# Deployment

## Prerequisites

- Samba AD DC
- Docker host joined to the AD domain
- Docker Swarm mode enabled
- Traefik running with API enabled

---

## 1. Samba AD: Create service account and keytab

On the Samba DC:

    sudo samba-tool user create dns-updater --random-password
    sudo samba-tool group addmembers DnsAdmins dns-updater
    sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
      --principal=dns-updater@DISCWORLD.NETWORK
    sudo kinit -kt /etc/samba/dns-updater.keytab dns-updater@DISCWORLD.NETWORK
    klist

---

## 2. Join the Docker host to the domain

    sudo apt install sssd-ad sssd-tools realmd adcli krb5-user \
      packagekit samba-common-bin libnss-sss libpam-sss
    sudo realm join discworld.network -U administrator
    sudo realm list

---

## 3. Transfer keytab and create Docker secret

On the DC make the keytab readable temporarily:

    sudo cp /etc/samba/dns-updater.keytab /tmp/dns-updater.keytab
    sudo chown <youradmin>:<youradmin> /tmp/dns-updater.keytab

On your local machine:

    scp <dcadmin>@<dc>:/tmp/dns-updater.keytab .
    scp dns-updater.keytab <dockeradmin>@<dockerhost>:/tmp/
    shred -u dns-updater.keytab

On the DC clean up:

    sudo shred -u /tmp/dns-updater.keytab

On the Docker host:

    sudo docker secret create dns-updater-keytab /tmp/dns-updater.keytab
    sudo shred -u /tmp/dns-updater.keytab
    sudo docker secret ls

---

## 4. Enable Docker Swarm

    sudo docker swarm init --advertise-addr <docker-host-ip>

---

## 5. Build and push the image

    git clone https://git.ankh-morpork.discworld.network/laurence/dns-traefik-sync.git
    cd dns-traefik-sync
    sudo docker build -t git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest .
    sudo docker login git.ankh-morpork.discworld.network
    sudo docker push git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest

---

## 6. Deploy the stack

    sudo docker stack deploy -c docker-compose.yml dns-traefik-sync
    sudo docker stack ps dns-traefik-sync
    sudo docker service logs dns-traefik-sync_dns-traefik-sync

---

## 7. Verify DNS records are being created

    dig @192.168.88.1 adguard.ankh-morpork.discworld.network

Or on the DC:

    sudo samba-tool dns query 127.0.0.1 ankh-morpork.discworld.network @ ALL -U administrator