laurence/dns-traefik-sync
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
dns-traefik-sync/docs/deployment.md

2.1 KiB
Raw Blame History

Deployment

Prerequisites

  • Samba AD DC
  • Docker host joined to the AD domain
  • Docker Swarm mode enabled
  • Traefik running with API enabled

1. Samba AD: Create service account and keytab

On the Samba DC:

sudo samba-tool user create dns-updater --random-password
sudo samba-tool group addmembers DnsAdmins dns-updater
sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
  --principal=dns-updater@<REALM>
sudo kinit -kt /etc/samba/dns-updater.keytab dns-updater@<REALM>
klist

2. Join the Docker host to the domain

sudo apt install sssd-ad sssd-tools realmd adcli krb5-user \
  packagekit samba-common-bin libnss-sss libpam-sss
sudo realm join <DOMAIN> -U administrator
sudo realm list

3. Transfer keytab and create Docker secret

On the DC make the keytab readable temporarily:

sudo cp /etc/samba/dns-updater.keytab /tmp/dns-updater.keytab
sudo chown <youradmin>:<youradmin> /tmp/dns-updater.keytab

On your local machine:

scp <dcadmin>@<dc>:/tmp/dns-updater.keytab .
scp dns-updater.keytab <dockeradmin>@<dockerhost>:/tmp/
shred -u dns-updater.keytab

On the DC clean up:

sudo shred -u /tmp/dns-updater.keytab

On the Docker host:

sudo docker secret create dns-updater-keytab /tmp/dns-updater.keytab
sudo shred -u /tmp/dns-updater.keytab
sudo docker secret ls

4. Enable Docker Swarm

sudo docker swarm init --advertise-addr <docker-host-ip>

5. Build and push the image

git clone https://<REGISTRY>/laurence/dns-traefik-sync.git
cd dns-traefik-sync
sudo docker build -t <REGISTRY>/laurence/dns-traefik-sync:latest .
sudo docker login <REGISTRY>
sudo docker push <REGISTRY>/laurence/dns-traefik-sync:latest

6. Deploy the stack

sudo docker stack deploy -c docker-compose.yml dns-traefik-sync
sudo docker stack ps dns-traefik-sync
sudo docker service logs dns-traefik-sync_dns-traefik-sync

7. Verify DNS records are being created

dig @<DNS_SERVER_IP> adguard.<DNS_ZONE>

Or on the DC:

sudo samba-tool dns query 127.0.0.1 <DNS_ZONE> @ ALL -U administrator