Cloudflare DDNS improvements

At some point I wrote that I built my own Cloudflare DDNS. If you want to check out the GitHub repo, here it is: https://github.com/alexmihai1984/cloudflare-ddns.

After running it for a while I had a couple of improvement ideas. Both ideas are rooted in an actual issue I had with it. In order to figure out the public IP to point the DNS records towards, what the tool did was to make a request to https://1.1.1.1/cdn-cgi/trace. You can make a request right now in your browser to see how that looks like. The point is that it contains your public IP. And it works. Most of the time. But unfortunately there have been a couple of instances of long stretches of time (hours) when it would return some Cloudflare IP.

So the DDNS would see the public IP has changed, update the DNS records to that other IP and all my self-hosted websites would go down. Now… I don’t host anything overly important, I don’t mind some downtime. But that was completely unnecessary as everything on my side was working fine.

So I decided to do a couple of things.

Health-check

I decided to introduce a health-check (optional). The DDNS was checking every 60s if the public IP has changed and updating it if needed.

But given my issue, why check or change anything if my websites are up? So optionally you can now enable the health-check feature and provide an URL. If the URL you provide returns status 200 OK, the DDNS will continue, it won’t attempt anything further.

You can do that with the following configuration:

healthcheck:
  enabled: true
  url: https://yourdomain.com
  connect-timeout: 10s
  request-timeout: 10s

The connect-timeout and request-timeout values are optional, they default to 10s, but you can provide whatever you feel is appropriate for your situation.

Public IP consensus

While now it’s much more unlikely to have the Cloudflare URL https://1.1.1.1/cdn-cgi/trace misbehave exactly after your public IP changes, it’s still theoretically possible.

So I decided to introduce multiple URLs that can provide you public IP and build a consensus based on what each of them return. Even if a minority of them returns bullshit, the consensus will still dictate the correct public IP.

The majority decides. Democracy is great, too bad we don’t have it anymore.

This is also configurable, you can change it in theory, but I’d recommend you don’t. As of now there are 5 URLs that contribute to this, 2 from Cloudflare and 3 from other parties. So even if Cloudflare shits itself on both URLs, the others win as long as they agree. Here’s how that looks like:

ip-providers:
  providers:
    - name: aws
      url: https://checkip.amazonaws.com
      type: plain_text
    - name: icanhazip
      url: https://icanhazip.com
      type: plain_text
    - name: ipify
      url: https://api.ipify.org
      type: plain_text
    - name: cloudflare
      url: https://1.1.1.1/cdn-cgi/trace
      type: cloudflare_trace
    - name: cloudflare_backup
      url: https://1.0.0.1/cdn-cgi/trace
      type: cloudflare_trace

The type dictates how the response is interpreted, plain_text means the response from the provider contains just the IP, while cloudflare_trace means the response from the provider is a bunch of key-value pairs, one of which is ip=<your ip>.

What’s next?

I’m tempted to build a UI for this tool, I admit it’s pretty annoying to make config changes when you want to add a domain for example.

Hope this helps, have fun clickity-clacking.