Hello everyone,
v3.1.3 is out.
This is a focused correctness and hardening release. No new infrastructure and no new services. This one is about making sure Access policies enforce exactly what you configured, agent tunnels keep every route assigned to them, and the fallback cache and health-check documentation behave as expected.
Slovak also joins the supported languages with a complete UI and Help Center translation.
Highlights
- Identity provider and email restrictions now work together as intended
- Existing unsafe Access policy structures are migrated automatically
- Manual routes on agent tunnels survive container restarts and updates
- In-memory cache invalidation now works correctly without Redis
- Docker health-check examples now use the tools actually included in the image
- Complete Slovak UI and Help Center localization
What's New
Slovak Localization
DockFlare now includes a complete Slovak translation across the Web UI and the full Help Center documentation.
Thanks to @Vaso73 for the community contribution in #379.
Fixed
Identity Provider Access Policies
This is the most important fix in this release.
When an Access Group contained both selected email addresses and an identity provider such as Google, both selectors were previously added as Include rules. Cloudflare treats entries inside Include as OR conditions, which meant any account authenticated through the selected provider could satisfy the policy even when its email address was not in the configured allowlist.
That is now corrected.
Allowed email addresses and domains remain alternatives within Include, while the selected identity provider is enforced as an additional Require condition.
In practical terms:
- Multiple allowed email addresses continue to work as an allowlist
- Allowed domains remain alternatives to individual addresses
- The user must also authenticate through the selected identity provider
- Multiple identity providers are supported as alternative authentication paths
- Missing identity providers now fail closed instead of falling back to email-only authentication
- Zone-default, Docker-managed, manual, and Master API-created policies all use the same rule-building logic
- Compound policies such as IP bypass plus authenticated access are preserved correctly
Previously stored DockFlare policies using the unsafe OR structure, including the intermediate inverted Require structure, are migrated automatically during state loading.
Agent Tunnel Manual Routes
Agent container events previously rebuilt the complete Cloudflare tunnel configuration using agent-managed rules only.
If the same tunnel also contained manual routes for services such as Plex, a NAS interface, or a VM, restarting or recreating any labeled container could silently remove those manual routes from the live tunnel configuration. DNS and Access applications often remained, so users could authenticate successfully and then receive a 404.
Agent tunnel updates now use the shared tunnel configuration builder. Active manual and agent-managed rules assigned to the tunnel are rebuilt together, including their origin settings, while rules belonging to other tunnels remain isolated.
Thanks to @essentrix83 for the detailed report and root-cause analysis in #386.
In-Memory Cache Invalidation
Redis is optional. Installations without REDIS_URL intentionally use the built-in in-memory SimpleCache fallback.
Pattern-based DNS and zone cache invalidation previously did nothing in this mode and produced a recurring Redis-only warning. Matching in-memory entries are now cleared correctly, while Redis behavior remains unchanged.
Thanks to @kocaemre for the contribution in #384.
Docker Health Checks
The documented Docker health check used curl, but curl is not included in the DockFlare image.
All localized health-check guides now use wget --spider, which is already available in the image and correctly checks the /ping endpoint.
Thanks again to @kocaemre for the contribution in #383, and to @Spoker for reporting the original problem in #382.
Notes
This is primarily a DockFlare Master update. No DockFlare Agent image update is required for the agent tunnel fix.
There are no Docker Compose or infrastructure changes in this release. Existing Redis installations are unaffected, and Redis remains optional.
Access policy enforcement is intentionally stricter. If an existing policy previously relied on the unintended identity-provider OR behavior, it will now enforce the configured email allowlist as expected.
For the full technical breakdown see CHANGELOG.md.
Happy tunnelling,
Christian