milestone 20: declarative configuration for iac

deploy/docker/compose.yaml

@@ -6,10 +6,17 @@ services:
     # NXDNS_IMAGE=nxdns.
     image: ${NXDNS_IMAGE:-git.mial.net/mokhtar/nxdns:${NXDNS_VERSION:-latest}}
     restart: unless-stopped
-    # First boot needs ./etc-nxdns/config.zon with a `default` group and at
-    # least one enabled upstream, or the container exits with code 2. The file
-    # seeds the database once; after that the database is the truth and the
-    # file is ignored.
+    # `run --config` makes the file the sole source of configuration: nxdns
+    # reconciles the database onto ./etc-nxdns/config.zon at every start, and
+    # rejects configuration writes from the admin UI. Edit the file and restart
+    # the container to change anything. The file needs a `default` group and at
+    # least one enabled upstream, or the container exits with code 2. A
+    # recreated nxdns-data volume rebuilds itself from the file on next start.
+    #
+    # Drop this line to let the database be the truth instead, and load a first
+    # configuration once with:
+    #   docker compose run --rm nxdns import /etc/nxdns/config.zon
+    command: ["run", "--config=/etc/nxdns/config.zon"]
     volumes:
       - ./etc-nxdns:/etc/nxdns:ro
       - nxdns-data:/var/lib/nxdns