mokhtar
a0d8af3170
Gates / test (push) Successful in 2m23s
Gates / test-aarch64 (push) Successful in 7m54s
Gates / package (push) Canceled after 0s
Gates / container (push) Canceled after 0s
Gates / frontend (push) Canceled after 1h33m1s
CI / gates (push) Canceled after 1h32m56s
41 lines
1.8 KiB
YAML
41 lines
1.8 KiB
YAML
services:
|
|
nxdns:
|
|
# Published multi-architecture image. The default is the release this file
|
|
# is tagged with: `zig build cut` moves it in the bump commit, so the file
|
|
# from a tag runs that tag's image. NXDNS_VERSION picks another release. To
|
|
# run a locally built image instead, build it first (see
|
|
# deploy/docker/Dockerfile) and set NXDNS_IMAGE=nxdns.
|
|
image: ${NXDNS_IMAGE:-git.mial.net/mokhtar/nxdns:${NXDNS_VERSION:-0.0.24}}
|
|
restart: unless-stopped
|
|
# `run --config` makes the file the sole source of configuration: nxdns
|
|
# reconciles the database onto ./etc-nxdns/config.zon at every start, and
|
|
# rejects configuration writes from the admin UI. Edit the file and restart
|
|
# the container to change anything. The file needs a `default` group and at
|
|
# least one enabled upstream, or the container exits with code 2. A
|
|
# recreated nxdns-data volume rebuilds itself from the file on next start.
|
|
#
|
|
# Drop this line to let the database be the truth instead, and load a first
|
|
# configuration once with:
|
|
# docker compose run --rm nxdns import /etc/nxdns/config.zon
|
|
command: ["run", "--config=/etc/nxdns/config.zon"]
|
|
volumes:
|
|
- ./etc-nxdns:/etc/nxdns:ro
|
|
- nxdns-data:/var/lib/nxdns
|
|
ports:
|
|
- "53:53/udp"
|
|
- "53:53/tcp"
|
|
- "8080:8080"
|
|
# DoH/DoT listeners, off by default in the config:
|
|
# - "443:443"
|
|
# - "853:853"
|
|
# Per-network-namespace sysctl: lets uid 65532 bind port 53 inside the
|
|
# container without CAP_NET_BIND_SERVICE.
|
|
sysctls:
|
|
net.ipv4.ip_unprivileged_port_start: 0
|
|
# Do not point the host's resolv.conf at nxdns itself: the container's own
|
|
# lookups (upstream DoH/DoT hostnames) would then depend on the service
|
|
# they are trying to start.
|
|
|
|
volumes:
|
|
nxdns-data:
|