DNS over HTTPs
Since I'd already gone to the trouble of generating a certificate for the UDR, I made one for AdGuard Home too. For DoH to work you need a wildcard certificate. Active24 supports DNS-01 via its API, so issuing it is no problem.
The advantage of DoH is that HTTPS is already open (the admin interface is on the same port) — only the path differs (dns-query). Clients are then identified using a ClientID.
A really nice guide on what to do and how was published recently on Jiří Eischmann's blog.
What I still need to fine-tune is the client setup, so that my devices use DoH only when they're connected to a specific Wi-Fi network.
