Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Update README.md #77

Merged
merged 1 commit into from
Sep 9, 2024
Merged

Update README.md #77

merged 1 commit into from
Sep 9, 2024

Conversation

rainyvalley
Copy link
Contributor

Update Changes to allow Worker Edits as well as DNS zone edit in instructions.

Update Changes to allow Worker Edits as well as DNS zone edit in instructions.
@willswire willswire merged commit 4fd4335 into willswire:main Sep 9, 2024
@MatthewA1
Copy link
Contributor

@rainyvalley Why does the API token need permissions to edit Workers? Unless I'm missing something, this seems like something you definitely wouldn't want provisioned for the API token you're giving to the UniFi machines that only are updating DNS records.

@rainyvalley
Copy link
Contributor Author

rainyvalley commented Oct 9, 2024

Hi Matthew,

The Workers were not creating in Cloudflare without the permission to edit workers (see issue 81). However, I did just confirm that you can edit the API token to swap them from "edit" to "read" for the Cloudflare Workers R2 Storage/Workers Tail/Workers KV Storage/Workers cripts/Workers Routes that are part of the "edit Cloudflare Workers" template so that they do not have access in the future. Though, My IP hasn't changed for me to properly test this in the field. I can do another merge request with an added step to remove these, if you prefer.

Hope this clarifies,

@MatthewA1
Copy link
Contributor

It seems like you're conflating the token you need for the GitHub Action needs to deploy a worker and the token clients need to update DNS records. The token you pass to the Action as a GitHub Actions secret named CLOUDFLARE_API_TOKEN does need permission to edit the workers, but the token you pass in the GET request to the worker that is then used to make the CF API call to update the DNS record shouldn't need anything to do with Workers, read or edit. These should be two totally separate tokens.

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants