Compare commits
No commits in common. "a0a588f63bd3914ad91414228d2e7216f0335580" and "69048df8640ece0aa80505f0acfacf2f70e5fb56" have entirely different histories.
a0a588f63b
...
69048df864
8 changed files with 44 additions and 44 deletions
|
|
@ -24,7 +24,7 @@ jobs:
|
|||
if: github.event_name != 'pull_request'
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: git.ankh-morpork.discworld.network
|
||||
registry: <REGISTRY>
|
||||
username: ${{ secrets.REGISTRY_USERNAME }}
|
||||
password: ${{ secrets.REGISTRY_PASSWORD }}
|
||||
|
||||
|
|
@ -32,7 +32,7 @@ jobs:
|
|||
id: meta
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: git.ankh-morpork.discworld.network/laurence/dns-traefik-sync
|
||||
images: <REGISTRY>/laurence/dns-traefik-sync
|
||||
tags: |
|
||||
type=semver,pattern={{version}}
|
||||
type=semver,pattern={{major}}.{{minor}}
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
|
||||
Clone the repo and set up a venv:
|
||||
|
||||
git clone https://git.ankh-morpork.discworld.network/laurence/dns-traefik-sync.git
|
||||
git clone https://<REGISTRY>/laurence/dns-traefik-sync.git
|
||||
cd dns-traefik-sync
|
||||
python3 -m venv venv
|
||||
source venv/bin/activate
|
||||
|
|
|
|||
10
README.md
10
README.md
|
|
@ -37,14 +37,14 @@ All configuration via environment variables:
|
|||
|
||||
| Variable | Default | Description |
|
||||
|------------------|------------------------------------|------------------------------------|
|
||||
| TRAEFIK_API | http://192.168.88.2:8080 | Traefik API base URL |
|
||||
| DNS_SERVER | 192.168.88.1 | Samba AD DNS server IP |
|
||||
| DNS_ZONE | ankh-morpork.discworld.network | Zone to manage records in |
|
||||
| TARGET_IP | 192.168.88.2 | IP address for created A records |
|
||||
| TRAEFIK_API | http://<TARGET_IP>:8080 | Traefik API base URL |
|
||||
| DNS_SERVER | <DNS_SERVER_IP> | Samba AD DNS server IP |
|
||||
| DNS_ZONE | <DNS_ZONE> | Zone to manage records in |
|
||||
| TARGET_IP | <TARGET_IP> | IP address for created A records |
|
||||
| TTL | 300 | TTL for created records (seconds) |
|
||||
| POLL_INTERVAL | 60 | Poll interval (seconds) |
|
||||
| KEYTAB | /run/secrets/dns-updater-keytab | Path to Kerberos keytab |
|
||||
| KRB_PRINCIPAL | dns-updater@DISCWORLD.NETWORK | Kerberos principal |
|
||||
| KRB_PRINCIPAL | dns-updater@<REALM> | Kerberos principal |
|
||||
| STATE_FILE | /tmp/dns_state.json | State persistence path |
|
||||
|
||||
## Deployment
|
||||
|
|
|
|||
10
dns_sync.py
10
dns_sync.py
|
|
@ -14,14 +14,14 @@ logging.basicConfig(
|
|||
)
|
||||
log = logging.getLogger(__name__)
|
||||
|
||||
TRAEFIK_API = os.environ.get('TRAEFIK_API', 'http://192.168.88.2:8080')
|
||||
DNS_SERVER = os.environ.get('DNS_SERVER', '192.168.88.1')
|
||||
DNS_ZONE = os.environ.get('DNS_ZONE', 'ankh-morpork.discworld.network')
|
||||
TARGET_IP = os.environ.get('TARGET_IP', '192.168.88.2')
|
||||
TRAEFIK_API = os.environ.get('TRAEFIK_API', 'http://<TARGET_IP>:8080')
|
||||
DNS_SERVER = os.environ.get('DNS_SERVER', '<DNS_SERVER_IP>')
|
||||
DNS_ZONE = os.environ.get('DNS_ZONE', '<DNS_ZONE>')
|
||||
TARGET_IP = os.environ.get('TARGET_IP', '<TARGET_IP>')
|
||||
TTL = int(os.environ.get('TTL', '300'))
|
||||
POLL_INTERVAL = int(os.environ.get('POLL_INTERVAL', '60'))
|
||||
KEYTAB = os.environ.get('KEYTAB', '/run/secrets/dns-updater-keytab')
|
||||
KRB_PRINCIPAL = os.environ.get('KRB_PRINCIPAL', 'dns-updater@DISCWORLD.NETWORK')
|
||||
KRB_PRINCIPAL = os.environ.get('KRB_PRINCIPAL', 'dns-updater@<REALM>')
|
||||
STATE_FILE = os.environ.get('STATE_FILE', '/tmp/dns_state.json')
|
||||
|
||||
def kinit():
|
||||
|
|
|
|||
|
|
@ -2,16 +2,16 @@ version: "3.8"
|
|||
|
||||
services:
|
||||
dns-traefik-sync:
|
||||
image: git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest
|
||||
image: <REGISTRY>/laurence/dns-traefik-sync:latest
|
||||
environment:
|
||||
TRAEFIK_API: "http://192.168.88.2:8080"
|
||||
DNS_SERVER: "192.168.88.1"
|
||||
DNS_ZONE: "ankh-morpork.discworld.network"
|
||||
TARGET_IP: "192.168.88.2"
|
||||
TRAEFIK_API: "http://<TARGET_IP>:8080"
|
||||
DNS_SERVER: "<DNS_SERVER_IP>"
|
||||
DNS_ZONE: "<DNS_ZONE>"
|
||||
TARGET_IP: "<TARGET_IP>"
|
||||
TTL: "300"
|
||||
POLL_INTERVAL: "60"
|
||||
KEYTAB: "/run/secrets/dns-updater-keytab"
|
||||
KRB_PRINCIPAL: "dns-updater@DISCWORLD.NETWORK"
|
||||
KRB_PRINCIPAL: "dns-updater@<REALM>"
|
||||
secrets:
|
||||
- dns-updater-keytab
|
||||
restart: unless-stopped
|
||||
|
|
|
|||
|
|
@ -16,8 +16,8 @@ On the Samba DC:
|
|||
sudo samba-tool user create dns-updater --random-password
|
||||
sudo samba-tool group addmembers DnsAdmins dns-updater
|
||||
sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
|
||||
--principal=dns-updater@DISCWORLD.NETWORK
|
||||
sudo kinit -kt /etc/samba/dns-updater.keytab dns-updater@DISCWORLD.NETWORK
|
||||
--principal=dns-updater@<REALM>
|
||||
sudo kinit -kt /etc/samba/dns-updater.keytab dns-updater@<REALM>
|
||||
klist
|
||||
|
||||
---
|
||||
|
|
@ -26,7 +26,7 @@ On the Samba DC:
|
|||
|
||||
sudo apt install sssd-ad sssd-tools realmd adcli krb5-user \
|
||||
packagekit samba-common-bin libnss-sss libpam-sss
|
||||
sudo realm join discworld.network -U administrator
|
||||
sudo realm join <DOMAIN> -U administrator
|
||||
sudo realm list
|
||||
|
||||
---
|
||||
|
|
@ -64,11 +64,11 @@ On the Docker host:
|
|||
|
||||
## 5. Build and push the image
|
||||
|
||||
git clone https://git.ankh-morpork.discworld.network/laurence/dns-traefik-sync.git
|
||||
git clone https://<REGISTRY>/laurence/dns-traefik-sync.git
|
||||
cd dns-traefik-sync
|
||||
sudo docker build -t git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest .
|
||||
sudo docker login git.ankh-morpork.discworld.network
|
||||
sudo docker push git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest
|
||||
sudo docker build -t <REGISTRY>/laurence/dns-traefik-sync:latest .
|
||||
sudo docker login <REGISTRY>
|
||||
sudo docker push <REGISTRY>/laurence/dns-traefik-sync:latest
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -82,8 +82,8 @@ On the Docker host:
|
|||
|
||||
## 7. Verify DNS records are being created
|
||||
|
||||
dig @192.168.88.1 adguard.ankh-morpork.discworld.network
|
||||
dig @<DNS_SERVER_IP> adguard.<DNS_ZONE>
|
||||
|
||||
Or on the DC:
|
||||
|
||||
sudo samba-tool dns query 127.0.0.1 ankh-morpork.discworld.network @ ALL -U administrator
|
||||
sudo samba-tool dns query 127.0.0.1 <DNS_ZONE> @ ALL -U administrator
|
||||
|
|
|
|||
|
|
@ -10,14 +10,14 @@
|
|||
|
||||
2026-05-24 18:00:00 INFO dns-traefik-sync starting
|
||||
2026-05-24 18:00:00 INFO Kerberos ticket obtained
|
||||
2026-05-24 18:00:00 INFO Adding adguard.ankh-morpork.discworld.network -> 192.168.88.2
|
||||
2026-05-24 18:00:00 INFO Adding adguard.<DNS_ZONE> -> <TARGET_IP>
|
||||
2026-05-24 18:01:00 INFO Kerberos ticket obtained
|
||||
2026-05-24 18:01:00 INFO No changes
|
||||
|
||||
## Manually verifying DNS records
|
||||
|
||||
dig @192.168.88.1 grafana.ankh-morpork.discworld.network A
|
||||
sudo samba-tool dns query 127.0.0.1 ankh-morpork.discworld.network @ ALL -U administrator
|
||||
dig @<DNS_SERVER_IP> grafana.<DNS_ZONE> A
|
||||
sudo samba-tool dns query 127.0.0.1 <DNS_ZONE> @ ALL -U administrator
|
||||
|
||||
## Forcing a re-sync
|
||||
|
||||
|
|
@ -27,10 +27,10 @@
|
|||
|
||||
cd dns-traefik-sync
|
||||
git pull
|
||||
sudo docker build -t git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest .
|
||||
sudo docker push git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest
|
||||
sudo docker build -t <REGISTRY>/laurence/dns-traefik-sync:latest .
|
||||
sudo docker push <REGISTRY>/laurence/dns-traefik-sync:latest
|
||||
sudo docker service update --image \
|
||||
git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest \
|
||||
<REGISTRY>/laurence/dns-traefik-sync:latest \
|
||||
dns-traefik-sync_dns-traefik-sync
|
||||
|
||||
## Keytab rotation
|
||||
|
|
@ -39,7 +39,7 @@ On the Samba DC:
|
|||
|
||||
sudo samba-tool user setpassword dns-updater --random-password
|
||||
sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
|
||||
--principal=dns-updater@DISCWORLD.NETWORK
|
||||
--principal=dns-updater@<REALM>
|
||||
|
||||
Update the Docker secret:
|
||||
|
||||
|
|
@ -50,8 +50,8 @@ Update the Docker secret:
|
|||
|
||||
## Removing a DNS record manually
|
||||
|
||||
sudo samba-tool dns delete 127.0.0.1 ankh-morpork.discworld.network \
|
||||
<hostname> A 192.168.88.2 -U administrator
|
||||
sudo samba-tool dns delete 127.0.0.1 <DNS_ZONE> \
|
||||
<hostname> A <TARGET_IP> -U administrator
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
|
|
@ -60,7 +60,7 @@ Update the Docker secret:
|
|||
Keytab is stale. Re-export on the DC:
|
||||
|
||||
sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
|
||||
--principal=dns-updater@DISCWORLD.NETWORK
|
||||
--principal=dns-updater@<REALM>
|
||||
|
||||
### nsupdate fails with REFUSED
|
||||
|
||||
|
|
|
|||
12
krb5.conf
12
krb5.conf
|
|
@ -1,14 +1,14 @@
|
|||
[libdefaults]
|
||||
default_realm = DISCWORLD.NETWORK
|
||||
default_realm = <REALM>
|
||||
dns_lookup_realm = false
|
||||
dns_lookup_kdc = true
|
||||
|
||||
[realms]
|
||||
DISCWORLD.NETWORK = {
|
||||
kdc = 192.168.88.1
|
||||
admin_server = 192.168.88.1
|
||||
<REALM> = {
|
||||
kdc = <DNS_SERVER_IP>
|
||||
admin_server = <DNS_SERVER_IP>
|
||||
}
|
||||
|
||||
[domain_realm]
|
||||
.discworld.network = DISCWORLD.NETWORK
|
||||
discworld.network = DISCWORLD.NETWORK
|
||||
.<DOMAIN> = <REALM>
|
||||
<DOMAIN> = <REALM>
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue