# Optional turnkey DNS — only if you DON'T run your own party DNS server.
# Layer on: `docker compose -f docker-compose.yml -f docker-compose.dnsmasq.yml ... up -d`.
# Serves dnsmasq/dnsmasq.conf (rendered from the template, includes the airgap
# spoof records). If you have your own DNS, skip this and use the records from
# `tooling/dns-records.sh` instead.
services:
  dnsmasq:
    image: jpillora/dnsmasq
    container_name: dnsmasq
    restart: unless-stopped
    ports:
      # Bind DNS to the host LAN IP so it doesn't clash with systemd-resolved on :53.
      - "${HOST_LAN_IP}:53:53/udp"
      - "${HOST_LAN_IP}:53:53/tcp"
    volumes:
      - ./dnsmasq/dnsmasq.conf:/etc/dnsmasq.conf:ro
    networks:
      - mcnet
    # webproc UI (:8080) can be exposed behind Caddy as dns.${BASE_DOMAIN};
    # guard with HTTP_USER / HTTP_PASS.