40 lines
1.7 KiB
YAML
40 lines
1.7 KiB
YAML
services:
|
|
nxdns:
|
|
# Published multi-architecture image. Pin an exact version in production:
|
|
# NXDNS_VERSION=0.0.1 docker compose up -d. To run a locally built image
|
|
# instead, build it first (see deploy/docker/Dockerfile) and set
|
|
# NXDNS_IMAGE=nxdns.
|
|
image: ${NXDNS_IMAGE:-git.mial.net/mokhtar/nxdns:${NXDNS_VERSION:-latest}}
|
|
restart: unless-stopped
|
|
# `run --config` makes the file the sole source of configuration: nxdns
|
|
# reconciles the database onto ./etc-nxdns/config.zon at every start, and
|
|
# rejects configuration writes from the admin UI. Edit the file and restart
|
|
# the container to change anything. The file needs a `default` group and at
|
|
# least one enabled upstream, or the container exits with code 2. A
|
|
# recreated nxdns-data volume rebuilds itself from the file on next start.
|
|
#
|
|
# Drop this line to let the database be the truth instead, and load a first
|
|
# configuration once with:
|
|
# docker compose run --rm nxdns import /etc/nxdns/config.zon
|
|
command: ["run", "--config=/etc/nxdns/config.zon"]
|
|
volumes:
|
|
- ./etc-nxdns:/etc/nxdns:ro
|
|
- nxdns-data:/var/lib/nxdns
|
|
ports:
|
|
- "53:53/udp"
|
|
- "53:53/tcp"
|
|
- "8080:8080"
|
|
# DoH/DoT listeners, off by default in the config:
|
|
# - "443:443"
|
|
# - "853:853"
|
|
# Per-network-namespace sysctl: lets uid 65532 bind port 53 inside the
|
|
# container without CAP_NET_BIND_SERVICE.
|
|
sysctls:
|
|
net.ipv4.ip_unprivileged_port_start: 0
|
|
# Do not point the host's resolv.conf at nxdns itself: the container's own
|
|
# lookups (upstream DoH/DoT hostnames) would then depend on the service
|
|
# they are trying to start.
|
|
|
|
volumes:
|
|
nxdns-data:
|