laurence/dns-traefik-sync
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
dns-traefik-sync/docs/deployment.md
root 473855e59a
Some checks are pending
build / build (push) Waiting to run
Details
docs: README, changelog, contributing, security, deployment, operations, CI
2026-05-24 18:21:04 +01:00

2.3 KiB
Raw Blame History

Deployment

Prerequisites

  • Samba AD DC
  • Docker host joined to the AD domain
  • Docker Swarm mode enabled
  • Traefik running with API enabled

1. Samba AD: Create service account and keytab

On the Samba DC:

sudo samba-tool user create dns-updater --random-password
sudo samba-tool group addmembers DnsAdmins dns-updater
sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
  --principal=dns-updater@DISCWORLD.NETWORK
sudo kinit -kt /etc/samba/dns-updater.keytab dns-updater@DISCWORLD.NETWORK
klist

2. Join the Docker host to the domain

sudo apt install sssd-ad sssd-tools realmd adcli krb5-user \
  packagekit samba-common-bin libnss-sss libpam-sss
sudo realm join discworld.network -U administrator
sudo realm list

3. Transfer keytab and create Docker secret

On the DC make the keytab readable temporarily:

sudo cp /etc/samba/dns-updater.keytab /tmp/dns-updater.keytab
sudo chown <youradmin>:<youradmin> /tmp/dns-updater.keytab

On your local machine:

scp <dcadmin>@<dc>:/tmp/dns-updater.keytab .
scp dns-updater.keytab <dockeradmin>@<dockerhost>:/tmp/
shred -u dns-updater.keytab

On the DC clean up:

sudo shred -u /tmp/dns-updater.keytab

On the Docker host:

sudo docker secret create dns-updater-keytab /tmp/dns-updater.keytab
sudo shred -u /tmp/dns-updater.keytab
sudo docker secret ls

4. Enable Docker Swarm

sudo docker swarm init --advertise-addr <docker-host-ip>

5. Build and push the image

git clone https://git.ankh-morpork.discworld.network/laurence/dns-traefik-sync.git
cd dns-traefik-sync
sudo docker build -t git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest .
sudo docker login git.ankh-morpork.discworld.network
sudo docker push git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest

6. Deploy the stack

sudo docker stack deploy -c docker-compose.yml dns-traefik-sync
sudo docker stack ps dns-traefik-sync
sudo docker service logs dns-traefik-sync_dns-traefik-sync

7. Verify DNS records are being created

dig @192.168.88.1 adguard.ankh-morpork.discworld.network

Or on the DC:

sudo samba-tool dns query 127.0.0.1 ankh-morpork.discworld.network @ ALL -U administrator