milestone 11: systemd and docker packaging, operator and architecture docs, config and api reference, docs drift guards

2026-08-02 15:24:10 +02:00
parent a589df7515
commit bdb6ffab7a
29 changed files with 1936 additions and 94 deletions
@@ -0,0 +1,31 @@
+services:
+  nxdns:
+    image: nxdns
+    build:
+      context: ../..
+      dockerfile: deploy/docker/Dockerfile
+    restart: unless-stopped
+    # First boot needs ./etc-nxdns/config.zon with a `default` group and at
+    # least one enabled upstream, or the container exits with code 2. The file
+    # seeds the database once; after that the database is the truth and the
+    # file is ignored.
+    volumes:
+      - ./etc-nxdns:/etc/nxdns:ro
+      - nxdns-data:/var/lib/nxdns
+    ports:
+      - "53:53/udp"
+      - "53:53/tcp"
+      - "8080:8080"
+      # DoH/DoT listeners, off by default in the config:
+      # - "443:443"
+      # - "853:853"
+    # Per-network-namespace sysctl: lets uid 65532 bind port 53 inside the
+    # container without CAP_NET_BIND_SERVICE.
+    sysctls:
+      net.ipv4.ip_unprivileged_port_start: 0
+    # Do not point the host's resolv.conf at nxdns itself: the container's own
+    # lookups (upstream DoH/DoT hostnames) would then depend on the service
+    # they are trying to start.
+
+volumes:
+  nxdns-data: