version: "3.9"

networks:
  public:
    external: true
  dns_net:
    name: dns_net
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16

services:
  pihole:
    image: pihole/pihole:latest
    container_name: pihole
    restart: always
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      # - "8180:80/tcp"
    hostname: pihole
    networks:
      public: {}
      dns_net:
        ipv4_address: 172.20.0.10
    environment:
      - "TZ=Asia/Singapore"
      - "WEBPASSWORD=${PIHOLE_PASSWORD}"
      - "DNS1=172.20.0.11#5335"
      - "DNS2=no"
      - "DNSMASQ_USER=root"
    volumes:
      - "./pihole-data/:/etc/pihole/"
      - "./dnsmasq.d-data/:/etc/dnsmasq.d/"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pihole.rule=Host(`${PIHOLE_DOMAIN}`)"
      - "traefik.http.routers.pihole.service=pihole-service"
      - "traefik.http.services.pihole-service.loadbalancer.server.port=80"
      - "traefik.http.routers.pihole.tls=true"
      - "traefik.http.routers.pihole.tls.certresolver=le"
      # - "traefik.http.middlewares.pihole-admin.addprefix.prefix=/admin"
      - "traefik.http.middlewares.pihole-redirect.redirectregex.regex=^https://pihole.ykz.app/$$"
      - "traefik.http.middlewares.pihole-redirect.redirectregex.replacement=https://pihole.ykz.app/admin"
      - "traefik.http.middlewares.pihole-redirect.redirectregex.permanent=true"
      - "traefik.http.routers.pihole.middlewares=pihole-redirect"

  unbound:
    image: mvance/unbound${IS_RPI}:latest
    container_name: unbound
    restart: always
    volumes:
      - "./unbound-data:/opt/unbound/etc/unbound"
    networks:
      dns_net:
        ipv4_address: 172.20.0.11
    healthcheck:
      disable: true