version: "3.8"

services:
  dns-proxy:
    image: timochan/dns-ingress:latest
    container_name: dns-ingress
    build:
      context: .
      dockerfile: Dockerfile
    restart: unless-stopped
    cap_add:
      - NET_BIND_SERVICE
    ports:
      # DoT (DNS over TLS) - TCP 853
      - "853:853/tcp"
      # DoH (DNS over HTTPS) - TCP 443
      - "443:443/tcp"
      # DoQ (DNS over QUIC) - UDP 853
      - "853:853/udp"
      # DoH3 (DNS over HTTP/3) - UDP 443
      - "443:443/udp"
      - "8080:8080/tcp"
    volumes:
      - ./config.toml:/app/config.toml:ro
      - ./certs:/app/certs:ro
    networks:
      - dns-proxy-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

networks:
  dns-proxy-network:
    driver: bridge