# BIND9 Web UI — API backend container ONLY.
#
# This runs just the API and manages an EXISTING BIND9 server that lives
# OUTSIDE the container (the host, or a remote machine) over the rndc TCP
# control channel. It mounts the host's /etc/bind so it can read/write the
# same config and zone files that `named` uses.
#
# Notes:
#   your host/remote `named` must listen on TCP 953. If your `named.conf` does
#   not already expose it, add a restricted block (never 'any'):
#
#   controls { inet 0.0.0.0 port 953 allow { 127.0.0.1; ::1; 172.16.0.0/12; } keys { "rndc-key"; }; };
#
# Optional host-config values come from an `.env` file (copy .env.example ->
# .env and edit). Otherwise sensible defaults are used.
#
# Usage:
#   docker compose up -d
# The API is then available at http://localhost:5000. The user interface lives
# in the webui facade (himalsimkhada/webui), which proxies to this backend.

services:
  webui:
    image: ghcr.io/himalsimkhada/webui/bind9-webui:latest
    # build: .   # optional: build the image from this repo instead of pulling
    container_name: bind9-webui
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:5000/api/session"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    ports:
      - "${WEBUI_PORT:-5000}:5000"
    environment:
      RNDC_HOST: ${RNDC_HOST}            # IP/hostname of the host/remote named
      RNDC_PORT: ${RNDC_PORT:-953}
      RNDC_KEY: /etc/bind/rndc.key
      BIND_CONF_DIR: /etc/bind
      ZONE_DIR: /etc/bind
      LOG_FILE: ${LOG_FILE:-/var/log/bind/named.log}
      WEBUI_PASSWORD: ${WEBUI_PASSWORD:-}
      SECRET_KEY: ${SECRET_KEY:-}
    extra_hosts:
      # Make host.docker.internal resolve to the Docker host gateway, so
      # RNDC_HOST=host.docker.internal reaches host/remote BIND on TCP 953.
      - "host.docker.internal:host-gateway"
    volumes:
      # Mount the host's BIND config dir (config + zone files + rndc.key).
      # BIND_HOST_DIR is set by ./install.sh (mode 2) to the detected config
      # dir on non-Debian distros (/etc/named).
      - ${BIND_HOST_DIR:-/etc/bind}:/etc/bind
      # Mount the host BIND log dir so the Logs tab can tail LOG_FILE.
      - ${HOST_BIND_LOG_DIR:-/var/log/bind}:/var/log/bind