milestone 20: declarative configuration for iac

deploy/docker/compose.yaml

@@ -6,10 +6,17 @@ services:
     # NXDNS_IMAGE=nxdns.
     image: ${NXDNS_IMAGE:-git.mial.net/mokhtar/nxdns:${NXDNS_VERSION:-latest}}
     restart: unless-stopped
-    # First boot needs ./etc-nxdns/config.zon with a `default` group and at
-    # least one enabled upstream, or the container exits with code 2. The file
-    # seeds the database once; after that the database is the truth and the
-    # file is ignored.
+    # `run --config` makes the file the sole source of configuration: nxdns
+    # reconciles the database onto ./etc-nxdns/config.zon at every start, and
+    # rejects configuration writes from the admin UI. Edit the file and restart
+    # the container to change anything. The file needs a `default` group and at
+    # least one enabled upstream, or the container exits with code 2. A
+    # recreated nxdns-data volume rebuilds itself from the file on next start.
+    #
+    # Drop this line to let the database be the truth instead, and load a first
+    # configuration once with:
+    #   docker compose run --rm nxdns import /etc/nxdns/config.zon
+    command: ["run", "--config=/etc/nxdns/config.zon"]
     volumes:
       - ./etc-nxdns:/etc/nxdns:ro
       - nxdns-data:/var/lib/nxdns

deploy/systemd/nxdns.service

@@ -16,6 +16,11 @@ StateDirectoryMode=0700
 LogsDirectory=nxdns
 ConfigurationDirectory=nxdns
 
+# ConfigurationDirectory creates /etc/nxdns owned by the service user. nxdns
+# never writes there in either authority mode, and in file mode that directory
+# holds the source of truth, so deny the write outright rather than rely on it.
+ReadOnlyPaths=/etc/nxdns
+
 # Port 53 (and 443/853 when the DoH/DoT listeners are enabled).
 AmbientCapabilities=CAP_NET_BIND_SERVICE
 CapabilityBoundingSet=CAP_NET_BIND_SERVICE
@@ -44,6 +49,9 @@ SystemCallArchitectures=native
 
 Restart=on-failure
 RestartSec=2
+# Exit 2 is a configuration fault and 64 is a usage error. Neither clears on a
+# retry, so a restart loop only buries the diagnostics already in the journal.
+RestartPreventExitStatus=2 64
 
 [Install]
 WantedBy=multi-user.target