Operations

Checking service status

sudo docker service ls
sudo docker stack ps dns-traefik-sync
sudo docker service logs dns-traefik-sync_dns-traefik-sync --follow

What healthy logs look like

2026-05-24 18:00:00 INFO dns-traefik-sync starting
2026-05-24 18:00:00 INFO Kerberos ticket obtained
2026-05-24 18:00:00 INFO Adding adguard.ankh-morpork.discworld.network -> 192.168.88.2
2026-05-24 18:01:00 INFO Kerberos ticket obtained
2026-05-24 18:01:00 INFO No changes

Manually verifying DNS records

dig @192.168.88.1 grafana.ankh-morpork.discworld.network A
sudo samba-tool dns query 127.0.0.1 ankh-morpork.discworld.network @ ALL -U administrator

Forcing a re-sync

sudo docker service update --force dns-traefik-sync_dns-traefik-sync

Updating the image

cd dns-traefik-sync
git pull
sudo docker build -t git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest .
sudo docker push git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest
sudo docker service update --image \
  git.ankh-morpork.discworld.network/laurence/dns-traefik-sync:latest \
  dns-traefik-sync_dns-traefik-sync

Keytab rotation

On the Samba DC:

sudo samba-tool user setpassword dns-updater --random-password
sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
  --principal=dns-updater@DISCWORLD.NETWORK

Update the Docker secret:

sudo docker secret rm dns-updater-keytab
sudo docker secret create dns-updater-keytab /tmp/dns-updater.keytab
sudo shred -u /tmp/dns-updater.keytab
sudo docker stack deploy -c docker-compose.yml dns-traefik-sync

Removing a DNS record manually

sudo samba-tool dns delete 127.0.0.1 ankh-morpork.discworld.network \
  <hostname> A 192.168.88.2 -U administrator

Troubleshooting

kinit fails - no suitable keys

Keytab is stale. Re-export on the DC:

sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
  --principal=dns-updater@DISCWORLD.NETWORK

nsupdate fails with REFUSED

dns-updater not in DnsAdmins:

sudo samba-tool group addmembers DnsAdmins dns-updater

nsupdate fails with NOTAUTH

Wrong DNS_ZONE or DNS_SERVER environment variable.

Records not being created for a container

Container must have a Host() rule in its Traefik label matching DNS_ZONE. Internal and non-docker providers are ignored.

2.4 KiB Raw Blame History