gitea-admin/gh-christianlouis-dmarq
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add Cloudflare DNS integration

Browse Source 
Closes #31
This commit is contained in:
Christian Krakau-Louis
2026-05-23 01:13:06 +02:00
parent a060bc59c2
commit 521dbc92d0
13 changed files with 1644 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/deployment/configuration.md
+17 -3
View File
@@ -110,11 +110,21 @@ operational policy if long-term storage size matters.
| Variable | Description | Default | Example |
|----------|-------------|---------|---------|
| `CF_ENABLED` | Enable Cloudflare integration | `false` | `true`, `false` |
| `CF_API_TOKEN` | Cloudflare API token | - | `your_cloudflare_api_token` |
| `CF_ZONE_ID` | Cloudflare Zone ID | - | `your_cloudflare_zone_id` |
| `CLOUDFLARE_API_TOKEN` | Cloudflare API token for read-only zone discovery and DNS inspection | - | `your_cloudflare_api_token` |
| `CLOUDFLARE_ZONE_ID` | Optional default Cloudflare Zone ID | - | `your_cloudflare_zone_id` |
| `WEBHOOK_SECRET` | Required secret for inbound email worker webhooks | - | `openssl rand -hex 32` |
Cloudflare credentials can also be stored from **Settings**. The API token is
encrypted in the settings table and redacted when settings are read back. Leave
the Zone ID blank to discover every active zone visible to the token.
The read-only integration exposes:
- `GET /api/v1/domains/cloudflare/discover` to list available zones.
- `POST /api/v1/domains/cloudflare/import` to create monitored domain rows from zones.
- `GET /api/v1/domains/{domain}/dns/cloudflare` to inspect managed DNS records, return DMARC/SPF/DKIM suggestions, and record detected DNS changes.
- `GET /api/v1/domains/{domain}/dns/history` to review DNS record additions, modifications, and removals.
### DNS Result Cache
DMARC, SPF, and DKIM DNS checks are cached in the database-backed `dns_cache`
@@ -123,6 +133,10 @@ API responses include whether the result came from cache and when it was
checked. Use `?refresh=true` on the domain DNS endpoint to bypass a fresh cache
entry for operational rechecks.
Cloudflare-managed DNS record snapshots and change events are stored in
`dns_record_snapshots` and `dns_record_changes`. They are updated whenever the
Cloudflare DNS analysis endpoint is called.
### Advanced Configuration
| Variable | Description | Default | Example |