# adguard-ana — the Anaheim colo's resolver.
#
# Stood up 2026-08-19 to close the gap found while designing the .internal
# naming scheme: ESH and NH3 each had an AdGuard, but colo hosts were
# resolving straight against 1.1.1.1, so the colo had no way to answer for
# internal names at all.
#
# ⚠️ PORTS DIFFER FROM THE OTHER TWO SITES. ana-docker is a busy host: :8080
# and :3000 are already taken (langfuse and friends), so AdGuard's web UI and
# API live on :8053 here, not :8080. Anything that talks to this API — notably
# scripts/dns-sync.py — reads the port from dns/internal.yaml rather than
# assuming the ESH/NH3 value.
#
# ⚠️ THIS IS NOT YET THE COLO'S RESOLVER-OF-RECORD. Standing the service up and
# repointing a whole site's DNS are two different changes with two different
# blast radii. Colo hosts still use 1.1.1.1; the cutover is a separate,
# operator-approved step. Until then this answers only what asks it directly.
#
# ESH and NH3 run their own, older, unmanaged compose files. They were left
# alone deliberately — adopting three live resolvers into this repo while also
# introducing a new naming system is two risky changes at once. Worth doing
# later, as its own piece of work.

name: adguard-ana

services:
  adguardhome:
    image: adguard/adguardhome:latest
    container_name: ${AG_CONTAINER:-adguardhome}
    restart: unless-stopped
    ports:
      - "${AG_DNS_PORT:-53}:53/tcp"
      - "${AG_DNS_PORT:-53}:53/udp"
      # Web UI + REST API. 8053, not 8080 — see the note above.
      - "${AG_WEB_PORT:-8053}:80/tcp"
    volumes:
      - adguard_work:/opt/adguardhome/work
      - adguard_conf:/opt/adguardhome/conf
    networks:
      - tnet
    labels:
      - homepage.group=DNS & Filtering
      - homepage.name=AdGuard (ANA)
      # si-adguard, matching the ESH and NH3 instances. This carried mdi-dns
      # and was the only one of the three wearing a different mark.
      - homepage.icon=si-adguard
      - homepage.description=DNS resolver + .internal zone (colo)
      - homepage.href=http://10.250.50.70:${AG_WEB_PORT:-8053}
      - homepage.siteMonitor=http://10.250.50.70:${AG_WEB_PORT:-8053}
      # Query/blocked/latency strip, same as ESH and NH3. Added 2026-08-24:
      # without it this was a short card sitting beside two tall ones, which
      # is the whole reason the DNS group exists as its own band — a group's
      # members should all carry a widget or none of them should.
      # Credential is the fleet AdGuard `infra-ops` login, which authenticates
      # against all three instances; it lives in this stack's .env on the host
      # (never in git) and is vaulted at
      # `secret get nh3-dev/adguard-infra-ops-password`.
      - homepage.widget.type=adguard
      - homepage.widget.url=http://10.250.50.70:${AG_WEB_PORT:-8053}
      - homepage.widget.username=infra-ops
      - homepage.widget.password=${ADGUARD_WIDGET_PASSWORD}

volumes:
  adguard_work: {}
  adguard_conf: {}

networks:
  tnet:
    name: traefik-net
    external: true