docs: README, changelog, contributing, security, deployment, operations, CI

docs/operations.md

@@ -0,0 +1,78 @@
+# Operations
+
+## Checking service status
+
+    sudo docker service ls
+    sudo docker stack ps dns-traefik-sync
+    sudo docker service logs dns-traefik-sync_dns-traefik-sync --follow
+
+## What healthy logs look like
+
+    2026-05-24 18:00:00 INFO dns-traefik-sync starting
+    2026-05-24 18:00:00 INFO Kerberos ticket obtained
+    2026-05-24 18:00:00 INFO Adding adguard.<DNS_ZONE> -> <TARGET_IP>
+    2026-05-24 18:01:00 INFO Kerberos ticket obtained
+    2026-05-24 18:01:00 INFO No changes
+
+## Manually verifying DNS records
+
+    dig @<DNS_SERVER_IP> grafana.<DNS_ZONE> A
+    sudo samba-tool dns query 127.0.0.1 <DNS_ZONE> @ ALL -U administrator
+
+## Forcing a re-sync
+
+    sudo docker service update --force dns-traefik-sync_dns-traefik-sync
+
+## Updating the image
+
+    cd dns-traefik-sync
+    git pull
+    sudo docker build -t <REGISTRY>/laurence/dns-traefik-sync:latest .
+    sudo docker push <REGISTRY>/laurence/dns-traefik-sync:latest
+    sudo docker service update --image \
+      <REGISTRY>/laurence/dns-traefik-sync:latest \
+      dns-traefik-sync_dns-traefik-sync
+
+## Keytab rotation
+
+On the Samba DC:
+
+    sudo samba-tool user setpassword dns-updater --random-password
+    sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
+      --principal=dns-updater@<REALM>
+
+Update the Docker secret:
+
+    sudo docker secret rm dns-updater-keytab
+    sudo docker secret create dns-updater-keytab /tmp/dns-updater.keytab
+    sudo shred -u /tmp/dns-updater.keytab
+    sudo docker stack deploy -c docker-compose.yml dns-traefik-sync
+
+## Removing a DNS record manually
+
+    sudo samba-tool dns delete 127.0.0.1 <DNS_ZONE> \
+      <hostname> A <TARGET_IP> -U administrator
+
+## Troubleshooting
+
+### kinit fails - no suitable keys
+
+Keytab is stale. Re-export on the DC:
+
+    sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
+      --principal=dns-updater@<REALM>
+
+### nsupdate fails with REFUSED
+
+dns-updater not in DnsAdmins:
+
+    sudo samba-tool group addmembers DnsAdmins dns-updater
+
+### nsupdate fails with NOTAUTH
+
+Wrong DNS_ZONE or DNS_SERVER environment variable.
+
+### Records not being created for a container
+
+Container must have a Host() rule in its Traefik label matching DNS_ZONE.
+Internal and non-docker providers are ignored.