Add Cloudflare DDNS for devopshomelab.com (IPv4 A records)

timothyjmiller/cloudflare-ddns with host networking; render env from
secrets (apex + subdomains mc/minecraft/vpn/www/forgejo/jellyfin).

docker-compose.yml

@@ -200,6 +200,33 @@ services:
       - ./landing/Caddyfile:/etc/caddy/Caddyfile:ro
       - ./landing/site:/srv:ro
 
+  # ---------------------------------------------- Cloudflare dynamic DNS (A) #
+  # Updates apex + subdomains to the host's public IPv4. Secrets from secrets/.env
+  # Render env first:  ./scripts/render-cloudflare-ddns-env.sh
+  cloudflare-ddns:
+    image: timothyjmiller/cloudflare-ddns:latest
+    container_name: cloudflare-ddns
+    restart: unless-stopped
+    # Host networking so we see the real WAN IPv4 (not a Docker NAT address)
+    network_mode: host
+    security_opt:
+      - no-new-privileges:true
+    env_file:
+      - path: ${CONFIG_DIR}/cloudflare-ddns/ddns.env
+        required: false
+    environment:
+      TZ: ${TZ}
+      # Fallbacks if ddns.env not rendered yet (prefer secrets via render script)
+      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN:-${CLOUDFLAREAPIKEY:-}}
+      IP4_DOMAINS: ${CLOUDFLARE_IP4_DOMAINS:-}
+      IP4_PROVIDER: ${CLOUDFLARE_IP4_PROVIDER:-cloudflare.trace}
+      IP6_PROVIDER: none
+      PROXIED: ${CLOUDFLARE_PROXIED:-false}
+      UPDATE_CRON: ${CLOUDFLARE_UPDATE_CRON:-@every 5m}
+      UPDATE_ON_START: "true"
+      TTL: "1"
+      RECORD_COMMENT: arr-stack cloudflare-ddns
+
   # ------------------------------------------------------------------- music #
   lidarr:
     image: lscr.io/linuxserver/lidarr:latest