78 lines
2.2 KiB
Markdown
78 lines
2.2 KiB
Markdown
# Operations
|
|
|
|
## Checking service status
|
|
|
|
sudo docker service ls
|
|
sudo docker stack ps dns-traefik-sync
|
|
sudo docker service logs dns-traefik-sync_dns-traefik-sync --follow
|
|
|
|
## What healthy logs look like
|
|
|
|
2026-05-24 18:00:00 INFO dns-traefik-sync starting
|
|
2026-05-24 18:00:00 INFO Kerberos ticket obtained
|
|
2026-05-24 18:00:00 INFO Adding adguard.<DNS_ZONE> -> <TARGET_IP>
|
|
2026-05-24 18:01:00 INFO Kerberos ticket obtained
|
|
2026-05-24 18:01:00 INFO No changes
|
|
|
|
## Manually verifying DNS records
|
|
|
|
dig @<DNS_SERVER_IP> grafana.<DNS_ZONE> A
|
|
sudo samba-tool dns query 127.0.0.1 <DNS_ZONE> @ ALL -U administrator
|
|
|
|
## Forcing a re-sync
|
|
|
|
sudo docker service update --force dns-traefik-sync_dns-traefik-sync
|
|
|
|
## Updating the image
|
|
|
|
cd dns-traefik-sync
|
|
git pull
|
|
sudo docker build -t <REGISTRY>/laurence/dns-traefik-sync:latest .
|
|
sudo docker push <REGISTRY>/laurence/dns-traefik-sync:latest
|
|
sudo docker service update --image \
|
|
<REGISTRY>/laurence/dns-traefik-sync:latest \
|
|
dns-traefik-sync_dns-traefik-sync
|
|
|
|
## Keytab rotation
|
|
|
|
On the Samba DC:
|
|
|
|
sudo samba-tool user setpassword dns-updater --random-password
|
|
sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
|
|
--principal=dns-updater@<REALM>
|
|
|
|
Update the Docker secret:
|
|
|
|
sudo docker secret rm dns-updater-keytab
|
|
sudo docker secret create dns-updater-keytab /tmp/dns-updater.keytab
|
|
sudo shred -u /tmp/dns-updater.keytab
|
|
sudo docker stack deploy -c docker-compose.yml dns-traefik-sync
|
|
|
|
## Removing a DNS record manually
|
|
|
|
sudo samba-tool dns delete 127.0.0.1 <DNS_ZONE> \
|
|
<hostname> A <TARGET_IP> -U administrator
|
|
|
|
## Troubleshooting
|
|
|
|
### kinit fails - no suitable keys
|
|
|
|
Keytab is stale. Re-export on the DC:
|
|
|
|
sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
|
|
--principal=dns-updater@<REALM>
|
|
|
|
### nsupdate fails with REFUSED
|
|
|
|
dns-updater not in DnsAdmins:
|
|
|
|
sudo samba-tool group addmembers DnsAdmins dns-updater
|
|
|
|
### nsupdate fails with NOTAUTH
|
|
|
|
Wrong DNS_ZONE or DNS_SERVER environment variable.
|
|
|
|
### Records not being created for a container
|
|
|
|
Container must have a Host() rule in its Traefik label matching DNS_ZONE.
|
|
Internal and non-docker providers are ignored.
|