# BIND9 Web UI — full stack: BIND9 name server + API backend container.
#
# Usage:
#   docker compose up -d
# The API is then available at http://localhost:5000; the UI lives in the
# webui facade (himalsimkhada/webui).
#
# The web-UI container manages the BIND9 container over the rndc control
# channel (TCP 953). The whole /etc/bind directory is a single named volume
# (bind9-vol) shared by both containers — every config file, zone file and
# the rndc key live there. install.sh seeds that volume from ./docker/bind on
# first run (the ISC image's own /etc/bind is nearly empty).
#
# If you instead run BIND on the host (bare-metal), use the web-UI-only
# docker-compose.yml (see the README).

services:
  bind9:
    image: internetsystemsconsortium/bind9:9.18
    container_name: bind9
    restart: unless-stopped
    ports:
      # DNS + rndc are published on non-default host ports (5353 / 9353) so
      # nothing on the host collides with them (systemd-resolved already holds
      # 53, and 953 is the classic rndc port). To serve DNS on the standard
      # port 53 instead, map "53:53/udp" and "53:53/tcp" here.
      - "5353:53/udp"
      - "5353:53/tcp"
      - "9353:953"              # rndc control channel for the web-UI container
    volumes:
      - bind9-vol:/etc/bind          # the whole BIND config directory in one volume
      - bind-logs:/var/log/bind      # named.log read by the web UI
    # command: ["-4"]

  webui:
    image: ghcr.io/himalsimkhada/webui/bind9-webui:latest
    # build: .   # optional: build the image from this repo instead of pulling
    container_name: bind9-webui
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:5000/api/session"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    ports:
      - "5000:5000"
    depends_on:
      - bind9
    environment:
      RNDC_HOST: bind9          # talk to the BIND container over TCP
      RNDC_PORT: "953"
      RNDC_KEY: /etc/bind/rndc.key
      BIND_CONF_DIR: /etc/bind
      LOG_FILE: /var/log/bind/named.log
      ZONE_DIR: /etc/bind/zones
      ZONE_OWNER: "bind:bind"   # named runs as 'bind'; make zone files writable
      WEBUI_PASSWORD: ${WEBUI_PASSWORD:-}
      SECRET_KEY: ${SECRET_KEY:-}
    volumes:
      - bind9-vol:/etc/bind          # same shared BIND config directory
      - bind-logs:/var/log/bind

volumes:
  bind9-vol:
    name: bind9-vol
    external: true   # created+seeded by install.sh (needed for a fresh /etc/bind)
  bind-logs:
    name: bind-logs
    external: true   # named logs carry across project dirs