PROJECT/002
Cloudflare DDNS Manager
Self-hosted Cloudflare dynamic DNS for Synology/Docker: IP detection, selective A/AAAA sync, history, and a hardened admin UI with Turnstile and optional MFA.
- CATEGORYINFRASTRUCTURE
- YEAR2025
- STATUSv1.0.0 RELEASED
- ACCESSPUBLIC
STATUS ONLINE
- PRODUCTION / ONLINE
- v1.0.0
- LAST CHECK · 1 MIN AGO
- LATEST RELEASE · AUG 2026
- Node.js
- Fastify
- React
- Prisma
- MariaDB
- Docker
- Cloudflare API
- Turnstile
- TOTP MFA
01 WHY
Why I built it
A home NAS public IP changes. Updating Cloudflare by hand — or trusting a thin script with a raw token — does not scale. I wanted a selective record manager with history, scheduling and an admin surface I would actually expose behind a reverse proxy.
02 PROBLEM
What breaks without it
Dynamic DNS work usually spreads across cron jobs, JSON configs and Cloudflare’s own console. There is little audit trail, weak credential handling, and no clear view of what failed overnight. The goal was one self-hosted control plane for detection, sync and diagnostics.
03 PRODUCT
What the app does
- 01Setup wizard
First-run flow for admin account, Cloudflare API token, zone discovery and record selection.
- 02DNS record management
Manage A/AAAA records only. Check, update or force-update; stop managing without deleting Cloudflare records by default.
- 03IP detection
Public IPv4/IPv6 detection with provider fallback and unicast validation so bad addresses never write to DNS.
- 04Scheduler
1–60 minute interval with a MariaDB lease, overlap protection and recovery of stale runs after restart.
- 05System monitoring
Dashboard and System pages for connectivity, scheduler state and sanitized runtime diagnostics.
- 06Security
Argon2 passwords, HttpOnly sessions, Cloudflare Turnstile, optional TOTP MFA, encrypted tokens at rest, auth audit events and step-up for sensitive actions.
04 INTERFACE
Product screens
Captured from the live deployment. Hostnames and addresses in records views are documentation-safe examples or redacted.
05 ARCHITECTURE
Single hardened container
A pnpm monorepo ships a Vite React SPA and Fastify API in one Docker image. The scheduler runs in-process. Prisma talks to an existing MariaDB on the NAS. Host networking keeps IP detection truthful; Synology Reverse Proxy terminates HTTPS to loopback. Tokens never leave the server unencrypted.
06 TECHNOLOGY
Confirmed stack
From the Cloudflare DDNS monorepo — Node 22+, Fastify 5, React 18, Prisma 7, MariaDB, Docker Compose, Cloudflare API v4 and Turnstile.
- Node.js
- Fastify
- React
- Vite
- Prisma
- MariaDB
- Zod
- argon2
- Docker
- Cloudflare API
- Turnstile
- TOTP MFA
07 LESSONS
What I learned
- Self-hosted admin UIs need the same auth depth as public apps — Turnstile, MFA and step-up are not optional extras.
- IP detection must reject non-unicast results before any Cloudflare write.
- A MariaDB lease beats in-memory locks when the container can restart mid-run.
- Sanitize diagnostics aggressively; operators still need enough signal to debug.
08 STATUS
Shipped as v1.0.0
Released 2026-08-18 as a complete Synology-oriented product. Source is public on GitHub. This case study omits tokens, database credentials, production hostnames and real IP addresses.