next ai changes

docker-compose.yml

@@ -1,42 +1,65 @@
-# RackNerd VPN hub — OpenVPN (road warriors) + Duo Auth Proxy + Unbound.
+# RackNerd VPN hub — OpenVPN (road warriors) + Duo Auth Proxy + Technitium DNS.
 #
 # All services use network_mode: host on purpose:
 #   * openvpn's tun0 must live in the host netns so the kernel can route
 #     tun0 <-> wg0 directly (wg0 is host-level wg-quick).
-#   * unbound/duo bind ONLY loopback + tunnel IPs (enforced in their own
-#     configs), so host networking exposes nothing on the public IP.
+#   * duo binds only 127.0.0.1; technitium binds wildcard, but the host
+#     firewall default-drops the public interface and the recursion ACL
+#     only allows tunnel/site networks — nothing is usable from outside.
 # Nothing here publishes ports; the host firewall (host/rules.v4.template)
 # is the single source of truth for what is reachable from where.
+#
+# The ${*_DIR:-./...} variables default to the repo layout for manual use;
+# the Ansible deploy sets them in .env to the /opt/<service> layout.
+#
+# NOTE: technitium's DNS_SERVER_* env vars only seed config on FIRST start
+# (empty config dir). After that, change settings in the web console —
+# or wipe ${TECHNITIUM_DIR}/config to re-seed.
 
 name: racknerd-vpnhub
 
 services:
-  unbound:
-    build: ./unbound
-    container_name: unbound
+  technitium:
+    # Pin a version (e.g. :13.6.0) for controlled upgrades
+    image: technitium/dns-server:latest
+    container_name: technitium
+    network_mode: host
+    environment:
+      - DNS_SERVER_DOMAIN=vpnhub
+      - DNS_SERVER_ADMIN_PASSWORD=${TECHNITIUM_ADMIN_PASSWORD}
+      - DNS_SERVER_WEB_SERVICE_HTTP_PORT=5380
+      - DNS_SERVER_RECURSION=UseSpecifiedNetworkACL
+      - DNS_SERVER_RECURSION_NETWORK_ACL=127.0.0.0/8,172.31.8.0/24,172.31.255.0/24,192.168.20.0/24,192.168.7.0/24
+    volumes:
+      - ${TECHNITIUM_DIR:-./technitium}/config:/etc/dns
+    restart: unless-stopped
+
+  technitium-init:
+    build: ${TECHNITIUM_DIR:-./technitium}
+    container_name: technitium-init
     network_mode: host
     env_file: .env
-    volumes:
-      - ./unbound/unbound.conf.template:/etc/unbound/unbound.conf.template:ro
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD", "dig", "@127.0.0.1", "+time=3", "+tries=1", "cloudflare.com"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
+    depends_on:
+      - technitium
+    restart: "no"
 
   duo-authproxy:
-    build: ./duo-authproxy
+    build:
+      context: ${DUO_DIR:-./duo-authproxy}
+      args:
+        # Pin a version (e.g. "6.5.1") to get deterministic updates —
+        # bumping it busts the Docker layer cache and refetches the tarball.
+        DUO_VERSION: ${DUO_AUTHPROXY_VERSION:-latest}
     container_name: duo-authproxy
     network_mode: host          # RADIUS listener bound to 127.0.0.1:1812 only
     env_file: .env
     volumes:
       # AD LDAPS issuing-CA chain, exported from your CA (see certs/README.md)
-      - ./duo-authproxy/certs:/certs:ro
+      - ${DUO_DIR:-./duo-authproxy}/certs:/certs:ro
     restart: unless-stopped
 
   openvpn:
-    build: ./openvpn
+    build: ${OPENVPN_DIR:-./openvpn}
     container_name: openvpn
     network_mode: host          # creates tun0 in the host netns
     cap_add:
@@ -45,12 +68,12 @@ services:
       - /dev/net/tun
     env_file: .env
     volumes:
-      - ./openvpn/server.conf:/etc/openvpn/server.conf:ro
-      - ./openvpn/pki:/etc/openvpn/pki:ro
+      - ${OPENVPN_DIR:-./openvpn}/server.conf:/etc/openvpn/server.conf:ro
+      - ${OPENVPN_DIR:-./openvpn}/pki:/etc/openvpn/pki:ro
       - openvpn-state:/var/lib/openvpn
     depends_on:
       - duo-authproxy
-      - unbound
+      - technitium
     restart: unless-stopped
 
 volumes: