services:
  nxdns:
    # Published multi-architecture image. Pin an exact version in production:
    # NXDNS_VERSION=0.0.1 docker compose up -d. To run a locally built image
    # instead, build it first (see deploy/docker/Dockerfile) and set
    # NXDNS_IMAGE=nxdns.
    image: ${NXDNS_IMAGE:-git.mial.net/mokhtar/nxdns:${NXDNS_VERSION:-latest}}
    restart: unless-stopped
    # First boot needs ./etc-nxdns/config.zon with a `default` group and at
    # least one enabled upstream, or the container exits with code 2. The file
    # seeds the database once; after that the database is the truth and the
    # file is ignored.
    volumes:
      - ./etc-nxdns:/etc/nxdns:ro
      - nxdns-data:/var/lib/nxdns
    ports:
      - "53:53/udp"
      - "53:53/tcp"
      - "8080:8080"
      # DoH/DoT listeners, off by default in the config:
      # - "443:443"
      # - "853:853"
    # Per-network-namespace sysctl: lets uid 65532 bind port 53 inside the
    # container without CAP_NET_BIND_SERVICE.
    sysctls:
      net.ipv4.ip_unprivileged_port_start: 0
    # Do not point the host's resolv.conf at nxdns itself: the container's own
    # lookups (upstream DoH/DoT hostnames) would then depend on the service
    # they are trying to start.

volumes:
  nxdns-data:
