x-domain-control-image: &domain-control-image
  image: git.j-mahler.de/admin/domain-control-webinterface-prod:v1.3.0

services:
  dyndns:
    <<: *domain-control-image
    restart: unless-stopped
    ports:
      - "9090:8080"
    volumes:
      - dyndns-data:/data
      - dyndns-secrets:/secrets
      - dyndns-update-control:/run/domain-control-update
    labels:
      de.j-mahler.domain-control.role: app
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=16m,mode=1777
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

  update-agent:
    <<: *domain-control-image
    restart: unless-stopped
    user: "0:10001"
    entrypoint:
      - /usr/local/bin/update-agent
    healthcheck:
      disable: true
    network_mode: none
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - dyndns-update-control:/run/domain-control-update
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=4m,mode=1777
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    pids_limit: 32
    mem_limit: 64m

volumes:
  dyndns-data:
  dyndns-secrets:
  dyndns-update-control: