services:
  adguardhome:
    image: ${ADGUARD_IMAGE}
    container_name: adguardhome
    pull_policy: always
    restart: unless-stopped

    volumes:
      - /opt/adguard/work:/opt/adguardhome/work:Z
      - /opt/adguard/conf:/opt/adguardhome/conf:Z
      - adguard-cert-crt-path:/certs/adguard.crt:ro,Z
      - adguard-cert-key-path:/certs/adguard.key:ro,Z

    # Solo DNS/DoT expuestos en el host
    ports:
      # - "53:53/tcp"
      # - "53:53/udp"
      - "${ADGUARD_DOT_PORT}:853/tcp"   # DoT para Android (DNS privado)
      # - "81:80/tcp"

    networks:
      proxy:
        ipv4_address: ${ADGUARD_IPV4}

    labels:
      traefik.http.services.adguard.loadbalancer.server.port: "${ADGUARD_HTTP_PORT}"

volumes:
  adguard-cert-crt-path:
  adguard-cert-key-path:

networks:
  proxy:
    external: true