dns_docker/compose-ospf.yml at main · rootwyrm/dns_docker · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
## compose-ospf.yml
## This is for networks that want to use OSPF or BGP for anycast

version: "3.7"    # CAUTION: do not use 3.8, breaks on Alpine
services:
  dnsdist:
    ## Never deploy more than 1 dnsdist instance per host.
    container_name: dnsdist
    networks:
      dns:
        ipv4_address: 172.16.53.10
    image: docker.io/rootwyrm/dnsdist:${RELEASE:-latest}
    restart: on-failure
    env_file:
      - /opt/rootwyrm/etc/dns_docker.env
    ports:
      - "53"
      - "853"
      - "443"
      - "8053"
      # regex_marker
    tmpfs:
      - /run
      - /tmp
    volumes:
      - /opt/rootwyrm/etc/dnsdist:/usr/local/etc/dnsdist/conf.d
      - /opt/rootwyrm/etc/dnsdist/lua:/usr/local/etc/dnsdist/lua
      - /opt/rootwyrm/etc/dnsdist/maps:/usr/local/etc/dnsdist/maps
      - /opt/rootwyrm/etc/pki:/usr/local/etc/dnsdist/pki:ro
      - /opt/rootwyrm/var/log/dnsdist:/var/log
    cap_add:
      - NET_ADMIN
      - NET_BIND_SERVICE
      ## CAUTION: Uncomment the following if doing perf work
      #- CAP_SYS_ADMIN
  nsd:
    ## If you need more than one nsd, you did it wrong.
    container_name: nsd
    restart: on-failure
    env_file:
      - /opt/rootwyrm/etc/dns_docker.env
    networks:
      dns:
        ipv4_address: 172.16.53.11
    image: docker.io/rootwyrm/nsd:${RELEASE:-latest}
    sysctls:
      - net.core.somaxconn=10240
      - net.ipv4.tcp_rmem=1024 87380 12582912
      - net.ipv4.tcp_wmem=1024 87380 12582912
      # If TCP MTU probing is disabled, upstream TLS may fail.
      - net.ipv4.tcp_mtu_probing=1
      - net.ipv4.tcp_fin_timeout=15
      - net.ipv4.tcp_tw_reuse=1
      - net.ipv4.tcp_fastopen=3
    restart: on-failure
    ports:
      - "53"
      - "853"
      - target: 10530
        published: 10530
        protocol: udp
        mode: host
      - target: 9530
        published: 9530
        protocol: tcp
        mode: host
    tmpfs:
      - /run
      - /tmp
    volumes:
      - /opt/rootwyrm/etc/nsd:/usr/local/etc/nsd/conf.d
      - /opt/rootwyrm/etc/nsd/zones:/usr/local/etc/nsd/zones
      - /opt/rootwyrm/var/db/nsd:/var/db/nsd
      - /opt/rootwyrm/etc/pki:/usr/local/etc/nsd/pki:ro
      - /opt/rootwyrm/var/log/nsd:/var/log
    cap_add:
      - NET_BIND_SERVICE
  unbound:
    ## If you need more than one unbound, you probably did it wrong.
    container_name: unbound
    restart: on-failure
    env_file:
      - /opt/rootwyrm/etc/dns_docker.env
    networks:
      dns:
        ipv4_address: 172.16.53.12
    image: docker.io/rootwyrm/unbound:${RELEASE:-latest}
    sysctls:
      - net.core.somaxconn=10240
      - net.ipv4.tcp_rmem=1024 87380 12582912
      - net.ipv4.tcp_wmem=1024 87380 12582912
      # If TCP MTU probing is disabled, upstream TLS may fail.
      - net.ipv4.tcp_mtu_probing=1
      - net.ipv4.tcp_fin_timeout=15
      - net.ipv4.tcp_tw_reuse=1
      - net.ipv4.tcp_fastopen=3
    restart: on-failure
    ports:
      - "53"
      - "853"
      - target: 10531
        published: 10531
        protocol: udp
        mode: host
      - target: 9531
        published: 9531
        protocol: tcp
        mode: host
    tmpfs:
      - /run
      - /tmp
    volumes:
      - /opt/rootwyrm/etc/unbound:/usr/local/etc/unbound/conf.d
      - /opt/rootwyrm/etc/unbound/zones:/usr/local/etc/unbound/zones
      - /opt/rootwyrm/etc/pki:/usr/local/etc/unbound/pki:ro
      - /opt/rootwyrm/var/log/unbound:/usr/local/etc/unbound/var/log
    cap_add:
      - NET_ADMIN
      - NET_BIND_SERVICE

networks:
  dns:
    ipam:
      config:
        - subnet: "172.16.53.0/24"

# vim:ts=2:sw=2:et