# ferrite — self-hosted DNS filtering + per-device tunnel routing
#
# Host networking is the recommended setup: ferrite identifies devices by their
# real LAN IP/MAC, which is what per-device profiles and routing rules match on.
# Behind a bridge every query arrives from the Docker gateway instead, so all
# clients look like one device.
#
#   docker compose up -d
#
# Then point your router's DHCP DNS at this host and open http://fe.te
services:
  ferrite:
    image: ghcr.io/koroblabs/ferrite-server:latest
    container_name: ferrite
    restart: unless-stopped
    network_mode: host
    cap_add:
      - NET_BIND_SERVICE   # bind :53 and :80 as a non-root user
      # - NET_ADMIN        # optional: kernel WireGuard backend (needs the wireguard module on the host)
    volumes:
      - ferrite-data:/var/lib/ferrite
    environment:
      - RUST_LOG=ferrite=info

volumes:
  ferrite-data:

# --- Bridge alternative -------------------------------------------------------
# Use only if host networking is unavailable (e.g. Docker Desktop). Per-device
# features degrade: every client is seen as the bridge gateway.
#
# services:
#   ferrite:
#     image: ghcr.io/koroblabs/ferrite-server:latest
#     container_name: ferrite
#     restart: unless-stopped
#     ports:
#       - "53:53/tcp"
#       - "53:53/udp"
#       - "80:80/tcp"
#       - "443:443/tcp"   # HTTPS (SNI) intercept — only needed with selective routing
#     cap_add:
#       - NET_BIND_SERVICE
#     volumes:
#       - ferrite-data:/var/lib/ferrite
#     environment:
#       - FERRITE_PANEL_IP=192.168.1.10   # host LAN IP, so the fe.te shortcut resolves