services:
  technitium:
    container_name: technitium
    hostname: dns-container
    image: docker.io/technitium/dns-server:latest
    restart: unless-stopped
    environment:
      - DNS_SERVER_DOMAIN=dns-container
      - DNS_SERVER_LOG_FOLDER_PATH=/var/log/technitium/dns
      # Required for clustering: HTTPS admin console, used for node-to-node
      # config sync and TLS join. Must NOT be proxied through nginx-proxy-manager
      # (TLS must terminate at the node itself for DANE-EE cluster auth).
      - DNS_SERVER_WEB_SERVICE_ENABLE_HTTPS=true
      - DNS_SERVER_WEB_SERVICE_USE_SELF_SIGNED_CERT=true
    ports:
      - "5380:5380/tcp"   # DNS web console (HTTP) - fronted by NPM
      - "53443:53443/tcp" # DNS web console (HTTPS) - cluster node-to-node sync, do not proxy
      - "53:53/udp"       # DNS service
      - "53:53/tcp"       # DNS service
    volumes:
      - /srv/technitium/config:/etc/dns
      - /srv/technitium/logs:/var/log/technitium/dns
    sysctls:
      - net.ipv4.ip_local_port_range=1024 65535
    networks:
      - npm-network

networks:
  npm-network:
    external: true