89 lines
2.1 KiB
Markdown
89 lines
2.1 KiB
Markdown
# Deployment
|
|
|
|
## Prerequisites
|
|
|
|
- Samba AD DC
|
|
- Docker host joined to the AD domain
|
|
- Docker Swarm mode enabled
|
|
- Traefik running with API enabled
|
|
|
|
---
|
|
|
|
## 1. Samba AD: Create service account and keytab
|
|
|
|
On the Samba DC:
|
|
|
|
sudo samba-tool user create dns-updater --random-password
|
|
sudo samba-tool group addmembers DnsAdmins dns-updater
|
|
sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
|
|
--principal=dns-updater@<REALM>
|
|
sudo kinit -kt /etc/samba/dns-updater.keytab dns-updater@<REALM>
|
|
klist
|
|
|
|
---
|
|
|
|
## 2. Join the Docker host to the domain
|
|
|
|
sudo apt install sssd-ad sssd-tools realmd adcli krb5-user \
|
|
packagekit samba-common-bin libnss-sss libpam-sss
|
|
sudo realm join <DOMAIN> -U administrator
|
|
sudo realm list
|
|
|
|
---
|
|
|
|
## 3. Transfer keytab and create Docker secret
|
|
|
|
On the DC make the keytab readable temporarily:
|
|
|
|
sudo cp /etc/samba/dns-updater.keytab /tmp/dns-updater.keytab
|
|
sudo chown <youradmin>:<youradmin> /tmp/dns-updater.keytab
|
|
|
|
On your local machine:
|
|
|
|
scp <dcadmin>@<dc>:/tmp/dns-updater.keytab .
|
|
scp dns-updater.keytab <dockeradmin>@<dockerhost>:/tmp/
|
|
shred -u dns-updater.keytab
|
|
|
|
On the DC clean up:
|
|
|
|
sudo shred -u /tmp/dns-updater.keytab
|
|
|
|
On the Docker host:
|
|
|
|
sudo docker secret create dns-updater-keytab /tmp/dns-updater.keytab
|
|
sudo shred -u /tmp/dns-updater.keytab
|
|
sudo docker secret ls
|
|
|
|
---
|
|
|
|
## 4. Enable Docker Swarm
|
|
|
|
sudo docker swarm init --advertise-addr <docker-host-ip>
|
|
|
|
---
|
|
|
|
## 5. Build and push the image
|
|
|
|
git clone https://<REGISTRY>/laurence/dns-traefik-sync.git
|
|
cd dns-traefik-sync
|
|
sudo docker build -t <REGISTRY>/laurence/dns-traefik-sync:latest .
|
|
sudo docker login <REGISTRY>
|
|
sudo docker push <REGISTRY>/laurence/dns-traefik-sync:latest
|
|
|
|
---
|
|
|
|
## 6. Deploy the stack
|
|
|
|
sudo docker stack deploy -c docker-compose.yml dns-traefik-sync
|
|
sudo docker stack ps dns-traefik-sync
|
|
sudo docker service logs dns-traefik-sync_dns-traefik-sync
|
|
|
|
---
|
|
|
|
## 7. Verify DNS records are being created
|
|
|
|
dig @<DNS_SERVER_IP> adguard.<DNS_ZONE>
|
|
|
|
Or on the DC:
|
|
|
|
sudo samba-tool dns query 127.0.0.1 <DNS_ZONE> @ ALL -U administrator
|