Operations

Checking service status

sudo docker service ls
sudo docker stack ps dns-traefik-sync
sudo docker service logs dns-traefik-sync_dns-traefik-sync --follow

What healthy logs look like

2026-05-24 18:00:00 INFO dns-traefik-sync starting
2026-05-24 18:00:00 INFO Kerberos ticket obtained
2026-05-24 18:00:00 INFO Adding adguard.<DNS_ZONE> -> <TARGET_IP>
2026-05-24 18:01:00 INFO Kerberos ticket obtained
2026-05-24 18:01:00 INFO No changes

Manually verifying DNS records

dig @<DNS_SERVER_IP> grafana.<DNS_ZONE> A
sudo samba-tool dns query 127.0.0.1 <DNS_ZONE> @ ALL -U administrator

Forcing a re-sync

sudo docker service update --force dns-traefik-sync_dns-traefik-sync

Updating the image

cd dns-traefik-sync
git pull
sudo docker build -t <REGISTRY>/laurence/dns-traefik-sync:latest .
sudo docker push <REGISTRY>/laurence/dns-traefik-sync:latest
sudo docker service update --image \
  <REGISTRY>/laurence/dns-traefik-sync:latest \
  dns-traefik-sync_dns-traefik-sync

Keytab rotation

On the Samba DC:

sudo samba-tool user setpassword dns-updater --random-password
sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
  --principal=dns-updater@<REALM>

Update the Docker secret:

sudo docker secret rm dns-updater-keytab
sudo docker secret create dns-updater-keytab /tmp/dns-updater.keytab
sudo shred -u /tmp/dns-updater.keytab
sudo docker stack deploy -c docker-compose.yml dns-traefik-sync

Removing a DNS record manually

sudo samba-tool dns delete 127.0.0.1 <DNS_ZONE> \
  <hostname> A <TARGET_IP> -U administrator

Troubleshooting

kinit fails - no suitable keys

Keytab is stale. Re-export on the DC:

sudo samba-tool domain exportkeytab /etc/samba/dns-updater.keytab \
  --principal=dns-updater@<REALM>

nsupdate fails with REFUSED

dns-updater not in DnsAdmins:

sudo samba-tool group addmembers DnsAdmins dns-updater

nsupdate fails with NOTAUTH

Wrong DNS_ZONE or DNS_SERVER environment variable.

Records not being created for a container

Container must have a Host() rule in its Traefik label matching DNS_ZONE. Internal and non-docker providers are ignored.

2.2 KiB Raw Permalink Blame History