services:
  fancy-dns:
    # Build here so initial startup does not depend on the cluster registry
    # whose name this resolver may be needed to resolve.
    build:
      context: ../..
      dockerfile: Dockerfile
    image: fancy-dns:local
    container_name: fancy-dns
    restart: unless-stopped
    read_only: true
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    user: "65532:65532"
    environment:
      FANCYDNS_API_KEY: ${FANCYDNS_API_KEY:?Set FANCYDNS_API_KEY in deploy/compose/.env}
    ports:
      - "53:1053/udp"
      - "53:1053/tcp"
      - "853:1853/tcp"
      - "443:8443/tcp"
      # Keep the admin UI/API on the host loopback. Put it behind an
      # authenticated TLS reverse proxy if remote access is needed.
      - "127.0.0.1:8080:8080/tcp"
    volumes:
      - ./config.yaml:/etc/fancy-dns/config.yaml:ro
      - ./zones:/etc/fancy-dns/zones:ro
      - ./rpz:/etc/fancy-dns/rpz:ro
      - ./tls:/etc/fancy-dns/tls:ro
      - ./data:/var/lib/fancy-dns
    tmpfs:
      - /tmp:mode=1777,size=16m
    healthcheck:
      test: ["CMD", "/usr/local/bin/fancy-dns", "-version"]
      interval: 30s
      timeout: 3s
      start_period: 10s
      retries: 3