# Generated by docker-install.sh — 2026-03-02 19:57:07
services:
  pihole:
    image: pihole/pihole:latest
    network_mode: host
    cap_add:
      - NET_ADMIN
      - NET_RAW
      - SYS_NICE
    # Wait for the sidecar to stage the inject script into the shared
    # pihole-ha-src volume, then run it — it injects the HA panel and hands off
    # to Pi-hole's own start.sh. No local file or bind-mount required, so this
    # works whether the sidecar is built from a local checkout or the git URL.
    entrypoint:
      - /bin/bash
      - -c
      # Bounded on purpose. An endless wait deadlocks a node whose Pi-hole IS
      # the LAN's DNS: the sidecar image cannot be built because nothing
      # resolves, and nothing resolves because Pi-hole is waiting for the
      # sidecar. After 90s, start Pi-hole anyway (replace start.sh with your
      # image's own entrypoint if it has one, e.g. /custom-entrypoint.sh).
      - 'n=0; while [ ! -f /pihole-ha-src/pihole-ha-inject-docker.sh ] && [ $$n -lt 90 ]; do n=$$((n+1)); sleep 1; done; if [ -f /pihole-ha-src/pihole-ha-inject-docker.sh ]; then exec /pihole-ha-src/pihole-ha-inject-docker.sh; fi; echo "pihole-ha: sidecar never staged the panel - starting Pi-hole without it"; exec start.sh'
    volumes:
      - pihole-etc:/etc/pihole
      - pihole-dnsmasq:/etc/dnsmasq.d
      - pihole-ha-src:/pihole-ha-src:ro
      - pihole-ha-run:/run/pihole-ha:ro
      - pihole-ha-conf:/etc/pihole-ha:ro
      - pihole-ha-ieee:/var/lib/ieee-data:ro
    environment:
      TZ: ${TZ:-America/New_York}
      FTLCONF_webserver_api_password: ${PIHOLE_PASSWORD:-}
      FTLCONF_webserver_port: ${PIHOLE_WEB_PORT:-80}
    restart: unless-stopped

  pihole-ha:
    build:
      context: ..
      dockerfile: docker/Dockerfile
    network_mode: host
    pid: "service:pihole"
    cap_add:
      - NET_ADMIN
      - NET_RAW
    depends_on:
      - pihole
    env_file: .env
    volumes:
      - pihole-etc:/etc/pihole
      - pihole-dnsmasq:/etc/dnsmasq.d
      - pihole-ha-conf:/etc/pihole-ha
      - pihole-ha-run:/run/pihole-ha
      # The built payload and its manifest. Without this they live in the
      # container layer and are destroyed by every redeploy, leaving the
      # publisher with nothing to serve.
      - pihole-ha-blob:/var/lib/pihole-ha
      - pihole-ha-src:/pihole-ha-src
      - pihole-ha-ieee:/var/lib/ieee-data
    restart: unless-stopped

volumes:
  pihole-etc:
  pihole-ha-blob:
    external: true
  pihole-dnsmasq:
    external: true
  pihole-ha-conf:
  pihole-ha-run:
  pihole-ha-src:
  pihole-ha-ieee: