services:
  dyndns:
    image: &image git.j-mahler.de/admin/domain-control-webinterface-prod:v1.4.2
    restart: unless-stopped
    stop_grace_period: 20s
    ports: ["9090:8080"]
    volumes: ["dyndns-data:/data", "dyndns-secrets:/secrets", "dyndns-update-control:/run/domain-control-update"]
    labels: {de.j-mahler.domain-control.role: app}
    read_only: true
    tmpfs: ["/tmp:rw,noexec,nosuid,nodev,size=16m,mode=1777"]
    security_opt: [no-new-privileges:true]
    cap_drop: [ALL]

  update-agent:
    image: *image
    restart: unless-stopped
    user: "0:10001"
    command: [update-agent]
    healthcheck: {disable: true}
    network_mode: none
    volumes: ["/var/run/docker.sock:/var/run/docker.sock", "dyndns-update-control:/run/domain-control-update"]
    read_only: true
    tmpfs: ["/tmp:rw,noexec,nosuid,nodev,size=4m,mode=1777"]
    security_opt: [no-new-privileges:true]
    cap_drop: [ALL]
    pids_limit: 32
    mem_limit: 64m

volumes: {dyndns-data: {}, dyndns-secrets: {}, dyndns-update-control: {}}