diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index 165ea46..60c7255 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -24,7 +24,7 @@ jobs: if: github.event_name != 'pull_request' uses: docker/login-action@v3 with: - registry: git.ankh-morpork.discworld.network + registry: username: ${{ secrets.REGISTRY_USERNAME }} password: ${{ secrets.REGISTRY_PASSWORD }} @@ -32,7 +32,7 @@ jobs: id: meta uses: docker/metadata-action@v5 with: - images: git.ankh-morpork.discworld.network/laurence/dns-traefik-sync + images: /laurence/dns-traefik-sync tags: | type=semver,pattern={{version}} type=semver,pattern={{major}}.{{minor}} diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 98328f8..bb3add8 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -4,7 +4,7 @@ Clone the repo and set up a venv: - git clone https://git.ankh-morpork.discworld.network/laurence/dns-traefik-sync.git + git clone https:///laurence/dns-traefik-sync.git cd dns-traefik-sync python3 -m venv venv source venv/bin/activate diff --git a/README.md b/README.md index eab3ddf..06e83b3 100644 --- a/README.md +++ b/README.md @@ -37,14 +37,14 @@ All configuration via environment variables: | Variable | Default | Description | |------------------|------------------------------------|------------------------------------| -| TRAEFIK_API | http://192.168.88.2:8080 | Traefik API base URL | -| DNS_SERVER | 192.168.88.1 | Samba AD DNS server IP | -| DNS_ZONE | ankh-morpork.discworld.network | Zone to manage records in | -| TARGET_IP | 192.168.88.2 | IP address for created A records | +| TRAEFIK_API | http://:8080 | Traefik API base URL | +| DNS_SERVER | | Samba AD DNS server IP | +| DNS_ZONE | | Zone to manage records in | +| TARGET_IP | | IP address for created A records | | TTL | 300 | TTL for created records (seconds) | | POLL_INTERVAL | 60 | Poll interval (seconds) | | KEYTAB | /run/secrets/dns-updater-keytab | Path to Kerberos keytab | -| KRB_PRINCIPAL | dns-updater@DISCWORLD.NETWORK | Kerberos principal | +| KRB_PRINCIPAL | dns-updater@ | Kerberos principal | | STATE_FILE | /tmp/dns_state.json | State persistence path | ## Deployment diff --git a/dns_sync.py b/dns_sync.py index 59387c6..253c11c 100644 --- a/dns_sync.py +++ b/dns_sync.py @@ -14,14 +14,14 @@ logging.basicConfig( ) log = logging.getLogger(__name__) -TRAEFIK_API = os.environ.get('TRAEFIK_API', 'http://192.168.88.2:8080') -DNS_SERVER = os.environ.get('DNS_SERVER', '192.168.88.1') -DNS_ZONE = os.environ.get('DNS_ZONE', 'ankh-morpork.discworld.network') -TARGET_IP = os.environ.get('TARGET_IP', '192.168.88.2') +TRAEFIK_API = os.environ.get('TRAEFIK_API', 'http://:8080') +DNS_SERVER = os.environ.get('DNS_SERVER', '') +DNS_ZONE = os.environ.get('DNS_ZONE', '') +TARGET_IP = os.environ.get('TARGET_IP', '') TTL = int(os.environ.get('TTL', '300')) POLL_INTERVAL = int(os.environ.get('POLL_INTERVAL', '60')) KEYTAB = os.environ.get('KEYTAB', '/run/secrets/dns-updater-keytab') -KRB_PRINCIPAL = os.environ.get('KRB_PRINCIPAL', 'dns-updater@DISCWORLD.NETWORK') +KRB_PRINCIPAL = os.environ.get('KRB_PRINCIPAL', 'dns-updater@') STATE_FILE = os.environ.get('STATE_FILE', '/tmp/dns_state.json') def kinit(): diff --git a/docker-compose.yml b/docker-compose.yml index 67be072..fb9bf51 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -2,16 +2,16 @@ version: "3.8" services: dns-traefik-sync: - image: git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest + image: /laurence/dns-traefik-sync:latest environment: - TRAEFIK_API: "http://192.168.88.2:8080" - DNS_SERVER: "192.168.88.1" - DNS_ZONE: "ankh-morpork.discworld.network" - TARGET_IP: "192.168.88.2" + TRAEFIK_API: "http://:8080" + DNS_SERVER: "" + DNS_ZONE: "" + TARGET_IP: "" TTL: "300" POLL_INTERVAL: "60" KEYTAB: "/run/secrets/dns-updater-keytab" - KRB_PRINCIPAL: "dns-updater@DISCWORLD.NETWORK" + KRB_PRINCIPAL: "dns-updater@" secrets: - dns-updater-keytab restart: unless-stopped diff --git a/docs/deployment.md b/docs/deployment.md index ec35f53..c8b6bc1 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -16,8 +16,8 @@ On the Samba DC: sudo samba-tool user create dns-updater --random-password sudo samba-tool group addmembers DnsAdmins dns-updater sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \ - --principal=dns-updater@DISCWORLD.NETWORK - sudo kinit -kt /etc/samba/dns-updater.keytab dns-updater@DISCWORLD.NETWORK + --principal=dns-updater@ + sudo kinit -kt /etc/samba/dns-updater.keytab dns-updater@ klist --- @@ -26,7 +26,7 @@ On the Samba DC: sudo apt install sssd-ad sssd-tools realmd adcli krb5-user \ packagekit samba-common-bin libnss-sss libpam-sss - sudo realm join discworld.network -U administrator + sudo realm join -U administrator sudo realm list --- @@ -64,11 +64,11 @@ On the Docker host: ## 5. Build and push the image - git clone https://git.ankh-morpork.discworld.network/laurence/dns-traefik-sync.git + git clone https:///laurence/dns-traefik-sync.git cd dns-traefik-sync - sudo docker build -t git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest . - sudo docker login git.ankh-morpork.discworld.network - sudo docker push git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest + sudo docker build -t /laurence/dns-traefik-sync:latest . + sudo docker login + sudo docker push /laurence/dns-traefik-sync:latest --- @@ -82,8 +82,8 @@ On the Docker host: ## 7. Verify DNS records are being created - dig @192.168.88.1 adguard.ankh-morpork.discworld.network + dig @ adguard. Or on the DC: - sudo samba-tool dns query 127.0.0.1 ankh-morpork.discworld.network @ ALL -U administrator + sudo samba-tool dns query 127.0.0.1 @ ALL -U administrator diff --git a/docs/operations.md b/docs/operations.md index 9b19bb0..e8d4dd2 100644 --- a/docs/operations.md +++ b/docs/operations.md @@ -10,14 +10,14 @@ 2026-05-24 18:00:00 INFO dns-traefik-sync starting 2026-05-24 18:00:00 INFO Kerberos ticket obtained - 2026-05-24 18:00:00 INFO Adding adguard.ankh-morpork.discworld.network -> 192.168.88.2 + 2026-05-24 18:00:00 INFO Adding adguard. -> 2026-05-24 18:01:00 INFO Kerberos ticket obtained 2026-05-24 18:01:00 INFO No changes ## Manually verifying DNS records - dig @192.168.88.1 grafana.ankh-morpork.discworld.network A - sudo samba-tool dns query 127.0.0.1 ankh-morpork.discworld.network @ ALL -U administrator + dig @ grafana. A + sudo samba-tool dns query 127.0.0.1 @ ALL -U administrator ## Forcing a re-sync @@ -27,10 +27,10 @@ cd dns-traefik-sync git pull - sudo docker build -t git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest . - sudo docker push git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest + sudo docker build -t /laurence/dns-traefik-sync:latest . + sudo docker push /laurence/dns-traefik-sync:latest sudo docker service update --image \ - git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest \ + /laurence/dns-traefik-sync:latest \ dns-traefik-sync_dns-traefik-sync ## Keytab rotation @@ -39,7 +39,7 @@ On the Samba DC: sudo samba-tool user setpassword dns-updater --random-password sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \ - --principal=dns-updater@DISCWORLD.NETWORK + --principal=dns-updater@ Update the Docker secret: @@ -50,8 +50,8 @@ Update the Docker secret: ## Removing a DNS record manually - sudo samba-tool dns delete 127.0.0.1 ankh-morpork.discworld.network \ - A 192.168.88.2 -U administrator + sudo samba-tool dns delete 127.0.0.1 \ + A -U administrator ## Troubleshooting @@ -60,7 +60,7 @@ Update the Docker secret: Keytab is stale. Re-export on the DC: sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \ - --principal=dns-updater@DISCWORLD.NETWORK + --principal=dns-updater@ ### nsupdate fails with REFUSED diff --git a/krb5.conf b/krb5.conf index c718ef4..3c864a8 100644 --- a/krb5.conf +++ b/krb5.conf @@ -1,14 +1,14 @@ [libdefaults] - default_realm = DISCWORLD.NETWORK + default_realm = dns_lookup_realm = false dns_lookup_kdc = true [realms] - DISCWORLD.NETWORK = { - kdc = 192.168.88.1 - admin_server = 192.168.88.1 + = { + kdc = + admin_server = } [domain_realm] - .discworld.network = DISCWORLD.NETWORK - discworld.network = DISCWORLD.NETWORK + . = + =