docker-compose.yml

version: '3.2'
volumes:
    dnscrypt:
    ssl:
    nsd:
services:
  acme:
    image: neilpang/acme.sh
    command: >
      /bin/sh -c "echo \"#!/bin/sh

      set -e

      if [ -f /opt/ssl/fullchain.pem ]; then
        if openssl x509 -checkend 2592000 -noout -in /opt/ssl/fullchain.pem; then
          echo 'Certificate is still valid!'
          exit 0
        else
          echo 'Certificate has expired or will do so within 30 days!'
          echo 'Renewing...'
        fi
      fi

      export CF_Key='$$(cat /run/secrets/CF_Key)'
      export CF_Email='$$(cat /run/secrets/CF_Email)'

      #### Remember to remove '--staging' in production! ####

      acme.sh
      --issue
      --staging
      --dns dns_cf
      --dnssleep 60
      -d doh.seby.io
      --fullchain-file /opt/ssl/fullchain.pem
      --key-file /opt/ssl/key.pem
      --ca-file /opt/ssl/ca.pem
      --cert-file /opt/ssl/cert.pem
      --reloadcmd 'cat /opt/ssl/key.pem > cat /opt/ssl/fullchain.pem > /opt/ssl/fullchain-key.pem'\" > start.sh
      && chmod +x start.sh
      && ./start.sh"

    deploy:
      resources:
        reservations :
          cpus: "0.2"
          memory: 50M
      restart_policy:
        condition: none
    secrets:
      - CF_Email
      - CF_Key
    volumes:
       - ssl:/opt/ssl

  nsd:
    build: nsd
    image: publicarray/nsd
    deploy:
      replicas: 1
      resources:
        limits:
          memory: 200M
        reservations:
          cpus: '0.1'
          memory: 100M
      restart_policy:
        condition: any
        delay: 5s
    volumes:
      - nsd:/etc/nsd/run
    networks:
      - nsd-net

  unbound:
    depends_on:
      - nsd
    build: unbound
    image: publicarray/unbound
    command: munin
    deploy:
      replicas: 1
      resources:
        limits:
          memory: 300M
        reservations :
          cpus: "0.2"
          memory: 256M
      restart_policy:
        condition: any
        delay: 5s
    ports:
      - target: 4949
        published: 4949
        protocol: tcp
        mode: ingress
    networks:
      - nsd-net
      - unbound-net

  doh-proxy:
    depends_on:
      - unbound
    build: doh-proxy
    image: publicarray/doh-proxy
    deploy:
      replicas: 1
      resources:
        reservations :
          cpus: "0.1"
          memory: 10M
      restart_policy:
        condition: any
        delay: 5s
    networks:
      - unbound-net

  haproxy:
    depends_on:
      - acme
      - doh-proxy
      - unbound
    build: haproxy
    image: publicarray/haproxy
    deploy:
      replicas: 1
      resources:
        reservations :
          cpus: "0.2"
          memory: 50M
      restart_policy:
        condition: any
        delay: 5s
    ports:
    - "443:443"
    - target: 853
      published: 853
      protocol: tcp
      mode: ingress
    - target: 853
      published: 853
      protocol: udp
      mode: ingress
    volumes:
       - ssl:/opt/ssl
    networks:
      - haproxy-net
      - unbound-net

  dnscrypt-wrapper:
    depends_on:
      - unbound
    image: publicarray/dnscrypt-wrapper
    command:
      - init
      - -N
      - dns.seby.io
      - -E
      - 149.28.165.94:8443
    deploy:
      replicas: 1
      resources:
        reservations :
          cpus: "0.2"
          memory: 10M
      restart_policy:
        condition: any
        delay: 5s
    ports:
      - target: 443
        published: 8443
        protocol: tcp
        mode: ingress
      - target: 443
        published: 8443
        protocol: udp
        mode: ingress
    volumes:
       - dnscrypt:/opt/dnscrypt
    networks:
      - dnscrypt-net
      - unbound-net

secrets:
  CF_Email:
    external: true
  CF_Key:
    external: true

networks:
  dnscrypt-net:
    driver: overlay
  haproxy-net:
    driver: overlay
  nsd-net:
    driver: overlay
  unbound-net:
    driver: overlay