services:

  # ── Traefik (example — adapt to your existing setup) ────────────────────────
  traefik:
    image: traefik:v3.1
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"   # dashboard
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    restart: unless-stopped

  # ── Hostinger DNS Sync ───────────────────────────────────────────────────────
  hostinger-dns-sync:
    build: .                       # use `image: ghcr.io/yourrepo/hostinger-dns-sync:latest` after pushing
    container_name: hostinger-dns-sync
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro   # read-only access to Docker events
    environment:
      # ── Required ──────────────────────────────────────────────────────────────
      HOSTINGER_API_KEY: ${HOSTINGER_API_KEY}           # set in .env
      DOMAIN: ${DOMAIN}                                 # e.g. example.com

      # ── Optional ──────────────────────────────────────────────────────────────
      # PUBLIC_IP: "1.2.3.4"      # override auto-detection
      RECORD_TYPE: "A"             # A or AAAA
      TTL: "3600"
      DELETE_ORPHANS: "false"      # set "true" to remove DNS records no longer in Traefik
      DRY_RUN: "false"             # set "true" to preview changes without applying them

# ── Example app (shows how Traefik labels work) ──────────────────────────────
# Uncomment to test end-to-end:
#
#   whoami:
#     image: traefik/whoami
#     labels:
#       - "traefik.enable=true"
#       - "traefik.http.routers.whoami.rule=Host(`whoami.example.com`)"
#       - "traefik.http.routers.whoami.entrypoints=web"