rework

deploy/compose/compose.yaml

@@ -0,0 +1,39 @@
+services:
+  fancy-dns:
+    # Build here so initial startup does not depend on the cluster registry
+    # whose name this resolver may be needed to resolve.
+    build:
+      context: ../..
+      dockerfile: Dockerfile
+    image: fancy-dns:local
+    container_name: fancy-dns
+    restart: unless-stopped
+    read_only: true
+    cap_drop: [ALL]
+    security_opt:
+      - no-new-privileges:true
+    user: "65532:65532"
+    environment:
+      FANCYDNS_API_KEY: ${FANCYDNS_API_KEY:?Set FANCYDNS_API_KEY in deploy/compose/.env}
+    ports:
+      - "53:1053/udp"
+      - "53:1053/tcp"
+      - "853:1853/tcp"
+      - "443:8443/tcp"
+      # Keep the admin UI/API on the host loopback. Put it behind an
+      # authenticated TLS reverse proxy if remote access is needed.
+      - "127.0.0.1:8080:8080/tcp"
+    volumes:
+      - ./config.yaml:/etc/fancy-dns/config.yaml:ro
+      - ./zones:/etc/fancy-dns/zones:ro
+      - ./rpz:/etc/fancy-dns/rpz:ro
+      - ./tls:/etc/fancy-dns/tls:ro
+      - ./data:/var/lib/fancy-dns
+    tmpfs:
+      - /tmp:mode=1777,size=16m
+    healthcheck:
+      test: ["CMD", "/usr/local/bin/fancy-dns", "-version"]
+      interval: 30s
+      timeout: 3s
+      start_period: 10s
+      retries: 3