From 6ac56136e5ca34117b18f98cae244b934182a0c8 Mon Sep 17 00:00:00 2001
From: Felix Stupp <felix.stupp@banananet.work>
Date: Tue, 16 Jun 2026 00:25:37 +0000
Subject: [PATCH 1/2] nixos/adguardhome: allow AF_UNIX when log.file=="syslog"

---
 nixos/modules/services/networking/adguardhome.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/services/networking/adguardhome.nix b/nixos/modules/services/networking/adguardhome.nix
index 1df503146b54..9a0eec481062 100644
--- a/nixos/modules/services/networking/adguardhome.nix
+++ b/nixos/modules/services/networking/adguardhome.nix
@@ -228,6 +228,8 @@ in
           "AF_INET"
           "AF_INET6"
         ]
+        # AF_UNIX to be able to connect to e.g. /dev/log
+        ++ lib.optionals (cfg.settings.log.file or "" == "syslog") [ "AF_UNIX" ]
         ++ lib.optionals cfg.allowDHCP [ "AF_PACKET" ];
         RestrictNamespaces = true;
         RestrictRealtime = true;

From 8c75f138ffdd6ab8dbc6eeb82d1144ef83db3b33 Mon Sep 17 00:00:00 2001
From: Felix Stupp <felix.stupp@banananet.work>
Date: Tue, 16 Jun 2026 00:26:41 +0000
Subject: [PATCH 2/2] nixos/adguardhome: add tests ensuring logging to syslog
 works

---
 nixos/tests/adguardhome.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/nixos/tests/adguardhome.nix b/nixos/tests/adguardhome.nix
index 48bed55e3187..9c8b90cebcd8 100644
--- a/nixos/tests/adguardhome.nix
+++ b/nixos/tests/adguardhome.nix
@@ -22,6 +22,14 @@
       };
     };
 
+    syslogConf = {
+      services.adguardhome = {
+        enable = true;
+
+        settings.log.file = "syslog";
+      };
+    };
+
     declarativeConf = {
       services.adguardhome = {
         enable = true;
@@ -122,6 +130,12 @@
       schemaVersionBefore23.wait_for_unit("adguardhome.service")
       schemaVersionBefore23.wait_for_open_port(3000)
 
+    with subtest("Logging to syslog test"):
+      # AdGuard is expected to fail when it cannot connect to syslog
+      # hence its sufficient to look whether the service starts at all
+      syslogConf.wait_for_unit("adguardhome.service")
+      syslogConf.wait_for_open_port(3000)
+
     with subtest("Declarative config test, DNS will be reachable"):
       declarativeConf.wait_for_unit("adguardhome.service")
       declarativeConf.wait_for_open_port(53)