Update Zero Trust Gateway DNS Location DNS IP

[iceman3k]

Could it please be added to the script to update the Zero Trust Gateway DNS Location DNS IP?

[iceman3k]

Is this feature not wanted by anyone else?

[Mister-Odd]

I think it's just a niche group of people who use this combo of services/hardware and know of this as even an option. That small group might want it too - but they would need to 1 think of it and 2 know to come here to vote your idea up. Even then, motivating a small group of volunteers to work on it, once you have "enough" requests, could be the greater challenge ;-)

[iceman3k]

I created this with the help of Google's Bard. I think it is close, but I am not a JSON programmer. I am trying to use the same API token that is pass to the script earlier and the IP that it received from DynDNS. Can anyone help me rewrite this? I am thinking to insert it on line 164. Thank you.

async function informZeroTrust(hostnames, ip, name, token) {

try{  // Update Zero Trust Gateway location after updating DNS records
	const cloudflare = new Cloudflare({ token });
    const locationId = "location_ID"; // Replace with the actual location ID
    const accountID = "account_ID"; // Replace with the actual Account ID
    const response = await fetch(`https://api.cloudflare.com/client/v4/accounts/${accountId}/gateway/locations/${locationId}`, {
        method: "PUT",
        headers: {
	        "Content-Type": "application/json",
	        Authorization: `Bearer ${token}`,
	    },
	    body: JSON.stringify({
	        name: "location_Name",  // Ensure this matches the DNS Location name
	        ecs_support: true,
	        networks: [ip],       // Update with the new IP address
	        client_default: true, // Adjust as needed
	    }),
	});

	    if (!response.ok) {
	      throw new Error(`Failed to update Zero Trust Gateway location: ${response.statusText}`);
	    }

	    console.log("Zero Trust Gateway location updated successfully.");
	} catch (error) {
	    console.error("Error updating Zero Trust Gateway location:", error);
	    // Handle error gracefully, e.g., log it or send a notification
	}

	return new Response("good", {
	    status: 200,
	    headers: {
	      "Content-Type": "text/plain;charset=UTF-8",
	      "Cache-Control": "no-store",
	    },
	});
}

[iceman3k]

I updated the JSON. I am editing in the worker Quick Editor. By the way, the API token permission were updated to add "Account; Zero Trust; Edit". I managed to clear all the errors. with this bit:

async function informZeroTrust(ip, token) {

  try{  // Update Zero Trust Gateway location after updating DNS records
    const locationId = "location_ID"; // Replace with the actual location ID
    const accountId = "account_ID"; // Replace with the actual Account ID
    const response = await fetch(`https://api.cloudflare.com/client/v4/accounts/${accountId}/gateway/locations/${locationId}`, {
      method: "PUT",
      headers: {
        "Content-Type": "application/json",
        Authorization: `Bearer ${token}`,
      },
    body: JSON.stringify({
      name: "location_Name",  // Replace and ensure this matches the DNS Location name
      ecs_support: true, // Adjust as needed, true, false
      networks: `${ip}/32`, // Update with the new IP address
      client_default: true, // Adjust as needed, true, false
      }),
  });
    if (!response.ok) {
      throw new Error(`Failed to update Zero Trust Gateway location: ${response.statusText}`);
    }
  console.log("Zero Trust Gateway location updated successfully.");
  }
  catch (error) {
    console.error("Error updating Zero Trust Gateway location:", error)  // Handle error gracefully, e.g., log it or send a notification
  }
    return new Response("good", {
      status: 200,
      headers: {
        "Content-Type": "text/plain;charset=UTF-8",
        "Cache-Control": "no-store",
      },
  });
}

The only error being thrown now is that the async function "informZeroTrust" is never called within the script. Should this be added to the cloudflare class?

Continuing. I decided to try and over come the call issue by adding to the "informAPI" function as it already contained the IP and the token, and was already called by the "handleRequest" function with returning the "response". Still no joy :-(.

async function informAPI(hostnames, ip, name, token) {

	const cloudflare = new Cloudflare({ token });

	const isIPV4 = ip.includes("."); //poorman's ipv4 check

	const zones = new Map();

	for (const hostname of hostnames) {
		const domainName = name && hostname.endsWith(name) ? name : hostname.replace(/.*?([^.]+\.[^.]+)$/, "$1");

		if (!zones.has(domainName)) zones.set(domainName, await cloudflare.findZone(domainName));

		const zone = zones.get(domainName);
		const record = await cloudflare.findRecord(zone, hostname, isIPV4);
		await cloudflare.updateRecord(record, ip);
	}

  try{  // Update Zero Trust Gateway location after updating DNS records
    const locationId = "location_ID"; // Replace with the actual location ID
    const accountId = "account_ID"; // Replace with the actual Account ID
    const response = await fetch(`https://api.cloudflare.com/client/v4/accounts/${accountId}/gateway/locations/${locationId}`, {
      method: "PUT",
      headers: {
        "Content-Type": "application/json",
        Authorization: `Bearer ${token}`,
      },
    body: JSON.stringify({
      name: "location_Name",  // Ensure this matches the DNS Location name
      ecs_support: true, // Adjust as needed, true, false
      networks: `${ip}/32`, // Update with the new IP address
      client_default: true, // Adjust as needed, true, false
      }),
  });
    if (!response.ok) {
      throw new Error(`Failed to update Zero Trust Gateway location: ${response.statusText}`);
    }
  console.log("Zero Trust Gateway location updated successfully.");
  }
  catch (error) {
    console.error("Error updating Zero Trust Gateway location:", error)  // Handle error gracefully, e.g., log it or send a notification
  }

	return new Response("good", {
		status: 200,
		headers: {
			"Content-Type": "text/plain;charset=UTF-8",
			"Cache-Control": "no-store",
		},
	});
}

[iceman3k]

I removed all other edits and tried to update the async "updateRecord" in the cloudflare class. I received my first error on the UDM-Pro. Am I on the right path here? Failed to update Zero Trust DNS IP!

root@UDM-Pro:~# inadyn -n -1 --force -f /run/ddns-eth8.201-inadyn.conf
inadyn[1758538]: In-a-dyn version 2.9.1 -- Dynamic DNS update client.
inadyn[1758538]: Guessing DDNS plugin '[email protected]' from 'afraid:2'
inadyn[1758538]: Update forced for alias 'insertCFdomain', new IP# 1.2.3.4
inadyn[1758538]: Update forced for alias 'insertAfraidDNSdomain.com', new IP# 1.2.3.4
inadyn[1758538]: Temporary error in DDNS server response:
inadyn[1781711]: [500 Internal Server Error] Error: Failed to update Zero Trust DNS IP
    at Cloudflare.updateRecord (index.js:70:10)
    at async informAPI (index.js:168:3)
    at async handleRequest (index.js:149:19)
inadyn[1781711]: Updating cache for  'insertAfraidDNSdomain.com'
inadyn[1781711]: Will retry again in 600 sec ...

	async updateRecord(record, value,) {
		record.content = value;
    const locationId = "location_ID"; // Replace with the actual location ID
    const accountId = "account_ID"; // Replace with the actual Account ID
		const response = await this._fetchWithToken(
			`zones/${record.zone_id}/dns_records/${record.id}`,
			{
				method: "PUT",
				body: JSON.stringify(record),
			}
		);
    const ztResponse = await this._fetchWithToken(
      `accounts/${accountId}/gateway/locations/${locationId}`,
      {
				method: "PUT",
				body: JSON.stringify({
          networks: record.ip/32
        }),
			}
    );
		const body = await response.json();
		if (!body.success) {
			throw new CloudflareApiException("Failed to update dns record");
		}
    const ztBody = await ztResponse.json();
		if (!ztBody.success) {
			throw new CloudflareApiException("Failed to update Zero Trust DNS IP");
		}
		return body.result[0], ztBody.result[0];
	}

[jb510]

FWIW. I'm interested in this too... but only a little and I'm honestly not 100% sure I see the utility in it.

Personally, I currently run cloudflared on my Synology (community package) at one location and cloudflared on a Proxmox server at another location. Both work reliably for me. Hence I don't really need to move that to my UDMs, but I guess I could and simplify things a tiny bit. It might help to explain why you need this over running Cloudflared elsewhere on your network?

Anwyay, I just got unifi-ddns working after banging my head on a wall (wrong token permissions) for an hour. So I don't have time or energy at the moment to try to sort out the javascript (not JSON) you shared above to see if it's on the right track or not, but can at least offer a +1 on being interested in it.

[willswire]

This seems like a useful automation to have, however it feels like it's out of scope for this project. I think a separate project would be ideal for building this out.