# dns-traefik-sync

Automatic DNS registration for Traefik-managed containers using Kerberos-authenticated
RFC 2136 dynamic updates against a Samba Active Directory DNS server.

Polls the Traefik API, extracts Host() rules from docker-provider routers, and
creates/removes A records in Samba AD DNS using GSS-TSIG authentication.
No SSH. No passwords. No broad privilege.

## How it works

    Traefik API (/api/http/routers)
        └── docker provider routers with Host() rules
                └── filtered to target zone
                        └── diff against last known state
                                └── nsupdate -g (GSS-TSIG via Kerberos keytab)
                                        └── Samba AD DNS (vetinari)

On each poll cycle:

- Fetches all routers from the Traefik API
- Filters to docker provider only, extracts hostnames matching the target zone
- Compares against state from the previous cycle
- Adds A records for new hostnames, removes A records for gone hostnames
- Renews the Kerberos ticket before each cycle

## Requirements

- Traefik with API enabled
- Samba AD DC with a service account in DnsAdmins
- Keytab for the service account stored as a Docker secret
- Docker Swarm mode (for secrets)

## Configuration

All configuration via environment variables:

| Variable         | Default                            | Description                        |
|------------------|------------------------------------|------------------------------------|
| TRAEFIK_API      | http://192.168.88.2:8080           | Traefik API base URL               |
| DNS_SERVER       | 192.168.88.1                       | Samba AD DNS server IP             |
| DNS_ZONE         | ankh-morpork.discworld.network     | Zone to manage records in          |
| TARGET_IP        | 192.168.88.2                       | IP address for created A records   |
| TTL              | 300                                | TTL for created records (seconds)  |
| POLL_INTERVAL    | 60                                 | Poll interval (seconds)            |
| KEYTAB           | /run/secrets/dns-updater-keytab    | Path to Kerberos keytab            |
| KRB_PRINCIPAL    | dns-updater@DISCWORLD.NETWORK      | Kerberos principal                 |
| STATE_FILE       | /tmp/dns_state.json                | State persistence path             |

## Deployment

See docs/deployment.md for full setup instructions.
See docs/operations.md for day-to-day operational guidance.

## Security model

- Service account scoped to DnsAdmins only
- Keytab stored as a Docker secret, never on disk
- GSS-TSIG: Kerberos mutual authentication, updates signed and verified by the KDC
- No SSH, no HTTP webhooks, no plaintext credentials
- Container runs as nobody

## Limitations

- A records only (no CNAME, no AAAA)
- Single target IP (all records point to the same host)
- Single zone
- On restart, re-syncs from Traefik - safe and idempotent

## Changelog

See CHANGELOG.md