Skip to content

1.17.0

Latest
Latest

Choose a tag to compare

View all tags
@favonia favonia released this 28 Jul 08:22
v1.17.0
This tag was signed with the committer’s verified signature.
favonia favonia
GPG key ID: C99C469685B44DDA
Verified
Learn about vigilant mode.
2c3beb3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release adds experimental controls for per-domain IPv6 host IDs and detected-address filtering, and makes advanced configuration easier to validate. It also removes the startup token-verification request that produced misleading warnings for valid account API tokens.

Highlights

  1. Per-domain IPv6 host IDs. Advanced IPv6 setups can now control the host bits of each domain's AAAA records by adding the experimental hostid6 field to entries in DOMAINS or IP6_DOMAINS, for example example.org{hostid6=::1}. A domain can preserve the detected host bits, replace them with a fixed host ID, or derive one from a MAC address. This changes only AAAA record derivation; WAF lists continue to use the raw detected prefixes. (#1224)
  2. IPv4 and IPv6 detection filters. New experimental IP4_DETECTION_FILTER and IP6_DETECTION_FILTER expressions select detected addresses before both DNS and WAF reconciliation. If a filter removes every address for one family, the updater preserves that family's existing managed content for the round. (#1231)
  3. Advisory linting for PROXIED. The updater now warns about suspicious boolean expressions, including constant results and redundant or subsumed terms. (#1235)
  4. Account API tokens no longer trigger misleading startup warnings. The updater no longer calls Cloudflare's user-token verification endpoint during startup. Malformed token values are still rejected locally. A well-formed token that is invalid or lacks permission for an attempted DNS or WAF operation is instead reported when that operation fails, with the corresponding permission guidance. (#1240)

Other Notable Changes

Features

  • New SHOUTRRR_FILE reads Shoutrrr notification URLs from a file, making mounted secrets usable without putting token-bearing URLs in environment values. If SHOUTRRR and SHOUTRRR_FILE are both set, they must specify the same URLs. (#1241)

Bug Fixes

  • When both HEALTHCHECKS and UPTIMEKUMA are configured, a failure from either service no longer prevents the updater from contacting the other. (#1249)

Message Improvements

  • Expanded operator feedback. Configuration checks now catch likely token-file mixups and warn about additional cases of family-specific settings being ignored because their provider is disabled. Diagnostics for Shoutrrr URLs containing spaces now identify the configuration source, report the correct line number, and give clearer guidance on how to fix the issue. Shoutrrr success logs now identify the notification type. (#1204) (#1227) (#1230) (#1250)
Assets 4
Loading