# Operations

## Checking service status

    sudo docker service ls
    sudo docker stack ps dns-traefik-sync
    sudo docker service logs dns-traefik-sync_dns-traefik-sync --follow

## What healthy logs look like

    2026-05-24 18:00:00 INFO dns-traefik-sync starting
    2026-05-24 18:00:00 INFO Kerberos ticket obtained
    2026-05-24 18:00:00 INFO Adding adguard.<DNS_ZONE> -> <TARGET_IP>
    2026-05-24 18:01:00 INFO Kerberos ticket obtained
    2026-05-24 18:01:00 INFO No changes

## Manually verifying DNS records

    dig @<DNS_SERVER_IP> grafana.<DNS_ZONE> A
    sudo samba-tool dns query 127.0.0.1 <DNS_ZONE> @ ALL -U administrator

## Forcing a re-sync

    sudo docker service update --force dns-traefik-sync_dns-traefik-sync

## Updating the image

    cd dns-traefik-sync
    git pull
    sudo docker build -t <REGISTRY>/laurence/dns-traefik-sync:latest .
    sudo docker push <REGISTRY>/laurence/dns-traefik-sync:latest
    sudo docker service update --image \
      <REGISTRY>/laurence/dns-traefik-sync:latest \
      dns-traefik-sync_dns-traefik-sync

## Keytab rotation

On the Samba DC:

    sudo samba-tool user setpassword dns-updater --random-password
    sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
      --principal=dns-updater@<REALM>

Update the Docker secret:

    sudo docker secret rm dns-updater-keytab
    sudo docker secret create dns-updater-keytab /tmp/dns-updater.keytab
    sudo shred -u /tmp/dns-updater.keytab
    sudo docker stack deploy -c docker-compose.yml dns-traefik-sync

## Removing a DNS record manually

    sudo samba-tool dns delete 127.0.0.1 <DNS_ZONE> \
      <hostname> A <TARGET_IP> -U administrator

## Troubleshooting

### kinit fails - no suitable keys

Keytab is stale. Re-export on the DC:

    sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
      --principal=dns-updater@<REALM>

### nsupdate fails with REFUSED

dns-updater not in DnsAdmins:

    sudo samba-tool group addmembers DnsAdmins dns-updater

### nsupdate fails with NOTAUTH

Wrong DNS_ZONE or DNS_SERVER environment variable.

### Records not being created for a container

Container must have a Host() rule in its Traefik label matching DNS_ZONE.
Internal and non-docker providers are ignored.