services:
  technitium:
    image: docker.io/technitium/dns-server@sha256:99c250f0ee494f2f31e09a76d83f8213bc4c5d6f106b0895cd5f327518469c48
    container_name: technitium-dns-pilot
    hostname: technitium-dns-pilot
    restart: unless-stopped
    networks:
      lan_macvlan:
        ipv4_address: ${TECHNITIUM_BIND_IP}
      pangolin: {}
    environment:
      DNS_SERVER_DOMAIN: ${DNS_SERVER_DOMAIN}
      DNS_SERVER_ADMIN_PASSWORD: ${DNS_SERVER_ADMIN_PASSWORD}
      DNS_SERVER_SSO_ENABLED: ${DNS_SERVER_SSO_ENABLED:-false}
      DNS_SERVER_SSO_AUTHORITY: ${DNS_SERVER_SSO_AUTHORITY:-}
      DNS_SERVER_SSO_CLIENT_ID: ${DNS_SERVER_SSO_CLIENT_ID:-}
      DNS_SERVER_SSO_CLIENT_SECRET: ${DNS_SERVER_SSO_CLIENT_SECRET:-}
      DNS_SERVER_SSO_METADATA_ADDRESS: ${DNS_SERVER_SSO_METADATA_ADDRESS:-}
      DNS_SERVER_SSO_SCOPES: ${DNS_SERVER_SSO_SCOPES:-openid profile email groups}
      DNS_SERVER_SSO_ALLOW_SIGNUP: ${DNS_SERVER_SSO_ALLOW_SIGNUP:-false}
      DNS_SERVER_SSO_ALLOW_SIGNUP_ONLY_FOR_MAPPED_USERS: ${DNS_SERVER_SSO_ALLOW_SIGNUP_ONLY_FOR_MAPPED_USERS:-true}
      DNS_SERVER_SSO_GROUP_MAP: ${DNS_SERVER_SSO_GROUP_MAP:-authentik Admins=Administrators}
      DNS_SERVER_WEB_SERVICE_HTTP_PORT: "80"
      DNS_SERVER_WEB_SERVICE_HTTPS_PORT: "443"
      DNS_SERVER_WEB_SERVICE_ENABLE_HTTPS: "true"
      DNS_SERVER_WEB_SERVICE_USE_SELF_SIGNED_CERT: "true"
      DNS_SERVER_WEB_SERVICE_HTTP_TO_TLS_REDIRECT: "true"
      DNS_SERVER_OPTIONAL_PROTOCOL_DNS_OVER_HTTP: "false"
      DNS_SERVER_RECURSION: "AllowOnlyForPrivateNetworks"
      DNS_SERVER_ENABLE_BLOCKING: "true"
      DNS_SERVER_ALLOW_TXT_BLOCKING_REPORT: "true"
      DNS_SERVER_BLOCK_LIST_URLS: ${DNS_SERVER_BLOCK_LIST_URLS}
      DNS_SERVER_LOG_USING_LOCAL_TIME: "true"
      DNS_SERVER_LOG_FOLDER_PATH: /var/log/technitium/dns
      DNS_SERVER_LOG_MAX_LOG_FILE_DAYS: "30"
      DNS_SERVER_STATS_MAX_STAT_FILE_DAYS: "30"
    volumes:
      - ${APPDATA_TECHNITIUM_ROOT}/config:/etc/dns
      - ${APPDATA_TECHNITIUM_ROOT}/logs:/var/log/technitium/dns

networks:
  pangolin:
    external: true
  lan_macvlan:
    driver: macvlan
    driver_opts:
      parent: ${LAN_INTERFACE}
    ipam:
      config:
        - subnet: ${LAN_SUBNET}
          gateway: ${LAN_GATEWAY}