services:
  adguardhome:
    image: ${ADGUARD_IMAGE}
    container_name: adguardhome
    pull_policy: always
    restart: unless-stopped

    volumes:
      - ${ADGUARD_WORK_PATH}:/opt/adguardhome/work:Z
      - ${ADGUARD_CONF_PATH}:/opt/adguardhome/conf:Z
      - ${ADGUARD_CERT_CRT_PATH}:/certs/adguard.crt:ro,Z
      - ${ADGUARD_CERT_KEY_PATH}:/certs/adguard.key:ro,Z

    # Solo DNS/DoT expuestos en el host
    ports:
      # - "53:53/tcp"
      # - "53:53/udp"
      - "${ADGUARD_DOT_PORT}:853/tcp"   # DoT para Android (DNS privado)
      # - "81:80/tcp"

    networks:
      proxy:
        ipv4_address: ${ADGUARD_IPV4}

    labels:
      traefik.http.services.adguard.loadbalancer.server.port: "${ADGUARD_HTTP_PORT}"

networks:
  proxy:
    external: true