laurence/dns-traefik-sync
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: laurence:69048df8640ece0aa80505f0acfacf2f70e5fb56
Branches Tags
laurence:main
laurence:v1.0.0
...
compare: laurence:a0a588f63bd3914ad91414228d2e7216f0335580
Branches Tags
laurence:main
laurence:v1.0.0

No commits in common. "69048df8640ece0aa80505f0acfacf2f70e5fb56" and "a0a588f63bd3914ad91414228d2e7216f0335580" have entirely different histories.
69048df864 ... a0a588f63b

8 changed files with 44 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

4
.gitea/workflows/build.yml
View file

@ -24,7 +24,7 @@ jobs:
if: github.event_name != 'pull_request'
uses: docker/login-action@v3
with:
registry: <REGISTRY>
registry: git.ankh-morpork.discworld.network
username: ${{ secrets.REGISTRY_USERNAME }}
password: ${{ secrets.REGISTRY_PASSWORD }}
@ -32,7 +32,7 @@ jobs:
id: meta
uses: docker/metadata-action@v5
with:
images: <REGISTRY>/laurence/dns-traefik-sync
images: git.ankh-morpork.discworld.network/laurence/dns-traefik-sync
tags: |
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}

2
CONTRIBUTING.md
View file

@ -4,7 +4,7 @@
Clone the repo and set up a venv:
git clone https://<REGISTRY>/laurence/dns-traefik-sync.git
git clone https://git.ankh-morpork.discworld.network/laurence/dns-traefik-sync.git
cd dns-traefik-sync
python3 -m venv venv
source venv/bin/activate

10
README.md
View file

@ -37,14 +37,14 @@ All configuration via environment variables:
| Variable | Default | Description |
|------------------|------------------------------------|------------------------------------|
| TRAEFIK_API | http://<TARGET_IP>:8080 | Traefik API base URL |
| DNS_SERVER | <DNS_SERVER_IP> | Samba AD DNS server IP |
| DNS_ZONE | <DNS_ZONE> | Zone to manage records in |
| TARGET_IP | <TARGET_IP> | IP address for created A records |
| TRAEFIK_API | http://192.168.88.2:8080 | Traefik API base URL |
| DNS_SERVER | 192.168.88.1 | Samba AD DNS server IP |
| DNS_ZONE | ankh-morpork.discworld.network | Zone to manage records in |
| TARGET_IP | 192.168.88.2 | IP address for created A records |
| TTL | 300 | TTL for created records (seconds) |
| POLL_INTERVAL | 60 | Poll interval (seconds) |
| KEYTAB | /run/secrets/dns-updater-keytab | Path to Kerberos keytab |
| KRB_PRINCIPAL | dns-updater@<REALM> | Kerberos principal |
| KRB_PRINCIPAL | dns-updater@DISCWORLD.NETWORK | Kerberos principal |
| STATE_FILE | /tmp/dns_state.json | State persistence path |
## Deployment

10
dns_sync.py
View file

@ -14,14 +14,14 @@ logging.basicConfig(
)
log = logging.getLogger(__name__)
TRAEFIK_API = os.environ.get('TRAEFIK_API', 'http://<TARGET_IP>:8080')
DNS_SERVER = os.environ.get('DNS_SERVER', '<DNS_SERVER_IP>')
DNS_ZONE = os.environ.get('DNS_ZONE', '<DNS_ZONE>')
TARGET_IP = os.environ.get('TARGET_IP', '<TARGET_IP>')
TRAEFIK_API = os.environ.get('TRAEFIK_API', 'http://192.168.88.2:8080')
DNS_SERVER = os.environ.get('DNS_SERVER', '192.168.88.1')
DNS_ZONE = os.environ.get('DNS_ZONE', 'ankh-morpork.discworld.network')
TARGET_IP = os.environ.get('TARGET_IP', '192.168.88.2')
TTL = int(os.environ.get('TTL', '300'))
POLL_INTERVAL = int(os.environ.get('POLL_INTERVAL', '60'))
KEYTAB = os.environ.get('KEYTAB', '/run/secrets/dns-updater-keytab')
KRB_PRINCIPAL = os.environ.get('KRB_PRINCIPAL', 'dns-updater@<REALM>')
KRB_PRINCIPAL = os.environ.get('KRB_PRINCIPAL', 'dns-updater@DISCWORLD.NETWORK')
STATE_FILE = os.environ.get('STATE_FILE', '/tmp/dns_state.json')
def kinit():

12
docker-compose.yml
View file

@ -2,16 +2,16 @@ version: "3.8"
services:
dns-traefik-sync:
image: <REGISTRY>/laurence/dns-traefik-sync:latest
image: git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest
environment:
TRAEFIK_API: "http://<TARGET_IP>:8080"
DNS_SERVER: "<DNS_SERVER_IP>"
DNS_ZONE: "<DNS_ZONE>"
TARGET_IP: "<TARGET_IP>"
TRAEFIK_API: "http://192.168.88.2:8080"
DNS_SERVER: "192.168.88.1"
DNS_ZONE: "ankh-morpork.discworld.network"
TARGET_IP: "192.168.88.2"
TTL: "300"
POLL_INTERVAL: "60"
KEYTAB: "/run/secrets/dns-updater-keytab"
KRB_PRINCIPAL: "dns-updater@<REALM>"
KRB_PRINCIPAL: "dns-updater@DISCWORLD.NETWORK"
secrets:
- dns-updater-keytab
restart: unless-stopped

18
docs/deployment.md
View file

@ -16,8 +16,8 @@ On the Samba DC:
sudo samba-tool user create dns-updater --random-password
sudo samba-tool group addmembers DnsAdmins dns-updater
sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
--principal=dns-updater@<REALM>
sudo kinit -kt /etc/samba/dns-updater.keytab dns-updater@<REALM>
--principal=dns-updater@DISCWORLD.NETWORK
sudo kinit -kt /etc/samba/dns-updater.keytab dns-updater@DISCWORLD.NETWORK
klist
---
@ -26,7 +26,7 @@ On the Samba DC:
sudo apt install sssd-ad sssd-tools realmd adcli krb5-user \
packagekit samba-common-bin libnss-sss libpam-sss
sudo realm join <DOMAIN> -U administrator
sudo realm join discworld.network -U administrator
sudo realm list
---
@ -64,11 +64,11 @@ On the Docker host:
## 5. Build and push the image
git clone https://<REGISTRY>/laurence/dns-traefik-sync.git
git clone https://git.ankh-morpork.discworld.network/laurence/dns-traefik-sync.git
cd dns-traefik-sync
sudo docker build -t <REGISTRY>/laurence/dns-traefik-sync:latest .
sudo docker login <REGISTRY>
sudo docker push <REGISTRY>/laurence/dns-traefik-sync:latest
sudo docker build -t git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest .
sudo docker login git.ankh-morpork.discworld.network
sudo docker push git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest
---
@ -82,8 +82,8 @@ On the Docker host:
## 7. Verify DNS records are being created
dig @<DNS_SERVER_IP> adguard.<DNS_ZONE>
dig @192.168.88.1 adguard.ankh-morpork.discworld.network
Or on the DC:
sudo samba-tool dns query 127.0.0.1 <DNS_ZONE> @ ALL -U administrator
sudo samba-tool dns query 127.0.0.1 ankh-morpork.discworld.network @ ALL -U administrator

20
docs/operations.md
View file

@ -10,14 +10,14 @@
2026-05-24 18:00:00 INFO dns-traefik-sync starting
2026-05-24 18:00:00 INFO Kerberos ticket obtained
2026-05-24 18:00:00 INFO Adding adguard.<DNS_ZONE> -> <TARGET_IP>
2026-05-24 18:00:00 INFO Adding adguard.ankh-morpork.discworld.network -> 192.168.88.2
2026-05-24 18:01:00 INFO Kerberos ticket obtained
2026-05-24 18:01:00 INFO No changes
## Manually verifying DNS records
dig @<DNS_SERVER_IP> grafana.<DNS_ZONE> A
sudo samba-tool dns query 127.0.0.1 <DNS_ZONE> @ ALL -U administrator
dig @192.168.88.1 grafana.ankh-morpork.discworld.network A
sudo samba-tool dns query 127.0.0.1 ankh-morpork.discworld.network @ ALL -U administrator
## Forcing a re-sync
@ -27,10 +27,10 @@
cd dns-traefik-sync
git pull
sudo docker build -t <REGISTRY>/laurence/dns-traefik-sync:latest .
sudo docker push <REGISTRY>/laurence/dns-traefik-sync:latest
sudo docker build -t git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest .
sudo docker push git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest
sudo docker service update --image \
<REGISTRY>/laurence/dns-traefik-sync:latest \
git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest \
dns-traefik-sync_dns-traefik-sync
## Keytab rotation
@ -39,7 +39,7 @@ On the Samba DC:
sudo samba-tool user setpassword dns-updater --random-password
sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
--principal=dns-updater@<REALM>
--principal=dns-updater@DISCWORLD.NETWORK
Update the Docker secret:
@ -50,8 +50,8 @@ Update the Docker secret:
## Removing a DNS record manually
sudo samba-tool dns delete 127.0.0.1 <DNS_ZONE> \
<hostname> A <TARGET_IP> -U administrator
sudo samba-tool dns delete 127.0.0.1 ankh-morpork.discworld.network \
<hostname> A 192.168.88.2 -U administrator
## Troubleshooting
@ -60,7 +60,7 @@ Update the Docker secret:
Keytab is stale. Re-export on the DC:
sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
--principal=dns-updater@<REALM>
--principal=dns-updater@DISCWORLD.NETWORK
### nsupdate fails with REFUSED

12
krb5.conf
View file

@ -1,14 +1,14 @@
[libdefaults]
default_realm = <REALM>
default_realm = DISCWORLD.NETWORK
dns_lookup_realm = false
dns_lookup_kdc = true
[realms]
<REALM> = {
kdc = <DNS_SERVER_IP>
admin_server = <DNS_SERVER_IP>
DISCWORLD.NETWORK = {
kdc = 192.168.88.1
admin_server = 192.168.88.1
}
[domain_realm]
.<DOMAIN> = <REALM>
<DOMAIN> = <REALM>
.discworld.network = DISCWORLD.NETWORK
discworld.network = DISCWORLD.NETWORK