---
services:
  pihole:
    image: pihole/pihole:{{ pihole.version }}
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "67:67/udp"
    environment:
      TZ: 'Europe/Berlin'
      FTLCONF_webserver_api_password: '{{ dns.api_key }}'
      FTLCONF_dns_listeningMode: 'ALL' # recomendet for docker bridge
    volumes:
      - './data/pihole:/etc/pihole'
      - './config/etc-dnsmasq.d:/etc/dnsmasq.d'
    networks:
      - exposed
    cap_add:
      - NET_ADMIN       # For DHCP
    restart: unless-stopped
    labels:
      traefik.enable: true

      traefik.http.routers.pihole.entrypoints: https
      traefik.http.routers.pihole.rule: Host(`{{ dns.domain }}`)
      traefik.http.services.pihole.loadbalancer.server.port: 80
      traefik.http.routers.pihole.tls: "true"
      traefik.http.routers.pihole.tls.certresolver: hetzner
      traefik.http.routers.pihole.middlewares: local-only@file

networks:
    exposed:
        name: traefik_exposed
        external: true