networks:
  DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
    external: true

services:
  unbound-service: #LIBREPORTAL|SERVICE_TAG_1|unbound-service
    container_name: unbound-service
    image: madnuttah/unbound:latest #LIBREPORTAL|UNBOUND_VERSION_TAG|latest
    restart: unless-stopped
    hostname: unbound
    # GLUETUN_OFF_BEGIN
    ports:
      - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
      - "PORTS_DATA_2" #LIBREPORTAL|PORTS_TAG_2|PORTS_DATA_2
    # GLUETUN_OFF_END
    # No traefik labels: Unbound has no web interface, it is a resolver other
    # apps point at. The category/title labels are the ones the portal reads.
    labels:
      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
    volumes:
      - SOCKET_DATA #LIBREPORTAL|SOCKET_TAG|SOCKET_DATA
      - /etc/ssl/certs:/etc/ssl/certs:ro
      # A drop-in, not a replacement: the image's own unbound.conf carries
      # `include-toplevel: /usr/local/unbound/conf.d/*.conf`, so ours adds to a
      # working recursive config maintained upstream instead of overriding it.
      # (The old image wanted a full config at /opt/unbound/etc/unbound — a
      # different path entirely, which is why this could not be a tag swap.)
      - "./conf.d:/usr/local/unbound/conf.d:ro"
    environment:
      - TZ=TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
    healthcheck:
      disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
    # GLUETUN_OFF_BEGIN
    networks:
      DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
        ipv4_address: IP_DATA_1 #LIBREPORTAL|IP_TAG_1|IP_DATA_1
    # GLUETUN_OFF_END
    # GLUETUN_ON_BEGIN
    # network_mode: "container:gluetun-service"
    # GLUETUN_ON_END

  # >>> libreportal-monitoring >>>
  #unbound-exporter:
  #  container_name: unbound-exporter
  #  image: letsencrypt/unbound-exporter:latest
  #  restart: unless-stopped
  #  depends_on:
  #    - unbound-service
  #  command:
  #    - "-unbound.host=tcp://unbound-service:8953"
  #    - "-web.listen-address=:PORT_INTERNAL_DATA_3" #LIBREPORTAL|PORT_INTERNAL_TAG_3|PORT_INTERNAL_DATA_3
  #  networks:
  #    DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
  # <<< libreportal-monitoring <<<