89 lines
2.3 KiB
Markdown
89 lines
2.3 KiB
Markdown
# Deployment
|
|
|
|
## Prerequisites
|
|
|
|
- Samba AD DC
|
|
- Docker host joined to the AD domain
|
|
- Docker Swarm mode enabled
|
|
- Traefik running with API enabled
|
|
|
|
---
|
|
|
|
## 1. Samba AD: Create service account and keytab
|
|
|
|
On the Samba DC:
|
|
|
|
sudo samba-tool user create dns-updater --random-password
|
|
sudo samba-tool group addmembers DnsAdmins dns-updater
|
|
sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
|
|
--principal=dns-updater@DISCWORLD.NETWORK
|
|
sudo kinit -kt /etc/samba/dns-updater.keytab dns-updater@DISCWORLD.NETWORK
|
|
klist
|
|
|
|
---
|
|
|
|
## 2. Join the Docker host to the domain
|
|
|
|
sudo apt install sssd-ad sssd-tools realmd adcli krb5-user \
|
|
packagekit samba-common-bin libnss-sss libpam-sss
|
|
sudo realm join discworld.network -U administrator
|
|
sudo realm list
|
|
|
|
---
|
|
|
|
## 3. Transfer keytab and create Docker secret
|
|
|
|
On the DC make the keytab readable temporarily:
|
|
|
|
sudo cp /etc/samba/dns-updater.keytab /tmp/dns-updater.keytab
|
|
sudo chown <youradmin>:<youradmin> /tmp/dns-updater.keytab
|
|
|
|
On your local machine:
|
|
|
|
scp <dcadmin>@<dc>:/tmp/dns-updater.keytab .
|
|
scp dns-updater.keytab <dockeradmin>@<dockerhost>:/tmp/
|
|
shred -u dns-updater.keytab
|
|
|
|
On the DC clean up:
|
|
|
|
sudo shred -u /tmp/dns-updater.keytab
|
|
|
|
On the Docker host:
|
|
|
|
sudo docker secret create dns-updater-keytab /tmp/dns-updater.keytab
|
|
sudo shred -u /tmp/dns-updater.keytab
|
|
sudo docker secret ls
|
|
|
|
---
|
|
|
|
## 4. Enable Docker Swarm
|
|
|
|
sudo docker swarm init --advertise-addr <docker-host-ip>
|
|
|
|
---
|
|
|
|
## 5. Build and push the image
|
|
|
|
git clone https://git.ankh-morpork.discworld.network/laurence/dns-traefik-sync.git
|
|
cd dns-traefik-sync
|
|
sudo docker build -t git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest .
|
|
sudo docker login git.ankh-morpork.discworld.network
|
|
sudo docker push git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest
|
|
|
|
---
|
|
|
|
## 6. Deploy the stack
|
|
|
|
sudo docker stack deploy -c docker-compose.yml dns-traefik-sync
|
|
sudo docker stack ps dns-traefik-sync
|
|
sudo docker service logs dns-traefik-sync_dns-traefik-sync
|
|
|
|
---
|
|
|
|
## 7. Verify DNS records are being created
|
|
|
|
dig @192.168.88.1 adguard.ankh-morpork.discworld.network
|
|
|
|
Or on the DC:
|
|
|
|
sudo samba-tool dns query 127.0.0.1 ankh-morpork.discworld.network @ ALL -U administrator
|