services:
  nxdns:
    # Published multi-architecture image. Pin an exact version in production:
    # NXDNS_VERSION=0.0.1 docker compose up -d. To run a locally built image
    # instead, build it first (see deploy/docker/Dockerfile) and set
    # NXDNS_IMAGE=nxdns.
    image: ${NXDNS_IMAGE:-git.mial.net/mokhtar/nxdns:${NXDNS_VERSION:-latest}}
    restart: unless-stopped
    # `run --config` makes the file the sole source of configuration: nxdns
    # reconciles the database onto ./etc-nxdns/config.zon at every start, and
    # rejects configuration writes from the admin UI. Edit the file and restart
    # the container to change anything. The file needs a `default` group and at
    # least one enabled upstream, or the container exits with code 2. A
    # recreated nxdns-data volume rebuilds itself from the file on next start.
    #
    # Drop this line to let the database be the truth instead, and load a first
    # configuration once with:
    #   docker compose run --rm nxdns import /etc/nxdns/config.zon
    command: ["run", "--config=/etc/nxdns/config.zon"]
    volumes:
      - ./etc-nxdns:/etc/nxdns:ro
      - nxdns-data:/var/lib/nxdns
    ports:
      - "53:53/udp"
      - "53:53/tcp"
      - "8080:8080"
      # DoH/DoT listeners, off by default in the config:
      # - "443:443"
      # - "853:853"
    # Per-network-namespace sysctl: lets uid 65532 bind port 53 inside the
    # container without CAP_NET_BIND_SERVICE.
    sysctls:
      net.ipv4.ip_unprivileged_port_start: 0
    # Do not point the host's resolv.conf at nxdns itself: the container's own
    # lookups (upstream DoH/DoT hostnames) would then depend on the service
    # they are trying to start.

volumes:
  nxdns-data: