33 lines
1.2 KiB
YAML
33 lines
1.2 KiB
YAML
services:
|
|
nxdns:
|
|
# Published multi-architecture image. Pin an exact version in production:
|
|
# NXDNS_VERSION=0.0.1 docker compose up -d. To run a locally built image
|
|
# instead, build it first (see deploy/docker/Dockerfile) and set
|
|
# NXDNS_IMAGE=nxdns.
|
|
image: ${NXDNS_IMAGE:-git.mial.net/mokhtar/nxdns:${NXDNS_VERSION:-latest}}
|
|
restart: unless-stopped
|
|
# First boot needs ./etc-nxdns/config.zon with a `default` group and at
|
|
# least one enabled upstream, or the container exits with code 2. The file
|
|
# seeds the database once; after that the database is the truth and the
|
|
# file is ignored.
|
|
volumes:
|
|
- ./etc-nxdns:/etc/nxdns:ro
|
|
- nxdns-data:/var/lib/nxdns
|
|
ports:
|
|
- "53:53/udp"
|
|
- "53:53/tcp"
|
|
- "8080:8080"
|
|
# DoH/DoT listeners, off by default in the config:
|
|
# - "443:443"
|
|
# - "853:853"
|
|
# Per-network-namespace sysctl: lets uid 65532 bind port 53 inside the
|
|
# container without CAP_NET_BIND_SERVICE.
|
|
sysctls:
|
|
net.ipv4.ip_unprivileged_port_start: 0
|
|
# Do not point the host's resolv.conf at nxdns itself: the container's own
|
|
# lookups (upstream DoH/DoT hostnames) would then depend on the service
|
|
# they are trying to start.
|
|
|
|
volumes:
|
|
nxdns-data:
|