# Copy to docker-compose.yml, fill in your records, put the API token in a
# .env file next to it (CF_API_TOKEN=...), then run: docker compose up -d
services:
  nofixedaddress:
    image: ghcr.io/mdr6273/no-fixed-address:latest
    container_name: nofixedaddress
    restart: unless-stopped
    environment:
      CF_API_TOKEN: ${CF_API_TOKEN}
      RECORDS: home.example.com,vpn.example.com  # can be in different domains
      INTERVAL: "300"              # seconds between checks; the image's default is 86400
      TZ: America/Chicago
      # Everything below is optional; these are the defaults.
      # IPV4: "true"
      # IPV6: "false"              # needs IPv6 inside the container; see the README
      # PROXIED: ""                # blank keeps each record's current setting
      # TTL: ""                    # blank keeps each record's current TTL; 1 = automatic
      # CREATE_IF_MISSING: "false"
      # DRY_RUN: "false"           # log what would change without changing it
      # LOG_LEVEL: info            # debug, info, warn or error
      # NOTIFY_URL: ""             # a webhook for changes and problems; see Notifications in the README
      # NOTIFY_FORMAT: auto        # discord, slack, ntfy, gotify, apprise, json or text
    # The container needs no privileges and only writes to /tmp.
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true

# To keep the token out of `docker inspect`, use a secret instead: replace the
# CF_API_TOKEN line above with
#
#       CF_API_TOKEN_FILE: /run/secrets/cf_api_token
#
# add this to the service
#
#     secrets:
#       - cf_api_token
#
# and this at the top level. The file must be readable by uid 10001 and by no
# one else: sudo chown 10001:10001 cf_api_token.txt && sudo chmod 0400 cf_api_token.txt
#
# secrets:
#   cf_api_token:
#     file: ./cf_api_token.txt