88 lines
3.3 KiB
YAML
88 lines
3.3 KiB
YAML
version: '3.8'
|
|
|
|
# Technitium DNS + Dockhand stack
|
|
# - Technitium replaces Pi-hole + Unbound behavior (blocking + recursion)
|
|
# - Dockhand manages container stacks from a web UI
|
|
|
|
services:
|
|
technitium-dns:
|
|
image: technitium/dns-server:latest
|
|
container_name: technitium-dns
|
|
restart: unless-stopped
|
|
labels:
|
|
- "com.synology.stack=network"
|
|
- "com.synology.service=technitium-dns"
|
|
environment:
|
|
TZ: "{{TZ}}"
|
|
# Domain shown in Technitium UI defaults
|
|
DNS_SERVER_DOMAIN: "{{TECHNITIUM_DNS_DOMAIN:-home.arpa}}"
|
|
|
|
# Required: set a strong admin password in .env
|
|
DNS_SERVER_ADMIN_PASSWORD: "{{TECHNITIUM_ADMIN_PASSWORD}}"
|
|
|
|
# Recursive resolver mode (Technitium does root recursion)
|
|
DNS_SERVER_RECURSION: "{{TECHNITIUM_RECURSION_MODE:-UseSpecifiedNetworkACL}}"
|
|
DNS_SERVER_RECURSION_NETWORK_ACL: "{{TECHNITIUM_RECURSION_ACL:-127.0.0.1/32,::1/128,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,fc00::/7}}"
|
|
|
|
# Pi-hole-like ad blocking behavior
|
|
DNS_SERVER_BLOCKING_TYPE: "{{TECHNITIUM_BLOCKING_TYPE:-AnyAddress}}"
|
|
DNS_SERVER_BLOCK_LIST_URLS: "{{TECHNITIUM_BLOCKLIST_URLS:-https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts}}"
|
|
DNS_SERVER_ALLOW_TXT_BLOCKING_REPORT: "{{TECHNITIUM_ALLOW_BLOCKING_REPORT:-false}}"
|
|
|
|
# Operational defaults
|
|
DNS_SERVER_PREFER_IPV6: "{{TECHNITIUM_PREFER_IPV6:-false}}"
|
|
DNS_SERVER_WEB_SERVICE_HTTP_PORT: "{{TECHNITIUM_WEB_CONTAINER_PORT:-5380}}"
|
|
volumes:
|
|
- /etc/localtime:/etc/localtime:ro
|
|
- {{DOCKERCONFDIR}}/technitium:/etc/dns
|
|
ports:
|
|
# Core DNS service
|
|
- "{{DNS_BIND_IP:-0.0.0.0}}:53:53/udp"
|
|
- "{{DNS_BIND_IP:-0.0.0.0}}:53:53/tcp"
|
|
# Technitium web admin
|
|
- "{{TECHNITIUM_WEB_BIND_IP:-0.0.0.0}}:{{TECHNITIUM_WEB_PORT:-5380}}:{{TECHNITIUM_WEB_CONTAINER_PORT:-5380}}/tcp"
|
|
# Optional encrypted DNS listeners (enable only if you intend to use them)
|
|
# - "{{DNS_BIND_IP:-0.0.0.0}}:853:853/tcp" # DoT
|
|
# - "{{DNS_BIND_IP:-0.0.0.0}}:443:443/tcp" # DoH
|
|
mem_limit: "{{TECHNITIUM_MEM_LIMIT:-512m}}"
|
|
mem_reservation: "{{TECHNITIUM_MEM_RESERVATION:-192m}}"
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-file: "{{DOCKERLOGGING_MAXFILE}}"
|
|
max-size: "{{DOCKERLOGGING_MAXSIZE}}"
|
|
|
|
dockhand:
|
|
image: fnsys/dockhand:latest
|
|
container_name: dockhand
|
|
restart: unless-stopped
|
|
labels:
|
|
- "com.synology.stack=management"
|
|
- "com.synology.service=dockhand"
|
|
environment:
|
|
TZ: "{{TZ}}"
|
|
# Required: set a strong random value in .env
|
|
ENCRYPTION_KEY: "{{DOCKHAND_ENCRYPTION_KEY}}"
|
|
PORT: "3000"
|
|
DATA_DIR: "/opt/dockhand"
|
|
PUID: "{{PUID}}"
|
|
PGID: "{{PGID}}"
|
|
group_add:
|
|
- "{{DOCKER_GID:-999}}"
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- {{DOCKERCONFDIR}}/dockhand:/opt/dockhand
|
|
- {{DOCKHAND_STACKS_DIR:-/opt/stacks}}:/opt/stacks
|
|
ports:
|
|
- "{{DOCKHAND_BIND_IP:-0.0.0.0}}:{{DOCKHAND_PORT:-3000}}:3000/tcp"
|
|
mem_limit: "{{DOCKHAND_MEM_LIMIT:-256m}}"
|
|
mem_reservation: "{{DOCKHAND_MEM_RESERVATION:-64m}}"
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-file: "{{DOCKERLOGGING_MAXFILE}}"
|
|
max-size: "{{DOCKERLOGGING_MAXSIZE}}"
|