docs: README, changelog, contributing, security, deployment, operations, CI

docs/deployment.md

@@ -0,0 +1,89 @@
+# Deployment
+
+## Prerequisites
+
+- Samba AD DC
+- Docker host joined to the AD domain
+- Docker Swarm mode enabled
+- Traefik running with API enabled
+
+---
+
+## 1. Samba AD: Create service account and keytab
+
+On the Samba DC:
+
+    sudo samba-tool user create dns-updater --random-password
+    sudo samba-tool group addmembers DnsAdmins dns-updater
+    sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
+      --principal=dns-updater@DISCWORLD.NETWORK
+    sudo kinit -kt /etc/samba/dns-updater.keytab dns-updater@DISCWORLD.NETWORK
+    klist
+
+---
+
+## 2. Join the Docker host to the domain
+
+    sudo apt install sssd-ad sssd-tools realmd adcli krb5-user \
+      packagekit samba-common-bin libnss-sss libpam-sss
+    sudo realm join discworld.network -U administrator
+    sudo realm list
+
+---
+
+## 3. Transfer keytab and create Docker secret
+
+On the DC make the keytab readable temporarily:
+
+    sudo cp /etc/samba/dns-updater.keytab /tmp/dns-updater.keytab
+    sudo chown <youradmin>:<youradmin> /tmp/dns-updater.keytab
+
+On your local machine:
+
+    scp <dcadmin>@<dc>:/tmp/dns-updater.keytab .
+    scp dns-updater.keytab <dockeradmin>@<dockerhost>:/tmp/
+    shred -u dns-updater.keytab
+
+On the DC clean up:
+
+    sudo shred -u /tmp/dns-updater.keytab
+
+On the Docker host:
+
+    sudo docker secret create dns-updater-keytab /tmp/dns-updater.keytab
+    sudo shred -u /tmp/dns-updater.keytab
+    sudo docker secret ls
+
+---
+
+## 4. Enable Docker Swarm
+
+    sudo docker swarm init --advertise-addr <docker-host-ip>
+
+---
+
+## 5. Build and push the image
+
+    git clone https://git.ankh-morpork.discworld.network/laurence/dns-traefik-sync.git
+    cd dns-traefik-sync
+    sudo docker build -t git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest .
+    sudo docker login git.ankh-morpork.discworld.network
+    sudo docker push git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest
+
+---
+
+## 6. Deploy the stack
+
+    sudo docker stack deploy -c docker-compose.yml dns-traefik-sync
+    sudo docker stack ps dns-traefik-sync
+    sudo docker service logs dns-traefik-sync_dns-traefik-sync
+
+---
+
+## 7. Verify DNS records are being created
+
+    dig @192.168.88.1 adguard.ankh-morpork.discworld.network
+
+Or on the DC:
+
+    sudo samba-tool dns query 127.0.0.1 ankh-morpork.discworld.network @ ALL -U administrator