services:
  nxdns:
    image: nxdns
    build:
      context: ../..
      dockerfile: deploy/docker/Dockerfile
    restart: unless-stopped
    # First boot needs ./etc-nxdns/config.zon with a `default` group and at
    # least one enabled upstream, or the container exits with code 2. The file
    # seeds the database once; after that the database is the truth and the
    # file is ignored.
    volumes:
      - ./etc-nxdns:/etc/nxdns:ro
      - nxdns-data:/var/lib/nxdns
    ports:
      - "53:53/udp"
      - "53:53/tcp"
      - "8080:8080"
      # DoH/DoT listeners, off by default in the config:
      # - "443:443"
      # - "853:853"
    # Per-network-namespace sysctl: lets uid 65532 bind port 53 inside the
    # container without CAP_NET_BIND_SERVICE.
    sysctls:
      net.ipv4.ip_unprivileged_port_start: 0
    # Do not point the host's resolv.conf at nxdns itself: the container's own
    # lookups (upstream DoH/DoT hostnames) would then depend on the service
    # they are trying to start.

volumes:
  nxdns-data: