This is a major release with many improvements! The most significant new feature is the ability to maintain a WAF list of detected IP addresses; you can then refer to the list in your firewall rules. Please consult the README. The second most important update is to use a variant of the Happy Eyeballs (Fast Fallback) algorithm to detect the blockage of 1.1.1.1. As the name of the new algorithm suggests, you should not notice any delay due to the detection, being happy. 😄
As a reminder, since 1.13.0, the updater will no longer drop superuser privileges and PUID and PGID will be ignored. Please use Docker’s built-in mechanism to drop privileges. The old Docker Compose template may grant the new updater unneeded privileges, which is not recommended. Please review the new template in README that is simpler and more secure when combined with the new updater. In a nutshell, remove the cap_add attribute and replace the environment variables PUID and PGID with the user: "UID:GID" attribute. If you are not using Docker Compose, chances are your system supports similar options under different names.
Other notable changes:
- The global Cloudflare account ID will no longer be used when searching for DNS zones.
CF_ACCOUNT_IDwill be ignored. - To reduce network traffic and delay, the Cloudflare API token will no longer be additionally verified via Cloudflare’s token verification API. Instead, the updater will locally check whether the token looks like a valid Bearer Token before using the API.
- Many parts of the README have been rewritten to improve clarity and to document the support of WAF lists.
- The DNS record updating algorithm was revised to be more deterministic, which means the updater will not give up updating stale DNS records (and create new ones) when there are errors; it will simply try again next time. As a result, in very rare cases, the updater may need more rounds to recover from errors.
Bug Fixes
- api: decouple account IDs from operations on DNS records (#875) (0fa1085)
- api: eliminate potential memory leak in caching (#854) (b9c7327)
- api: make the updating algorithm more deterministic (#864) (b557c41)
- api: remove global account ID and remote token verification (#877) (5a40ea7)
- monitor: retry connections to Uptime Kuma (#890) (8236410)
- setter: do not quote DNS record IDs (#851) (fc8accb)
- updater: delete unmanaged IP addresses from WAF lists (#885) (bf0361c)
- updater: show the hint to disable a network when IP detection timeouts (#859) (bdf154c) (#862) (397e722)