docker-compose.yml

version: '3.4'
volumes:
    dnscrypt:
    dnscrypt-server:
    ssl:
    nsd:
    acme-sh:
    acme-acc:
services:
  acme:
    image: docker.io/neilpang/acme.sh
    container_name: acme
    command: >
      /bin/sh -c "echo \"#!/bin/sh

      set -e

      acme.sh --set-default-ca --server letsencrypt

      if [ -n ${HEALTHCHECK} ]; then

        acme.sh --issue --dns dns_cf --dnssleep 60 --domain '${DOMAIN}' --keylength ec-384 --fullchain-file /opt/ssl/fullchain-ecc.pem --key-file /opt/ssl/key-ecc.pem --ca-file /opt/ssl/ca-ecc.pem --cert-file /opt/ssl/cert-ecc.pem --pre-hook 'curl -fsS -m 10 --retry 5 -o /dev/null https://hc-ping.com/${HEALTHCHECK}'

      else

        acme.sh --issue --dns dns_cf --dnssleep 60 --domain '${DOMAIN}' --keylength ec-384 --fullchain-file /opt/ssl/fullchain-ecc.pem --key-file /opt/ssl/key-ecc.pem --ca-file /opt/ssl/ca-ecc.pem --cert-file /opt/ssl/cert-ecc.pem
      
      fi

      acme.sh --deploy -d '${DOMAIN}' --ecc --deploy-hook docker

      \" > start.sh
      && chmod +x start.sh
      && ./start.sh"
    logging:
      driver: "json-file"
      options:
        max-size: "200k"
        max-file: "10"
    environment:
      - HEALTHCHECK=${HEALTHCHECK}
      - CF_Email=${CF_EMAIL}
      - CF_Key=${CF_KEY}
      - CF_Token=${CF_TOKEN}
      - CF_Account_ID=${CF_ACCOUNT_ID}
      - CF_Zone_ID=${CF_ZONE_ID}
      - DOMAIN=${DOMAIN}
      - DEPLOY_DOCKER_CONTAINER_LABEL=sh.acme.autoload.domain=${DOMAIN}
      - DEPLOY_DOCKER_CONTAINER_KEY_FILE=/opt/ssl/key-ecc.pem
      - DEPLOY_DOCKER_CONTAINER_CERT_FILE="/opt/ssl/cert-ecc.pem"
      - DEPLOY_DOCKER_CONTAINER_CA_FILE="/opt/ssl/ca-ecc.pem"
      - DEPLOY_DOCKER_CONTAINER_FULLCHAIN_FILE="/opt/ssl/fullchain-ecc.pem"
      - DEPLOY_DOCKER_CONTAINER_RELOAD_CMD="cat /opt/ssl/key-ecc.pem > cat /opt/ssl/fullchain-ecc.pem > /opt/ssl/fullchain-key.pem.ecdsa; sv restart haproxy"
    volumes:
       - ssl:/opt/ssl
       - ./run/acmeout:/acme.sh
       - /var/run/docker.sock:/var/run/docker.sock

  acme-daemon:
    container_name: acme-daemon
    restart: on-failure:2
    image: docker.io/neilpang/acme.sh
    command: daemon
    logging:
      driver: "json-file"
      options:
        max-size: "200k"
        max-file: "10"
    volumes:
       - ssl:/opt/ssl
       - ./run/acmeout:/acme.sh
       - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - DOMAIN=${DOMAIN}
      - HEALTHCHECK=${HEALTHCHECK}
      - DEPLOY_DOCKER_CONTAINER_LABEL=sh.acme.autoload.domain=${DOMAIN}
      - DEPLOY_DOCKER_CONTAINER_KEY_FILE=/opt/ssl/key-ecc.pem
      - DEPLOY_DOCKER_CONTAINER_CERT_FILE="/opt/ssl/cert-ecc.pem"
      - DEPLOY_DOCKER_CONTAINER_CA_FILE="/opt/ssl/ca-ecc.pem"
      - DEPLOY_DOCKER_CONTAINER_FULLCHAIN_FILE="/opt/ssl/fullchain-ecc.pem"
      - DEPLOY_DOCKER_CONTAINER_RELOAD_CMD="cat /opt/ssl/key-ecc.pem > cat /opt/ssl/fullchain-ecc.pem > /opt/ssl/fullchain-key.pem.ecdsa; sv restart haproxy"

  nsd:
    container_name: nsd
    restart: on-failure:5
    build: nsd
    image: ghcr.io/publicarray/dns-resolver-infra/nsd
    logging:
      driver: "json-file"
      options:
        max-size: "200k"
        max-file: "10"
    volumes:
      - nsd:/etc/nsd/run

  unbound:
    container_name: unbound
    restart: on-failure:5
    depends_on:
      - nsd
    build: unbound
    image: ghcr.io/publicarray/dns-resolver-infra/unbound
    command: -d nsd
    logging:
      driver: "json-file"
      options:
        max-size: "200k"
        max-file: "10"
    # ports:
    #   - target: 4949
    #     published: 4949
    #     protocol: tcp
    #     mode: ingress

  m13253-doh:
    container_name: doh
    restart: on-failure:5
    depends_on:
      - unbound
    build: m13253-doh
    image: ghcr.io/publicarray/dns-resolver-infra/m13253-doh
    command: -d unbound
    logging:
      driver: "json-file"
      options:
        max-size: "200k"
        max-file: "10"

  # doh-proxy:
  #   container_name: doh-proxy
  #   restart: on-failure:5
  #   depends_on:
  #     - unbound
  #   build: doh-proxy
  #   image: ghcr.io/publicarray/dns-resolver-infra/doh-proxy
  #   command: -d

  haproxy:
    container_name: haproxy
    restart: on-failure:5
    depends_on:
      - acme
      - m13253-doh
      - unbound
    labels:
      - sh.acme.autoload.domain=${DOMAIN}
    build: haproxy
    image: ghcr.io/publicarray/dns-resolver-infra/haproxy
    command: -d -r
    logging:
      driver: "json-file"
      options:
        max-size: "200k"
        max-file: "10"
    ports:
      - "443:443/tcp"
      - "853:853/tcp"
      - "443:443/udp"
      - "853:853/udp"
    volumes:
       - ssl:/opt/ssl
    environment:
      - DOMAIN=${DOMAIN}

  # dnscrypt-server:
  #   container_name: dnscrypt-server
  #   restart: on-failure:5
  #   depends_on:
  #     - unbound
  #     - haproxy
  #   image: ghcr.io/publicarray/dns-resolver-infra/dnscrypt-server
  #   command:
  #     - init
  #     - -d unbound
  #     - -N
  #     - dns.seby.io
  #     - -T
  #     - haproxy
  #     - -E
  #     - 139.99.222.72:8443
  #     - -A
  #   logging:
  #     driver: "json-file"
  #     options:
  #       max-size: "200k"
  #       max-file: "10"
  #   ports:
  #     - "443:8443/tcp"
  #     - "443:8443/udp"
  #   volumes:
  #      - dnscrypt:/opt/dnscrypt-wrapper
  #      - dnscrypt-server:/opt/encrypted-dns