hryha/do-cf-sync

Sync Cloudflare IP ranges into a DigitalOcean Firewall (ingress rules)

1.0.0 2025-12-17 12:30 UTC

Requires

• php: >=8.2
• guzzlehttp/guzzle: ^7.9
• vlucas/phpdotenv: ^5.6

Requires (Dev)

• friendsofphp/php-cs-fixer: ^3.92
• pestphp/pest: ^3.8
• phpstan/phpstan: ^1.11

MIT

• Ivan Hryha

• cloudflare
• DigitalOcean Firewall

README

This small PHP utility syncs the current list of Cloudflare IP ranges into a specified DigitalOcean Firewall as inbound rules. It runs as a CLI script and is intended to be scheduled daily via cron.

What it does

• Fetches Cloudflare IP ranges (both IPv4 and IPv6) from the official Cloudflare API.
• Updates the target DigitalOcean Firewall to allow inbound TCP traffic on configured ports (default: 80 and 443) from those Cloudflare ranges.
• Preserves your other firewall rules. It only replaces previously-added Cloudflare rules for the same ports.

Requirements

• PHP 8.2+
• Composer
• A DigitalOcean Personal Access Token with write access to Firewalls
• An existing DigitalOcean Firewall ID you want to update

Installation

1. Clone or copy this repository to your server.
2. Install dependencies:

   composer install --no-dev --optimize-autoloader

3. Configure environment variables. Copy .env.example to .env and fill values:

   DO_TOKEN="your_digitalocean_api_token_here"
   DO_FIREWALL_ID="your_firewall_id_here"
   # Optional: comma-separated list of TCP ports to allow from Cloudflare
   PORTS="80,443"
   # Optional: add extra CIDRs (IPv4/IPv6) to allow in addition to Cloudflare ranges
   EXTRA_CIDRS="8.8.8.8/32,2001:db8::/32"

4. Add a daily cron job (every day at 02:15):

   15 2 * * * /usr/bin/php /path/to/project/bin/sync.php >> /var/log/do-cf-sync.log 2>&1