version: '3.8'

# AdGuard Home - Network-wide DNS Ad Blocking
# Infrastructure Layer
# Ports: 53 (DNS), 3053 (Web UI)
# GPU: No
# Storage: SSD (configs and work data)

services:
  adguard:
    image: adguard/adguardhome:latest
    container_name: adguard
    restart: unless-stopped
    ports:
      - "192.168.86.149:53:53/tcp"   # DNS TCP (bound to LAN IP to avoid systemd-resolved conflict)
      - "192.168.86.149:53:53/udp"   # DNS UDP
      - "3053:3000/tcp"              # Web UI
    volumes:
      # SSD storage for configs and query logs
      - /home/jpmschweitzer/docker-data/adguard/work:/opt/adguardhome/work
      - /home/jpmschweitzer/docker-data/adguard/conf:/opt/adguardhome/conf
    environment:
      - TZ=Europe/Amsterdam
    healthcheck:
      test: ["CMD-SHELL", "nslookup localhost 127.0.0.1 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    networks:
      - docker-dataplane

networks:
  docker-dataplane:
    external: true
    name: docker-dataplane

# Setup Instructions:
# 1. Deploy this stack via Portainer
# 2. Access setup wizard at http://192.168.86.149:3053
# 3. Configure:
#    - Admin interface: Listen on port 3053, all interfaces
#    - DNS server: Listen on port 53, all interfaces
#    - Create admin username/password
# 4. After setup, configure in AdGuard Home UI:
#    - Settings → DNS settings → Upstream DNS:
#      https://dns.quad9.net/dns-query
#    - Enable "Parallel requests"
#    - Filters → DNS blocklists → Add recommended lists
# 5. Configure router DNS to 192.168.86.149
#
# Testing:
# dig @192.168.86.149 google.com          # Should resolve
# dig @192.168.86.149 ads.google.com      # Should be blocked
#
# Internal access: http://dns.schweitz.internal (requires NPM proxy + /etc/hosts entry)