fix keep-open for close invalid pr

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.github/workflows/close-invalid-pr-template.yml

@@ -45,7 +45,7 @@ jobs:
             }
 
             const labels = pr.labels.map((label) => label.name);
-            const skipLabels = ["automated pr", "keep open"];
+            const skipLabels = ["automated pr", "keep-open"];
 
             if (skipLabels.some((label) => labels.includes(label))) {
               core.info(`PR #${prNumber} has a skip label (${labels.join(", ")}) — skipping template validation.`);
@@ -136,7 +136,7 @@ jobs:
               ``,
               `> Use the template sections, fill in the description, check all prerequisite boxes, and select at least one type of change.`,
               ``,
-              `Maintainers can add the \`keep open\` label to exempt a PR from this check.`,
+              `Maintainers can add the \`keep-open\` label to exempt a PR from this check.`,
               ``,
               `Thank you for contributing! 🙏`,
             ].join("\n");

CHANGELOG.md

@@ -508,6 +508,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-28
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Cloudflare-DDNS: store API token in a 600 env file and build the binary at install time [@angusmaul](https://github.com/angusmaul) ([#16100](https://github.com/community-scripts/ProxmoxVE/pull/16100))
+
 ## 2026-07-27
 
 ### 🆕 New Scripts

ct/cloudflare-ddns.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-3}"
 var_os="${var_os:-debian}"
-var_version="${var_version:-12}"
+var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 
@@ -24,11 +24,35 @@ function update_script() {
   header_info
   check_container_storage
   check_container_resources
-  if [[ ! -f /etc/systemd/system/cloudflare-ddns.service ]]; then
+
+  if [[ ! -f /usr/local/bin/ddns ]]; then
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-  msg_error "There is no update function for ${APP}."
+
+  if check_for_gh_release "cloudflare-ddns" "favonia/cloudflare-ddns"; then
+    msg_info "Stopping Service"
+    systemctl stop cloudflare-ddns
+    msg_ok "Stopped Service"
+
+    setup_go
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cloudflare-ddns" "favonia/cloudflare-ddns" "tarball"
+
+    msg_info "Updating ${APP}"
+    cd /opt/cloudflare-ddns
+    export CGO_ENABLED=0 GOOS=linux
+    $STD go build -trimpath -ldflags="-s -w" -o /usr/local/bin/ddns ./cmd/ddns
+    msg_ok "Updated ${APP}"
+
+    msg_info "Removing Build Dependencies"
+    rm -rf /usr/local/go /usr/local/bin/go /usr/local/bin/gofmt /root/go /root/.cache/go-build /opt/cloudflare-ddns
+    msg_ok "Removed Build Dependencies"
+
+    msg_info "Starting Service"
+    systemctl start cloudflare-ddns
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
   exit
 }
 

install/cloudflare-ddns-install.sh

@@ -13,8 +13,6 @@ setting_up_container
 network_check
 update_os
 
-setup_go
-
 var_cf_api_token="default"
 read -rp "${TAB3}Enter the Cloudflare API token: " var_cf_api_token
 
@@ -53,23 +51,50 @@ while true; do
 done
 msg_ok "Configured Application"
 
+setup_go
+fetch_and_deploy_gh_release "cloudflare-ddns" "favonia/cloudflare-ddns" "tarball"
+
+msg_info "Building ${APPLICATION}"
+cd /opt/cloudflare-ddns
+export CGO_ENABLED=0 GOOS=linux
+$STD go build -trimpath -ldflags="-s -w" -o /usr/local/bin/ddns ./cmd/ddns
+msg_ok "Built ${APPLICATION}"
+
+# The binary is statically linked (CGO_ENABLED=0), so Go is only a build-time
+# dependency. Removing it keeps the container small; update_script reinstalls it
+# via setup_go when a rebuild is needed.
+msg_info "Removing Build Dependencies"
+rm -rf /usr/local/go /usr/local/bin/go /usr/local/bin/gofmt /root/go /root/.cache/go-build /opt/cloudflare-ddns
+msg_ok "Removed Build Dependencies"
+
 msg_info "Setting up service"
-mkdir -p /root/go
+useradd --system --no-create-home --shell /usr/sbin/nologin cloudflare-ddns 2>/dev/null || true
+cat <<EOF >/etc/cloudflare-ddns.env
+CLOUDFLARE_API_TOKEN=${var_cf_api_token}
+DOMAINS=${var_cf_domains}
+PROXIED=${var_cf_proxied}
+IP6_PROVIDER=${var_cf_ip6_provider}
+EOF
+chown root:root /etc/cloudflare-ddns.env
+chmod 600 /etc/cloudflare-ddns.env
 cat <<EOF >/etc/systemd/system/cloudflare-ddns.service
 [Unit]
-Description=Cloudflare DDNS Service (Go run)
-After=network.target
+Description=Cloudflare DDNS Service
+After=network-online.target
+Wants=network-online.target
 
 [Service]
-Environment="CLOUDFLARE_API_TOKEN=${var_cf_api_token}"
-Environment="DOMAINS=${var_cf_domains}"
-Environment="PROXIED=${var_cf_proxied}"
-Environment="IP6_PROVIDER=${var_cf_ip6_provider}"
-Environment="GOPATH=/root/go"
-Environment="GOCACHE=/tmp/go-build"
-ExecStart=/usr/local/bin/go run github.com/favonia/cloudflare-ddns/cmd/ddns@latest
+Type=simple
+User=cloudflare-ddns
+Group=cloudflare-ddns
+EnvironmentFile=/etc/cloudflare-ddns.env
+ExecStart=/usr/local/bin/ddns
 Restart=always
 RestartSec=300
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
 
 [Install]
 WantedBy=multi-user.target