# Operations

## Checking service status

    sudo docker service ls
    sudo docker stack ps dns-traefik-sync
    sudo docker service logs dns-traefik-sync_dns-traefik-sync --follow

## What healthy logs look like

    2026-05-24 18:00:00 INFO dns-traefik-sync starting
    2026-05-24 18:00:00 INFO Kerberos ticket obtained
    2026-05-24 18:00:00 INFO Adding adguard.ankh-morpork.discworld.network -> 192.168.88.2
    2026-05-24 18:01:00 INFO Kerberos ticket obtained
    2026-05-24 18:01:00 INFO No changes

## Manually verifying DNS records

    dig @192.168.88.1 grafana.ankh-morpork.discworld.network A
    sudo samba-tool dns query 127.0.0.1 ankh-morpork.discworld.network @ ALL -U administrator

## Forcing a re-sync

    sudo docker service update --force dns-traefik-sync_dns-traefik-sync

## Updating the image

    cd dns-traefik-sync
    git pull
    sudo docker build -t git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest .
    sudo docker push git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest
    sudo docker service update --image \
      git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest \
      dns-traefik-sync_dns-traefik-sync

## Keytab rotation

On the Samba DC:

    sudo samba-tool user setpassword dns-updater --random-password
    sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
      --principal=dns-updater@DISCWORLD.NETWORK

Update the Docker secret:

    sudo docker secret rm dns-updater-keytab
    sudo docker secret create dns-updater-keytab /tmp/dns-updater.keytab
    sudo shred -u /tmp/dns-updater.keytab
    sudo docker stack deploy -c docker-compose.yml dns-traefik-sync

## Removing a DNS record manually

    sudo samba-tool dns delete 127.0.0.1 ankh-morpork.discworld.network \
      <hostname> A 192.168.88.2 -U administrator

## Troubleshooting

### kinit fails - no suitable keys

Keytab is stale. Re-export on the DC:

    sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
      --principal=dns-updater@DISCWORLD.NETWORK

### nsupdate fails with REFUSED

dns-updater not in DnsAdmins:

    sudo samba-tool group addmembers DnsAdmins dns-updater

### nsupdate fails with NOTAUTH

Wrong DNS_ZONE or DNS_SERVER environment variable.

### Records not being created for a container

Container must have a Host() rule in its Traefik label matching DNS_ZONE.
Internal and non-docker providers are ignored.