From dd74eef5f693b6409cb47312e326b8202c09e459 Mon Sep 17 00:00:00 2001
From: Tim Moore <angusmaul@gmail.com>
Date: Tue, 28 Jul 2026 17:39:30 +1000
Subject: [PATCH] Cloudflare-DDNS: store API token in a 600 env file and build
 the binary at install time (#16100)

---
 ct/cloudflare-ddns.sh              | 30 ++++++++++++++++--
 install/cloudflare-ddns-install.sh | 49 ++++++++++++++++++++++--------
 2 files changed, 64 insertions(+), 15 deletions(-)

diff --git a/ct/cloudflare-ddns.sh b/ct/cloudflare-ddns.sh
index 00146535a..624a2574c 100644
--- a/ct/cloudflare-ddns.sh
+++ b/ct/cloudflare-ddns.sh
@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-3}"
 var_os="${var_os:-debian}"
-var_version="${var_version:-12}"
+var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 
@@ -24,11 +24,35 @@ function update_script() {
   header_info
   check_container_storage
   check_container_resources
-  if [[ ! -f /etc/systemd/system/cloudflare-ddns.service ]]; then
+
+  if [[ ! -f /usr/local/bin/ddns ]]; then
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-  msg_error "There is no update function for ${APP}."
+
+  if check_for_gh_release "cloudflare-ddns" "favonia/cloudflare-ddns"; then
+    msg_info "Stopping Service"
+    systemctl stop cloudflare-ddns
+    msg_ok "Stopped Service"
+
+    setup_go
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cloudflare-ddns" "favonia/cloudflare-ddns" "tarball"
+
+    msg_info "Updating ${APP}"
+    cd /opt/cloudflare-ddns
+    export CGO_ENABLED=0 GOOS=linux
+    $STD go build -trimpath -ldflags="-s -w" -o /usr/local/bin/ddns ./cmd/ddns
+    msg_ok "Updated ${APP}"
+
+    msg_info "Removing Build Dependencies"
+    rm -rf /usr/local/go /usr/local/bin/go /usr/local/bin/gofmt /root/go /root/.cache/go-build /opt/cloudflare-ddns
+    msg_ok "Removed Build Dependencies"
+
+    msg_info "Starting Service"
+    systemctl start cloudflare-ddns
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
   exit
 }
 
diff --git a/install/cloudflare-ddns-install.sh b/install/cloudflare-ddns-install.sh
index bc4c8c2b3..9fc2771f2 100644
--- a/install/cloudflare-ddns-install.sh
+++ b/install/cloudflare-ddns-install.sh
@@ -13,8 +13,6 @@ setting_up_container
 network_check
 update_os
 
-setup_go
-
 var_cf_api_token="default"
 read -rp "${TAB3}Enter the Cloudflare API token: " var_cf_api_token
 
@@ -53,23 +51,50 @@ while true; do
 done
 msg_ok "Configured Application"
 
+setup_go
+fetch_and_deploy_gh_release "cloudflare-ddns" "favonia/cloudflare-ddns" "tarball"
+
+msg_info "Building ${APPLICATION}"
+cd /opt/cloudflare-ddns
+export CGO_ENABLED=0 GOOS=linux
+$STD go build -trimpath -ldflags="-s -w" -o /usr/local/bin/ddns ./cmd/ddns
+msg_ok "Built ${APPLICATION}"
+
+# The binary is statically linked (CGO_ENABLED=0), so Go is only a build-time
+# dependency. Removing it keeps the container small; update_script reinstalls it
+# via setup_go when a rebuild is needed.
+msg_info "Removing Build Dependencies"
+rm -rf /usr/local/go /usr/local/bin/go /usr/local/bin/gofmt /root/go /root/.cache/go-build /opt/cloudflare-ddns
+msg_ok "Removed Build Dependencies"
+
 msg_info "Setting up service"
-mkdir -p /root/go
+useradd --system --no-create-home --shell /usr/sbin/nologin cloudflare-ddns 2>/dev/null || true
+cat <<EOF >/etc/cloudflare-ddns.env
+CLOUDFLARE_API_TOKEN=${var_cf_api_token}
+DOMAINS=${var_cf_domains}
+PROXIED=${var_cf_proxied}
+IP6_PROVIDER=${var_cf_ip6_provider}
+EOF
+chown root:root /etc/cloudflare-ddns.env
+chmod 600 /etc/cloudflare-ddns.env
 cat <<EOF >/etc/systemd/system/cloudflare-ddns.service
 [Unit]
-Description=Cloudflare DDNS Service (Go run)
-After=network.target
+Description=Cloudflare DDNS Service
+After=network-online.target
+Wants=network-online.target
 
 [Service]
-Environment="CLOUDFLARE_API_TOKEN=${var_cf_api_token}"
-Environment="DOMAINS=${var_cf_domains}"
-Environment="PROXIED=${var_cf_proxied}"
-Environment="IP6_PROVIDER=${var_cf_ip6_provider}"
-Environment="GOPATH=/root/go"
-Environment="GOCACHE=/tmp/go-build"
-ExecStart=/usr/local/bin/go run github.com/favonia/cloudflare-ddns/cmd/ddns@latest
+Type=simple
+User=cloudflare-ddns
+Group=cloudflare-ddns
+EnvironmentFile=/etc/cloudflare-ddns.env
+ExecStart=/usr/local/bin/ddns
 Restart=always
 RestartSec=300
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
 
 [Install]
 WantedBy=multi-user.target