qdm12/gluetun
    labels:
      - traefik.enable=true

      - traefik.http.routers.adguardhome.rule=Host(`dns.👀.duckdns.org`) || HostRegexp(`{my-client:.+}.dns.👀.duckdns.org`)
      - traefik.http.routers.adguardhome.entryPoints=websecure
      - traefik.http.routers.adguardhome.tls.certResolver=duckdns

      - traefik.http.routers.adguardhome.service=adguardhome
      - traefik.http.services.adguardhome.loadBalancer.server.port=3000
    networks:
      - gluetun
    ports:
      # - 53:5353 # DNS over TCP
      # - 53:5353/udp # DNS over UDP
      - 853:853 # DNS over TLS
      - 853:853/udp # DNS over QUIC
    restart: unless-stopped
    volumes:
      - ./gluetun:/gluetun

  watchtower:
    container_name: watchtower
    environment:
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_REMOVE_VOLUMES=true
    image: containrrr/watchtower
    networks:
      - watchtower
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

networks:
  traefik:
    name: traefik

  duckdns:
    name: duckdns

  gluetun:
    name: gluetun

  watchtower:
    name: watchtower

AdGuardHome.yaml

http:
  address: 0.0.0.0:3000
dns:
  port: 5353
  trusted_proxies:
    - 127.0.0.0/8
    - ::1/128
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
tls:
  enabled: true
  server_name: dns.👀.duckdns.org
  allow_unencrypted_doh: true
  certificate_path: /certs/certs/*.dns.👀.duckdns.org.crt
  private_key_path: /certs/private/*.dns.👀.duckdns.org.key