github.com/favonia/cloudflare-ddns

This release adds experimental controls for per-domain IPv6 host IDs and detected-address filtering, and makes advanced configuration easier to validate. It also removes the startup token-verification request that produced misleading warnings for valid account API tokens.

Highlights

1. Per-domain IPv6 host IDs. Advanced IPv6 setups can now control the host bits of each domain's AAAA records by adding the experimental hostid6 field to entries in DOMAINS or IP6_DOMAINS, for example example.org{hostid6=::1}. A domain can preserve the detected host bits, replace them with a fixed host ID, or derive one from a MAC address. This changes only AAAA record derivation; WAF lists continue to use the raw detected prefixes. (#1224)
2. IPv4 and IPv6 detection filters. New experimental IP4_DETECTION_FILTER and IP6_DETECTION_FILTER expressions select detected addresses before both DNS and WAF reconciliation. If a filter removes every address for one family, the updater preserves that family's existing managed content for the round. (#1231)
3. Advisory linting for PROXIED. The updater now warns about suspicious boolean expressions, including constant results and redundant or subsumed terms. (#1235)
4. Account API tokens no longer trigger misleading startup warnings. The updater no longer calls Cloudflare's user-token verification endpoint during startup. Malformed token values are still rejected locally. A well-formed token that is invalid or lacks permission for an attempted DNS or WAF operation is instead reported when that operation fails, with the corresponding permission guidance. (#1240)

Other Notable Changes

Features

• New SHOUTRRR_FILE reads Shoutrrr notification URLs from a file, making mounted secrets usable without putting token-bearing URLs in environment values. If SHOUTRRR and SHOUTRRR_FILE are both set, they must specify the same URLs. (#1241)

Bug Fixes

• When both HEALTHCHECKS and UPTIMEKUMA are configured, a failure from either service no longer prevents the updater from contacting the other. (#1249)

Message Improvements

• Expanded operator feedback. Configuration checks now catch likely token-file mixups and warn about additional cases of family-specific settings being ignored because their provider is disabled. Diagnostics for Shoutrrr URLs containing spaces now identify the configuration source, report the correct line number, and give clearer guidance on how to fix the issue. Shoutrrr success logs now identify the notification type. (#1204) (#1227) (#1230) (#1250)

This release adds experimental controls for per-domain IPv6 host IDs and detected-address filtering, and makes advanced configuration easier to validate. It also removes the startup token-verification request that produced misleading warnings for valid account API tokens.

Highlights

1. Per-domain IPv6 host IDs. Advanced IPv6 setups can now control the host bits of each domain's AAAA records by adding the experimental hostid6 field to entries in DOMAINS or IP6_DOMAINS, for example example.org{hostid6=::1}. A domain can preserve the detected host bits, replace them with a fixed host ID, or derive one from a MAC address. This changes only AAAA record derivation; WAF lists continue to use the raw detected prefixes. (#1224)
2. IPv4 and IPv6 detection filters. New experimental IP4_DETECTION_FILTER and IP6_DETECTION_FILTER expressions select detected addresses before both DNS and WAF reconciliation. If a filter removes every address for one family, the updater preserves that family's existing managed content for the round. (#1231)
3. Advisory linting for PROXIED. The updater now warns about suspicious boolean expressions, including constant results and redundant or subsumed terms. (#1235)
4. Account API tokens no longer trigger misleading startup warnings. The updater no longer calls Cloudflare's user-token verification endpoint during startup. Malformed token values are still rejected locally. A well-formed token that is invalid or lacks permission for an attempted DNS or WAF operation is instead reported when that operation fails, with the corresponding permission guidance. (#1240)

Other Notable Changes

Features

• New SHOUTRRR_FILE reads Shoutrrr notification URLs from a file, making mounted secrets usable without putting token-bearing URLs in environment values. If SHOUTRRR and SHOUTRRR_FILE are both set, they must specify the same URLs. (#1241)

Bug Fixes

• When both HEALTHCHECKS and UPTIMEKUMA are configured, a failure from either service no longer prevents the updater from contacting the other. (#1249)

Message Improvements

• Expanded operator feedback. Configuration checks now catch likely token-file mixups and warn about additional cases of family-specific settings being ignored because their provider is disabled. Diagnostics for Shoutrrr URLs containing spaces now identify the configuration source, report the correct line number, and give clearer guidance on how to fix the issue. Shoutrrr success logs now identify the notification type. (#1204) (#1227) (#1230) (#1250)

This release adds experimental controls for per-domain IPv6 host IDs and detected-address filtering, and makes advanced configuration easier to validate. It also removes the startup token-verification request that produced misleading warnings for valid account API tokens.

Highlights

1. Per-domain IPv6 host IDs. Advanced IPv6 setups can now control the host bits of each domain's AAAA records by adding the experimental hostid6 field to entries in DOMAINS or IP6_DOMAINS, for example example.org{hostid6=::1}. A domain can preserve the detected host bits, replace them with a fixed host ID, or derive one from a MAC address. This changes only AAAA record derivation; WAF lists continue to use the raw detected prefixes. (#1224)
2. IPv4 and IPv6 detection filters. New experimental IP4_DETECTION_FILTER and IP6_DETECTION_FILTER expressions select detected addresses before both DNS and WAF reconciliation. If a filter removes every address for one family, the updater preserves that family's existing managed content for the round. (#1231)
3. Advisory linting for PROXIED. The updater now warns about suspicious boolean expressions, including constant results and redundant or subsumed terms. (#1235)
4. Account API tokens no longer trigger misleading startup warnings. The updater no longer calls Cloudflare's user-token verification endpoint during startup. Malformed token values are still rejected locally. A well-formed but invalid or insufficiently scoped token is instead reported when the first DNS or WAF operation uses it, with the corresponding permission guidance. (#1240)

Other Notable Changes

Features

• New SHOUTRRR_FILE reads Shoutrrr notification URLs from a file, making mounted secrets usable without putting token-bearing URLs in environment values. If SHOUTRRR and SHOUTRRR_FILE are both set, they must specify the same URLs. (#1241)

Bug Fixes

• When both HEALTHCHECKS and UPTIMEKUMA are configured, a failure from either service no longer prevents the updater from contacting the other. (#1249)

Message Improvements

• Expanded operator feedback. Configuration checks now catch likely token-file mixups and warn about additional cases of family-specific settings being ignored because their provider is disabled. Warnings about Shoutrrr URLs containing spaces now report the original source line and show the exact URL encoding or YAML block-style fixes. Shoutrrr success logs now identify the notification type. (#1204) (#1227) (#1230) (#1250)

This is a quick bugfix release for users affected by a startup regression in 1.16.0. If 1.16.0 or 1.16.1 reports that your Cloudflare API token is invalid during startup even though the token had worked before 1.16.0, upgrade to 1.16.2. If version 1.16.0 or 1.16.1 is working well for you, there is no rush.

We will continue investigating the unexpected behavior around Cloudflare’s token-verification endpoint; see #1197.

Detailed Changes

Bug Fixes

• Relax startup token verification so inconsistent failures from Cloudflare’s token-verify endpoint no longer stop the updater immediately. (#1198)

This is a quick bugfix release for users affected by a startup regression in 1.16.0. If 1.16.0 or 1.16.1 reports that your Cloudflare API token is invalid during startup even though the token had worked before 1.16.0, upgrade to 1.16.2. If version 1.16.0 or 1.16.1 is working well for you, there is no rush.

We will continue investigating the unexpected behavior around Cloudflare’s token-verification endpoint; see #1197.

Detailed Changes

Bug Fixes

• Relax startup token verification so inconsistent failures from Cloudflare’s token-verify endpoint no longer stop the updater immediately. (#1198)

This is a bugfix release for the new static.empty provider introduced in 1.16.0. If you are not using static.empty, this release should not affect you. A nice consequence of these fixes is the following one-shot wipe-all workflow:

• Set UPDATE_CRON=@once for a single-run execution.
• Set IP4_PROVIDER=static.empty and IP6_PROVIDER=static.empty to clear all managed DNS records and WAF items.
• Optionally set DELETE_ON_STOP=true to make the updater also try to delete the WAF lists themselves.

Note: this workflow is for using the updater as a single-run command, not as a long-running Docker deployment.

Reminders from the Past

Please provide feedback on the proposed syntax of upcoming features:

• Per-domain IPv6 host IDs (#764): IP6_DOMAINS=sub.example.com{hostid6=::2}
• Detection IP filtering (#1138): IP4_DETECTION_FILTER=!addr-in(10.0.0.0/8)

If you are still using PUID and PGID, please migrate to Docker’s built-in security mechanism; see the changelogs of previous versions.

Detailed Changes

Bug Fixes

• static.empty no longer creates a missing WAF list. In addition, DELETE_ON_STOP=true with UPDATE_CRON=@once is now accepted when every managed IP family uses static.empty or none. (#1190)

This is a bugfix release for the new static.empty provider introduced in 1.16.0. If you are not using static.empty, this release should not affect you. A nice consequence of these fixes is the following one-shot wipe-all workflow:

• Set UPDATE_CRON=@once for a single-run execution.
• Set IP4_PROVIDER=static.empty and IP6_PROVIDER=static.empty to clear all managed DNS records and WAF items.
• Optionally set DELETE_ON_STOP=true to make the updater also try to delete the WAF lists themselves.

Note: this workflow is for using the updater as a single-run command, not as a long-running Docker deployment.

Reminders from the Past

Please provide feedback on the proposed syntax of upcoming features:

• Per-domain IPv6 host IDs (#764): IP6_DOMAINS=sub.example.com{hostid6=::2}
• Detection IP filtering (#1138): IP4_DETECTION_FILTER=!addr-in(10.0.0.0/8)

If you are still using PUID and PGID, please migrate to Docker’s built-in security mechanism; see the changelogs of previous versions.

Detailed Changes

Bug Fixes

• static.empty no longer creates a missing WAF list. In addition, DELETE_ON_STOP=true with UPDATE_CRON=@once is now accepted when every managed IP family uses static.empty or none. (#1190)

Despite the gap of over a year since the last release, we are not aware of any security vulnerability affecting the default configuration. As always, please review the changelog and watch for warnings or errors when upgrading.

Highlights

1. WAF lists now support /128 IPv6 entries. Cloudflare’s API now accepts individual IPv6 addresses in WAF lists. New IP4_DEFAULT_PREFIX_LEN (default /32) and IP6_DEFAULT_PREFIX_LEN (default /64) control how bare addresses are stored in WAF lists. Users can now set IP6_DEFAULT_PREFIX_LEN to 128 for per-address granularity. DNS records currently ignore prefix lengths, but will use these in the future.
2. Multi-instance support via comment-based selection. New MANAGED_RECORDS_COMMENT_REGEX and MANAGED_WAF_LIST_ITEMS_COMMENT_REGEX let multiple updater instances safely share the same domain or WAF list, each managing only records or items with matching comments. New WAF_LIST_ITEM_COMMENT provides a fallback comment for WAF list items, similar to how RECORD_COMMENT serves as a fallback for DNS records.
3. Multi-IP detection and reconciliation. Providers now return multiple IP addresses, each with a CIDR prefix length, and the reconciliation algorithm has been redesigned to handle them correctly. The experimental local.iface provider now collects all matching global unicast addresses from the specified interface, instead of just the first one. Multi-address support in url: and file: providers is also experimental.
4. New file: provider. Reads IP addresses from a local file, re-reading each detection cycle. This enables integration with external scripts or monitoring systems without restarting the updater. (Multi-address support is experimental.)
5. New variants of url: (url.via4: and url.via6:) for transport overrides. By default, url:<url> connects using the same IP family as the address being detected. Override the IP family used to connect with url.via4:<url> or url.via6:<url> (e.g., get an IPv6 address over an IPv4 connection). (Multi-address support in URL-based providers is experimental.)
6. Rewritten user-facing messages. Many log messages have been reworded into clearer, more natural English.

Your Feedback Wanted

The IP prefix length work in this release lays the groundwork for several upcoming features. We’d love your input on the proposed configuration syntax:

• Per-domain IPv6 host IDs (#764):
  • IP6_DOMAINS=sub.example.com{hostid6=::2}
  • IP6_DOMAINS=sub.example.com{hostid6=preserve} (keep the detected host IDs)
  • IP6_DOMAINS=sub.example.com{hostid6=mac(77:cc:a7:f9:45:94)} (compute an EUI-64 host ID from a MAC address)
  • DOMAINS=sub1.example.com{hostid6=::aad1},sub2.example.com{hostid6=preserve}
• Detection IP filtering (#1138):
  • IP6_DETECTION_FILTER=keep-all
  • IP6_DETECTION_FILTER=!addr-in(fc00::/7)
  • IP6_DETECTION_FILTER=subnet-in(2001:db8:abcd::/48)
  • IP4_DETECTION_FILTER=!addr-in(10.0.0.0/8) && !addr-in(192.168.0.0/16)
  • IP6_DETECTION_FILTER=contains(2002:dead:beef::/100) || contains(2005:dead:beef::/100)

Also planned: a linter for boolean expressions targeting advanced usage of PROXIED and the upcoming IP4/6_DETECTION_FILTER, and further robustness improvements to the default cloudflare.trace provider.

Reminder from the Past

As a reminder, since 1.13.0, the updater no longer drops privileges internally, and PUID and PGID are ignored. Please use Docker’s built-in mechanism to drop privileges. The old Docker Compose template may grant unneeded privileges to the new updater, which is not recommended. Please review the new, simpler, and more secure template in README. In a nutshell, remove the cap_add attribute and replace the environment variables PUID and PGID with the user: "UID:GID" attribute. Similar options may exist for systems not using Docker Compose.

Other Notes

Shoutrrr support is no longer experimental. The shoutrrr notification integration, introduced in 1.12.0, is now considered stable.

Detailed Changes

Features

• The detection model has been redesigned so that providers return multiple IP addresses, each with a CIDR prefix length. New IP4_DEFAULT_PREFIX_LEN and IP6_DEFAULT_PREFIX_LEN settings control how bare addresses are stored in WAF lists. (#1144) (#1156)
• The reconciliation algorithm has been redesigned to handle complex metadata mismatches when multiple IP addresses result in multiple records. (#1015) (#1020) (#1022) (#1115)
• New file: provider reads IP addresses from a local file. (#1148)
• New static:<ip1>,<ip2>,... and static.empty providers have been added. static.empty actively clears managed content for a given IP family. (#1102) (#1135)
• The url:, file:, and static: providers now accept addresses in CIDR notation (e.g., 198.51.100.1/24). (#1159) (#1169)
• The experimental local.iface provider now collects all matching global unicast addresses. (#1095)
• New MANAGED_RECORDS_COMMENT_REGEX selects only DNS records whose comments match a regex. (#1103)
• New MANAGED_WAF_LIST_ITEMS_COMMENT_REGEX and WAF_LIST_ITEM_COMMENT provide the same comment-based selection for WAF list items. (#1106)
• New url.via4:<url> and url.via6:<url> providers override the IP family used to connect to a custom URL. (#1131)
• The updater now warns about likely misconfigured SHOUTRRR values. (#1111)

Bug Fixes

• The configuration parser now warns about extra commas in lists (e.g., a,,b) except for trailing commas, which were silently ignored. (#1177)
• The updater now exits gracefully when EMOJI or QUIET is invalid. (#1174)
• The updater invalidates relevant zone search cache entries when a zone cannot be found for faster recovery. (#1125)
• API token verification is now stricter, catching malformed tokens before any update attempts. (#1126)
• Providers (especially cloudflare.trace and cloudflare.doh) now validate detected IP addresses more strictly. (#1097) (#1099) (#1101) (#1151)
• WAF list entries in the configuration are now deduplicated. (#1091)
• The updater now warns when a configured domain does not look like a fully qualified domain name. (#1019)
• The updater now warns when DNS records and WAF list items for the same domain have mixed ownership (some managed, some not). (#1173)

Despite the gap of over a year since the last release, we are not aware of any security vulnerability affecting the default configuration. As always, please review the changelog and watch for warnings or errors when upgrading.

Highlights

1. WAF lists now support /128 IPv6 entries. Cloudflare’s API now accepts individual IPv6 addresses in WAF lists. New IP4_DEFAULT_PREFIX_LEN (default /32) and IP6_DEFAULT_PREFIX_LEN (default /64) control how bare addresses are stored in WAF lists. Users can now set IP6_DEFAULT_PREFIX_LEN to 128 for per-address granularity. DNS records currently ignore prefix lengths, but will use these in the future.
2. Multi-instance support via comment-based selection. New MANAGED_RECORDS_COMMENT_REGEX and MANAGED_WAF_LIST_ITEMS_COMMENT_REGEX let multiple updater instances safely share the same domain or WAF list, each managing only records or items with matching comments. New WAF_LIST_ITEM_COMMENT provides a fallback comment for WAF list items, similar to how RECORD_COMMENT serves as a fallback for DNS records.
3. Multi-IP detection and reconciliation. Providers now return multiple IP addresses, each with a CIDR prefix length, and the reconciliation algorithm has been redesigned to handle them correctly. The experimental local.iface provider now collects all matching global unicast addresses from the specified interface, instead of just the first one. Multi-address support in url: and file: providers is also experimental.
4. New file: provider. Reads IP addresses from a local file, re-reading each detection cycle. This enables integration with external scripts or monitoring systems without restarting the updater. (Multi-address support is experimental.)
5. New variants of url: (url.via4: and url.via6:) for transport overrides. By default, url:<url> connects using the same IP family as the address being detected. Override the IP family used to connect with url.via4:<url> or url.via6:<url> (e.g., get an IPv6 address over an IPv4 connection). (Multi-address support in URL-based providers is experimental.)
6. Rewritten user-facing messages. Many log messages have been reworded into clearer, more natural English.

Your Feedback Wanted

The IP prefix length work in this release lays the groundwork for several upcoming features. We’d love your input on the proposed configuration syntax:

• Per-domain IPv6 host IDs (#764):
  • IP6_DOMAINS=sub.example.com{hostid6=::2}
  • IP6_DOMAINS=sub.example.com{hostid6=preserve} (keep the detected host IDs)
  • IP6_DOMAINS=sub.example.com{hostid6=mac(77:cc:a7:f9:45:94)} (compute an EUI-64 host ID from a MAC address)
  • DOMAINS=sub1.example.com{hostid6=::aad1},sub2.example.com{hostid6=preserve}
• Detection IP filtering (#1138):
  • IP6_DETECTION_FILTER=keep-all
  • IP6_DETECTION_FILTER=!addr-in(fc00::/7)
  • IP6_DETECTION_FILTER=subnet-in(2001:db8:abcd::/48)
  • IP4_DETECTION_FILTER=!addr-in(10.0.0.0/8) && !addr-in(192.168.0.0/16)
  • IP6_DETECTION_FILTER=contains(2002:dead:beef::/100) || contains(2005:dead:beef::/100)

Also planned: a linter for boolean expressions targeting advanced usage of PROXIED and the upcoming IP4/6_DETECTION_FILTER, and further robustness improvements to the default cloudflare.trace provider.

Reminder from the Past

As a reminder, since 1.13.0, the updater no longer drops privileges internally, and PUID and PGID are ignored. Please use Docker’s built-in mechanism to drop privileges. The old Docker Compose template may grant unneeded privileges to the new updater, which is not recommended. Please review the new, simpler, and more secure template in README. In a nutshell, remove the cap_add attribute and replace the environment variables PUID and PGID with the user: "UID:GID" attribute. Similar options may exist for systems not using Docker Compose.

Other Notes

Shoutrrr support is no longer experimental. The shoutrrr notification integration, introduced in 1.12.0, is now considered stable.

Detailed Changes

Features

• The detection model has been redesigned so that providers return multiple IP addresses, each with a CIDR prefix length. New IP4_DEFAULT_PREFIX_LEN and IP6_DEFAULT_PREFIX_LEN settings control how bare addresses are stored in WAF lists. (#1144) (#1156)
• The reconciliation algorithm has been redesigned to handle complex metadata mismatches when multiple IP addresses result in multiple records. (#1015) (#1020) (#1022) (#1115)
• New file: provider reads IP addresses from a local file. (#1148)
• New static:<ip1>,<ip2>,... and static.empty providers have been added. static.empty actively clears managed content for a given IP family. (#1102) (#1135)
• The url:, file:, and static: providers now accept addresses in CIDR notation (e.g., 198.51.100.1/24). (#1159) (#1169)
• The experimental local.iface provider now collects all matching global unicast addresses. (#1095)
• New MANAGED_RECORDS_COMMENT_REGEX selects only DNS records whose comments match a regex. (#1103)
• New MANAGED_WAF_LIST_ITEMS_COMMENT_REGEX and WAF_LIST_ITEM_COMMENT provide the same comment-based selection for WAF list items. (#1106)
• New url.via4:<url> and url.via6:<url> providers override the IP family used to connect to a custom URL. (#1131)
• The updater now warns about likely misconfigured SHOUTRRR values. (#1111)

Bug Fixes

• The configuration parser now warns about extra commas in lists (e.g., a,,b) except for trailing commas, which were silently ignored. (#1177)
• The updater now exits gracefully when EMOJI or QUIET is invalid. (#1174)
• The updater invalidates relevant zone search cache entries when a zone cannot be found for faster recovery. (#1125)
• API token verification is now stricter, catching malformed tokens before any update attempts. (#1126)
• Providers (especially cloudflare.trace and cloudflare.doh) now validate detected IP addresses more strictly. (#1097) (#1099) (#1101) (#1151)
• WAF list entries in the configuration are now deduplicated. (#1091)
• The updater now warns when a configured domain does not look like a fully qualified domain name. (#1019)
• The updater now warns when DNS records and WAF list items for the same domain have mixed ownership (some managed, some not). (#1173)

This is a minor release that modifies the Cloudflare URLs used by the IP providers cloudflare.trace (the default) and cloudflare.doh. The IP provider cloudflare.trace was updated to address recent mysterious 1034 errors from Cloudflare servers. Additionally, both providers have been switched away from 1.1.1.1, eliminating the need for a detection algorithm to determine whether 1.0.0.1 is a more suitable alternative. This simplification results in cleaner code and potentially lower resource usage.

For enhanced debugging capabilities, we have introduced a new Docker tag, edge-alpine. This tag provides a full Alpine Linux environment, offering basic system tools and libraries. Please note that this image is larger than the standard development tag edge and is not minimal.

As a reminder, since 1.13.0, the updater no longer drops superuser privileges and PUID and PGID are ignored. Please use Docker’s built-in mechanism to drop privileges. The old Docker Compose template may grant unneeded privileges to the new updater, which is not recommended. Please review the new, simpler, and more secure template in README. In a nutshell, remove the cap_add attribute and replace the environment variables PUID and PGID with the user: "UID:GID" attribute. Similar options may exist for systems not using Docker Compose.

Bug Fixes

• protocol: quote unknown strings in logging (#986) (b4d52b0)
• provider: change cloudflare.doh and cloudflare.trace URLs (#994) (eaa9c61)

Features

• Add a new Docker image tagged edge-alpine that contains Alpine Linux (not minimal) (#978) (#980) (21d9f94) (7d8ef9a) (#981) (c9f4f12) (#982) (73a4ba3) (#998) (bd85cad)
• provider: add undocumented debug.const provider (#966) (638c1a2)
• provider: add undocumented cloudflare.trace:URL provider (#988) (7afb1d2)

This is a minor release that modifies the Cloudflare URLs used by the IP providers cloudflare.trace (the default) and cloudflare.doh. The IP provider cloudflare.trace was updated to address recent mysterious 1034 errors from Cloudflare servers. Additionally, both providers have been switched away from 1.1.1.1, eliminating the need for a detection algorithm to determine whether 1.0.0.1 is a more suitable alternative. This simplification results in cleaner code and potentially lower resource usage.

For enhanced debugging capabilities, we have introduced a new Docker tag, edge-alpine. This tag provides a full Alpine Linux environment, offering basic system tools and libraries. Please note that this image is larger than the standard development tag edge and is not minimal.

As a reminder, since 1.13.0, the updater no longer drops superuser privileges and PUID and PGID are ignored. Please use Docker’s built-in mechanism to drop privileges. The old Docker Compose template may grant unneeded privileges to the new updater, which is not recommended. Please review the new, simpler, and more secure template in README. In a nutshell, remove the cap_add attribute and replace the environment variables PUID and PGID with the user: "UID:GID" attribute. Similar options may exist for systems not using Docker Compose.

Bug Fixes

• protocol: quote unknown strings in logging (#986) (b4d52b0)
• provider: change cloudflare.doh and cloudflare.trace URLs (#994) (eaa9c61)

Features

• Add a new Docker image tagged edge-alpine that contains Alpine Linux (not minimal) (#978) (#980) (21d9f94) (7d8ef9a) (#981) (c9f4f12) (#982) (73a4ba3) (#998) (bd85cad)
• provider: add undocumented debug.const provider (#966) (638c1a2)
• provider: add undocumented cloudflare.trace:URL provider (#988) (7afb1d2)

This is a major release with many improvements:

1. New CLOUDFLARE_* variables: Cloudflare is transitioning its tools to use the new prefix CLOUDFLARE_*. Therefore, the updater now accepts CLOUDFLARE_API_TOKEN and CLOUDFLARE_API_TOKEN_FILE. The old CF_API_TOKEN and CF_API_TOKEN_FILE will still be fully supported until 2.0.0, then deprecated (but still supported) until 3.0.0.
2. Improved custom IP providers: The updater now forces IPv4 or IPv6 when connecting to custom IP providers url:<URL>. This solves a long-standing issue where custom providers couldn't be used on dual-stack machines supporting both IPv4 and IPv6. This enforcement ensures predictable IPv4/IPv6 detection on such machines.
3. Stricter IP validation: The updater now rejects unusual IP addresses for updating DNS records, such as link-local addresses or IPv4-mapped IPv6 addresses for AAAA records. These addresses are unsuitable and may cause trouble.
4. Experimental support of using a network interface’s IP address (not finalized until 1.16.0): Experimental support lets you use the address assigned to a specific network interface, bypassing the routing table used by the local provider. The syntax for this feature is under development and will not be finalized until 1.16.0. Please refer to README and join the discussion on GitHub issue #713 if you are interested.

As a reminder, since 1.13.0, the updater no longer drops superuser privileges and PUID and PGID are ignored. Please use Docker’s built-in mechanism to drop privileges. The old Docker Compose template may grant unneeded privileges to the new updater, which is not recommended. Please review the new, simpler, and more secure template in README. In a nutshell, remove the cap_add attribute and replace the environment variables PUID and PGID with the user: "UID:GID" attribute. Similar options may exist for systems not using Docker Compose.

Bug Fixes

• ipnet: reject IPv4-mapped IPv6 addresses for updating IPv6 records (#936) (be5b3a7)
• ipnet: tighten the checking of IP addresses (#942) (640d30b)
• pp: print blank lines to separate each round of updating (#958) (0a6c71b)
• provider: fix the name and messages of custom URL providers (#940) (2d95d69)
• provider: force IPv4/IPv6 for custom URL providers (#939) (3e80358)
• updater: actively close idle connections for IP detection (#943) (05cbf7e)

Features

• config: accept CLOUDFLARE_* and all compatible token settings (#948) (4fc883c)
• provider: get IP from a specific network interface (#941) (69f8cf2) (#947) (4518fac)

This is a major release with many improvements:

1. New CLOUDFLARE_* variables: Cloudflare is transitioning its tools to use the new prefix CLOUDFLARE_*. Therefore, the updater now accepts CLOUDFLARE_API_TOKEN and CLOUDFLARE_API_TOKEN_FILE. The old CF_API_TOKEN and CF_API_TOKEN_FILE will still be fully supported until 2.0.0, then deprecated (but still supported) until 3.0.0.
2. Improved custom IP providers: The updater now forces IPv4 or IPv6 when connecting to custom IP providers url:<URL>. This solves a long-standing issue where custom providers couldn't be used on dual-stack machines supporting both IPv4 and IPv6. This enforcement ensures predictable IPv4/IPv6 detection on such machines.
3. Stricter IP validation: The updater now rejects unusual IP addresses for updating DNS records, such as link-local addresses or IPv4-mapped IPv6 addresses for AAAA records. These addresses are unsuitable and may cause trouble.
4. Experimental support of using a network interface’s IP address (not finalized until 1.16.0): Experimental support lets you use the address assigned to a specific network interface, bypassing the routing table used by the local provider. The syntax for this feature is under development and will not be finalized until 1.16.0. Please refer to README and join the discussion on GitHub issue #713 if you are interested.

As a reminder, since 1.13.0, the updater no longer drops superuser privileges and PUID and PGID are ignored. Please use Docker’s built-in mechanism to drop privileges. The old Docker Compose template may grant unneeded privileges to the new updater, which is not recommended. Please review the new, simpler, and more secure template in README. In a nutshell, remove the cap_add attribute and replace the environment variables PUID and PGID with the user: "UID:GID" attribute. Similar options may exist for systems not using Docker Compose.

Bug Fixes

• ipnet: reject IPv4-mapped IPv6 addresses for updating IPv6 records (#936) (be5b3a7)
• ipnet: tighten the checking of IP addresses (#942) (640d30b)
• pp: print blank lines to separate each round of updating (#958) (0a6c71b)
• provider: fix the name and messages of custom URL providers (#940) (2d95d69)
• provider: force IPv4/IPv6 for custom URL providers (#939) (3e80358)
• updater: actively close idle connections for IP detection (#943) (05cbf7e)

Features

• config: accept CLOUDFLARE_* and all compatible token settings (#948) (4fc883c)
• provider: get IP from a specific network interface (#941) (69f8cf2) (#947) (4518fac)

This is an urgent hotfix that resolves a nil pointer dereference issue introduced in version 1.14.1.

Bug Fixes

• fix a nil pointer bug introduced by the commit 319e6a0 (issue #911) (#930) (3ea0eb9)

This is an urgent hotfix that resolves a nil pointer dereference issue introduced in version 1.14.1.

Bug Fixes

• fix a nil pointer bug introduced by the commit 319e6a0 (issue #911) (#930) (3ea0eb9)

This version is buggy; use version 1.14.2 instead.

This is a minor release that addresses minor issues and improves the usability of the new feature for managing WAF lists, which was initially introduced in version 1.14.0.

Bug Fixes

• reduce unnecessary quotation marks in logging (#925) (dc3a26b)

Features

• api: clear a WAF list when it cannot be deleted (#908) (1acf11d)
• api: warn about mismatched attributes (#921) (80388a0)

This version is buggy; use version 1.14.2 instead.

This is a minor release that addresses minor issues and improves the usability of the new feature for managing WAF lists, which was initially introduced in version 1.14.0.

Bug Fixes

• reduce unnecessary quotation marks in logging (#925) (dc3a26b)

Features

• api: clear a WAF list when it cannot be deleted (#908) (1acf11d)
• api: warn about mismatched attributes (#921) (80388a0)

This is a major release with many improvements! The most significant new feature is the ability to maintain a WAF list of detected IP addresses; you can then refer to the list in your firewall rules. Please consult the README. The second most important update is to use a variant of the Happy Eyeballs (Fast Fallback) algorithm to detect the blockage of 1.1.1.1. As the name of the new algorithm suggests, you should not notice any delay due to the detection, being happy. 😄

As a reminder, since 1.13.0, the updater will no longer drop superuser privileges and PUID and PGID will be ignored. Please use Docker’s built-in mechanism to drop privileges. The old Docker Compose template may grant the new updater unneeded privileges, which is not recommended. Please review the new template in README that is simpler and more secure when combined with the new updater. In a nutshell, remove the cap_add attribute and replace the environment variables PUID and PGID with the user: "UID:GID" attribute. If you are not using Docker Compose, chances are your system supports similar options under different names.

Other notable changes:

1. The global Cloudflare account ID will no longer be used when searching for DNS zones. CF_ACCOUNT_ID will be ignored.
2. To reduce network traffic and delay, the Cloudflare API token will no longer be additionally verified via Cloudflare’s token verification API. Instead, the updater will locally check whether the token looks like a valid Bearer Token before using the API.
3. Many parts of the README have been rewritten to improve clarity and to document the support of WAF lists.
4. The DNS record updating algorithm was revised to be more deterministic, which means the updater will not give up updating stale DNS records (and create new ones) when there are errors; it will simply try again next time. As a result, in very rare cases, the updater may need more rounds to recover from errors.

Bug Fixes

• api: decouple account IDs from operations on DNS records (#875) (0fa1085)
• api: eliminate potential memory leak in caching (#854) (b9c7327)
• api: make the updating algorithm more deterministic (#864) (b557c41)
• api: remove global account ID and remote token verification (#877) (5a40ea7)
• monitor: retry connections to Uptime Kuma (#890) (8236410)
• setter: do not quote DNS record IDs (#851) (fc8accb)
• updater: delete unmanaged IP addresses from WAF lists (#885) (bf0361c)
• updater: show the hint to disable a network when IP detection timeouts (#859) (bdf154c) (#862) (397e722)

Features

• api: ability to update WAF lists (#797) (180bcd7)
• provider: Happy Eyeballs for 1.1.1.1 v.s. 1.0.0.1 (#883) (be0109b)

This is a major release with many improvements! The most significant new feature is the ability to maintain a WAF list of detected IP addresses; you can then refer to the list in your firewall rules. Please consult the README. The second most important update is to use a variant of the Happy Eyeballs (Fast Fallback) algorithm to detect the blockage of 1.1.1.1. As the name of the new algorithm suggests, you should not notice any delay due to the detection, being happy. 😄

As a reminder, since 1.13.0, the updater will no longer drop superuser privileges and PUID and PGID will be ignored. Please use Docker’s built-in mechanism to drop privileges. The old Docker Compose template may grant the new updater unneeded privileges, which is not recommended. Please review the new template in README that is simpler and more secure when combined with the new updater. In a nutshell, remove the cap_add attribute and replace the environment variables PUID and PGID with the user: "UID:GID" attribute. If you are not using Docker Compose, chances are your system supports similar options under different names.

Other notable changes:

1. The global Cloudflare account ID will no longer be used when searching for DNS zones. CF_ACCOUNT_ID will be ignored.
2. To reduce network traffic and delay, the Cloudflare API token will no longer be additionally verified via Cloudflare’s token verification API. Instead, the updater will locally check whether the token looks like a valid Bearer Token before using the API.
3. Many parts of the README have been rewritten to improve clarity and to document the support of WAF lists.
4. The DNS record updating algorithm was revised to be more deterministic, which means the updater will not give up updating stale DNS records (and create new ones) when there are errors; it will simply try again next time. As a result, in very rare cases, the updater may need more rounds to recover from errors.

Bug Fixes

• api: decouple account IDs from operations on DNS records (#875) (0fa1085)
• api: eliminate potential memory leak in caching (#854) (b9c7327)
• api: make the updating algorithm more deterministic (#864) (b557c41)
• api: remove global account ID and remote token verification (#877) (5a40ea7)
• monitor: retry connections to Uptime Kuma (#890) (8236410)
• setter: do not quote DNS record IDs (#851) (fc8accb)
• updater: delete unmanaged IP addresses from WAF lists (#885) (bf0361c)
• updater: show the hint to disable a network when IP detection timeouts (#859) (bdf154c) (#862) (397e722)

Features

• api: ability to update WAF lists (#797) (180bcd7)
• provider: Happy Eyeballs for 1.1.1.1 v.s. 1.0.0.1 (#883) (be0109b)

This is a quick release to change the default user/group IDs of the shipped Docker images to 1000 (instead of 0, the root). The change will help many people use the Docker images more safely. You are still encouraged to review whether the default ID 1000 is what you want. If you have already adopted the new recommended Docker template (in README) with user: ... (not PUID or PGID) to explicitly set the user and group IDs, this release does not affect you.

This is a quick release to change the default user/group IDs of the shipped Docker images to 1000 (instead of 0, the root). The change will help many people use the Docker images more safely. You are still encouraged to review whether the default ID 1000 is what you want. If you have already adopted the new recommended Docker template (in README) with user: ... (not PUID or PGID) to explicitly set the user and group IDs, this release does not affect you.

This is a very minor release that improves the error messages produced by the new API token verifier (introduced in 1.13.0). See #813.

Bug Fixes

• domain: fix incorrect parsing of *.*.foo.bar (#809) (9ccf9df)

This is a major release that no longer drops superuser privileges. Please review the instructions in README for the new recommended setup.

BREAKING CHANGES

• The updater will no longer drop superuser privileges and PUID and PGID will be ignored. Please use Docker’s built-in mechanism to drop privileges. The old, hacky Docker Compose template will grant the new updater unneeded privileges, which is less secure and not recommended. Please review the new template in README that is simpler and more secure when combined with the new updater. In a nutshell, remove cap_add completely and add user: ... as

  user: "1000:1000"
  # Run the updater with a specific user ID and group ID (in that order).
  # You should change the two numbers based on your setup.
  

  If you have not, please add cap_drop: [all] to drop all Linux capabilities. You should probably remove PUID and PGID as well because they are now useless.

• In case you are using the *-nocapdrop Docker tags, they will no longer be maintained. The updater will no longer drop superuser privileges, and thus the nocapdrop builds are identical to the regular ones. Just use the regular Docker tags such as latest.

• The older versions used to add the comment “Created by cloudflare-ddns” to all newly created DNS records. Since this version, the comment has become configurable, but by default it is empty. To restore the old behavior, add the configuration RECORD_COMMENT=Created by cloudflare-ddns (or any comment you want to use).

Features

• api: make record comment of new DNS records configurable using RECORD_COMMENT (#783) (b10c9a3)
• api: recheck tokens if the network is temporarily down (#790) (15d1a5a)
• api: smarter sanity checking (#796) (80dc7f4)
• cron: show dates when needed (#795) (d1850b1)
• config: recheck 1.1.1.1 and 1.0.0.1 some time later when probing fails (possibly because the network is temporarily down) (#788) (0983b06)
• updater: bail out faster when it times out (#784) (3b42131)