laurence/dns-traefik-sync
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: laurence:69048df8640ece0aa80505f0acfacf2f70e5fb56
Branches Tags
laurence:main
laurence:v1.0.0
..
compare: laurence:a0a588f63bd3914ad91414228d2e7216f0335580
Branches Tags
laurence:main
laurence:v1.0.0

No commits in common. "69048df8640ece0aa80505f0acfacf2f70e5fb56" and "a0a588f63bd3914ad91414228d2e7216f0335580" have entirely different histories.
69048df864 ... a0a588f63b

8 changed files with 44 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

4
.gitea/workflows/build.yml
View file

@ -24,7 +24,7 @@ jobs:
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
uses: docker/login-action@v3 uses: docker/login-action@v3
with: with:
registry: <REGISTRY> registry: git.ankh-morpork.discworld.network
username: ${{ secrets.REGISTRY_USERNAME }} username: ${{ secrets.REGISTRY_USERNAME }}
password: ${{ secrets.REGISTRY_PASSWORD }} password: ${{ secrets.REGISTRY_PASSWORD }}
@ -32,7 +32,7 @@ jobs:
id: meta id: meta
uses: docker/metadata-action@v5 uses: docker/metadata-action@v5
with: with:
images: <REGISTRY>/laurence/dns-traefik-sync images: git.ankh-morpork.discworld.network/laurence/dns-traefik-sync
tags: | tags: |
type=semver,pattern={{version}} type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}} type=semver,pattern={{major}}.{{minor}}

2
CONTRIBUTING.md
View file

@ -4,7 +4,7 @@
Clone the repo and set up a venv: Clone the repo and set up a venv:
git clone https://<REGISTRY>/laurence/dns-traefik-sync.git git clone https://git.ankh-morpork.discworld.network/laurence/dns-traefik-sync.git
cd dns-traefik-sync cd dns-traefik-sync
python3 -m venv venv python3 -m venv venv
source venv/bin/activate source venv/bin/activate

10
README.md
View file

@ -37,14 +37,14 @@ All configuration via environment variables:
| Variable | Default | Description | | Variable | Default | Description |
|------------------|------------------------------------|------------------------------------| |------------------|------------------------------------|------------------------------------|
| TRAEFIK_API | http://<TARGET_IP>:8080 | Traefik API base URL | | TRAEFIK_API | http://192.168.88.2:8080 | Traefik API base URL |
| DNS_SERVER | <DNS_SERVER_IP> | Samba AD DNS server IP | | DNS_SERVER | 192.168.88.1 | Samba AD DNS server IP |
| DNS_ZONE | <DNS_ZONE> | Zone to manage records in | | DNS_ZONE | ankh-morpork.discworld.network | Zone to manage records in |
| TARGET_IP | <TARGET_IP> | IP address for created A records | | TARGET_IP | 192.168.88.2 | IP address for created A records |
| TTL | 300 | TTL for created records (seconds) | | TTL | 300 | TTL for created records (seconds) |
| POLL_INTERVAL | 60 | Poll interval (seconds) | | POLL_INTERVAL | 60 | Poll interval (seconds) |
| KEYTAB | /run/secrets/dns-updater-keytab | Path to Kerberos keytab | | KEYTAB | /run/secrets/dns-updater-keytab | Path to Kerberos keytab |
| KRB_PRINCIPAL | dns-updater@<REALM> | Kerberos principal | | KRB_PRINCIPAL | dns-updater@DISCWORLD.NETWORK | Kerberos principal |
| STATE_FILE | /tmp/dns_state.json | State persistence path | | STATE_FILE | /tmp/dns_state.json | State persistence path |
## Deployment ## Deployment

10
dns_sync.py
View file

@ -14,14 +14,14 @@ logging.basicConfig(
) )
log = logging.getLogger(__name__) log = logging.getLogger(__name__)
TRAEFIK_API = os.environ.get('TRAEFIK_API', 'http://<TARGET_IP>:8080') TRAEFIK_API = os.environ.get('TRAEFIK_API', 'http://192.168.88.2:8080')
DNS_SERVER = os.environ.get('DNS_SERVER', '<DNS_SERVER_IP>') DNS_SERVER = os.environ.get('DNS_SERVER', '192.168.88.1')
DNS_ZONE = os.environ.get('DNS_ZONE', '<DNS_ZONE>') DNS_ZONE = os.environ.get('DNS_ZONE', 'ankh-morpork.discworld.network')
TARGET_IP = os.environ.get('TARGET_IP', '<TARGET_IP>') TARGET_IP = os.environ.get('TARGET_IP', '192.168.88.2')
TTL = int(os.environ.get('TTL', '300')) TTL = int(os.environ.get('TTL', '300'))
POLL_INTERVAL = int(os.environ.get('POLL_INTERVAL', '60')) POLL_INTERVAL = int(os.environ.get('POLL_INTERVAL', '60'))
KEYTAB = os.environ.get('KEYTAB', '/run/secrets/dns-updater-keytab') KEYTAB = os.environ.get('KEYTAB', '/run/secrets/dns-updater-keytab')
KRB_PRINCIPAL = os.environ.get('KRB_PRINCIPAL', 'dns-updater@<REALM>') KRB_PRINCIPAL = os.environ.get('KRB_PRINCIPAL', 'dns-updater@DISCWORLD.NETWORK')
STATE_FILE = os.environ.get('STATE_FILE', '/tmp/dns_state.json') STATE_FILE = os.environ.get('STATE_FILE', '/tmp/dns_state.json')
def kinit(): def kinit():

12
docker-compose.yml
View file

@ -2,16 +2,16 @@ version: "3.8"
services: services:
dns-traefik-sync: dns-traefik-sync:
image: <REGISTRY>/laurence/dns-traefik-sync:latest image: git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest
environment: environment:
TRAEFIK_API: "http://<TARGET_IP>:8080" TRAEFIK_API: "http://192.168.88.2:8080"
DNS_SERVER: "<DNS_SERVER_IP>" DNS_SERVER: "192.168.88.1"
DNS_ZONE: "<DNS_ZONE>" DNS_ZONE: "ankh-morpork.discworld.network"
TARGET_IP: "<TARGET_IP>" TARGET_IP: "192.168.88.2"
TTL: "300" TTL: "300"
POLL_INTERVAL: "60" POLL_INTERVAL: "60"
KEYTAB: "/run/secrets/dns-updater-keytab" KEYTAB: "/run/secrets/dns-updater-keytab"
KRB_PRINCIPAL: "dns-updater@<REALM>" KRB_PRINCIPAL: "dns-updater@DISCWORLD.NETWORK"
secrets: secrets:
- dns-updater-keytab - dns-updater-keytab
restart: unless-stopped restart: unless-stopped

18
docs/deployment.md
View file

@ -16,8 +16,8 @@ On the Samba DC:
sudo samba-tool user create dns-updater --random-password sudo samba-tool user create dns-updater --random-password
sudo samba-tool group addmembers DnsAdmins dns-updater sudo samba-tool group addmembers DnsAdmins dns-updater
sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \ sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
--principal=dns-updater@<REALM> --principal=dns-updater@DISCWORLD.NETWORK
sudo kinit -kt /etc/samba/dns-updater.keytab dns-updater@<REALM> sudo kinit -kt /etc/samba/dns-updater.keytab dns-updater@DISCWORLD.NETWORK
klist klist
--- ---
@ -26,7 +26,7 @@ On the Samba DC:
sudo apt install sssd-ad sssd-tools realmd adcli krb5-user \ sudo apt install sssd-ad sssd-tools realmd adcli krb5-user \
packagekit samba-common-bin libnss-sss libpam-sss packagekit samba-common-bin libnss-sss libpam-sss
sudo realm join <DOMAIN> -U administrator sudo realm join discworld.network -U administrator
sudo realm list sudo realm list
--- ---
@ -64,11 +64,11 @@ On the Docker host:
## 5. Build and push the image ## 5. Build and push the image
git clone https://<REGISTRY>/laurence/dns-traefik-sync.git git clone https://git.ankh-morpork.discworld.network/laurence/dns-traefik-sync.git
cd dns-traefik-sync cd dns-traefik-sync
sudo docker build -t <REGISTRY>/laurence/dns-traefik-sync:latest . sudo docker build -t git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest .
sudo docker login <REGISTRY> sudo docker login git.ankh-morpork.discworld.network
sudo docker push <REGISTRY>/laurence/dns-traefik-sync:latest sudo docker push git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest
--- ---
@ -82,8 +82,8 @@ On the Docker host:
## 7. Verify DNS records are being created ## 7. Verify DNS records are being created
dig @<DNS_SERVER_IP> adguard.<DNS_ZONE> dig @192.168.88.1 adguard.ankh-morpork.discworld.network
Or on the DC: Or on the DC:
sudo samba-tool dns query 127.0.0.1 <DNS_ZONE> @ ALL -U administrator sudo samba-tool dns query 127.0.0.1 ankh-morpork.discworld.network @ ALL -U administrator

20
docs/operations.md
View file

@ -10,14 +10,14 @@
2026-05-24 18:00:00 INFO dns-traefik-sync starting 2026-05-24 18:00:00 INFO dns-traefik-sync starting
2026-05-24 18:00:00 INFO Kerberos ticket obtained 2026-05-24 18:00:00 INFO Kerberos ticket obtained
2026-05-24 18:00:00 INFO Adding adguard.<DNS_ZONE> -> <TARGET_IP> 2026-05-24 18:00:00 INFO Adding adguard.ankh-morpork.discworld.network -> 192.168.88.2
2026-05-24 18:01:00 INFO Kerberos ticket obtained 2026-05-24 18:01:00 INFO Kerberos ticket obtained
2026-05-24 18:01:00 INFO No changes 2026-05-24 18:01:00 INFO No changes
## Manually verifying DNS records ## Manually verifying DNS records
dig @<DNS_SERVER_IP> grafana.<DNS_ZONE> A dig @192.168.88.1 grafana.ankh-morpork.discworld.network A
sudo samba-tool dns query 127.0.0.1 <DNS_ZONE> @ ALL -U administrator sudo samba-tool dns query 127.0.0.1 ankh-morpork.discworld.network @ ALL -U administrator
## Forcing a re-sync ## Forcing a re-sync
@ -27,10 +27,10 @@
cd dns-traefik-sync cd dns-traefik-sync
git pull git pull
sudo docker build -t <REGISTRY>/laurence/dns-traefik-sync:latest . sudo docker build -t git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest .
sudo docker push <REGISTRY>/laurence/dns-traefik-sync:latest sudo docker push git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest
sudo docker service update --image \ sudo docker service update --image \
<REGISTRY>/laurence/dns-traefik-sync:latest \ git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest \
dns-traefik-sync_dns-traefik-sync dns-traefik-sync_dns-traefik-sync
## Keytab rotation ## Keytab rotation
@ -39,7 +39,7 @@ On the Samba DC:
sudo samba-tool user setpassword dns-updater --random-password sudo samba-tool user setpassword dns-updater --random-password
sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \ sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
--principal=dns-updater@<REALM> --principal=dns-updater@DISCWORLD.NETWORK
Update the Docker secret: Update the Docker secret:
@ -50,8 +50,8 @@ Update the Docker secret:
## Removing a DNS record manually ## Removing a DNS record manually
sudo samba-tool dns delete 127.0.0.1 <DNS_ZONE> \ sudo samba-tool dns delete 127.0.0.1 ankh-morpork.discworld.network \
<hostname> A <TARGET_IP> -U administrator <hostname> A 192.168.88.2 -U administrator
## Troubleshooting ## Troubleshooting
@ -60,7 +60,7 @@ Update the Docker secret:
Keytab is stale. Re-export on the DC: Keytab is stale. Re-export on the DC:
sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \ sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
--principal=dns-updater@<REALM> --principal=dns-updater@DISCWORLD.NETWORK
### nsupdate fails with REFUSED ### nsupdate fails with REFUSED

12
krb5.conf
View file

@ -1,14 +1,14 @@
[libdefaults] [libdefaults]
default_realm = <REALM> default_realm = DISCWORLD.NETWORK
dns_lookup_realm = false dns_lookup_realm = false
dns_lookup_kdc = true dns_lookup_kdc = true
[realms] [realms]
<REALM> = { DISCWORLD.NETWORK = {
kdc = <DNS_SERVER_IP> kdc = 192.168.88.1
admin_server = <DNS_SERVER_IP> admin_server = 192.168.88.1
} }
[domain_realm] [domain_realm]
.<DOMAIN> = <REALM> .discworld.network = DISCWORLD.NETWORK
<DOMAIN> = <REALM> discworld.network = DISCWORLD.NETWORK