Cloudflare 的优选 IP 优化

访问 blog.ljhboard.cn
        │
        ▼
DNS-only CNAME: blog -> cdn.ljhboard.cn
        │
        ▼
DNS-only A: cdn -> CFST 本轮选出的 Cloudflare IPv4
        │
        ▼
Cloudflare Custom Hostname（证书、Host 路由）
        │
        ▼
Fallback Origin: origin-ai.ljhboard.cn（橙云）
        │
        ▼
北京 ECS 源站

dig +short blog.ljhboard.cn
curl -I --connect-timeout 10 https://blog.ljhboard.cn/

mkdir -p /opt/cloudflare-speed-test
cd /opt/cloudflare-speed-test
 
# 将下载的压缩包放到此目录后解压
tar -xzf cfst.tar.gz
 
# 注意真实文件路径，不要直接执行 chmod 755 cfst
install -m 755 cfst_linux_amd64/cfst ./cfst
install -m 644 cfst_linux_amd64/ip.txt ./ip.txt
./cfst -v

cd /opt/cloudflare-speed-test
./cfst -f ./ip.txt -n 50 -t 4 -dn 10 -dt 10 \
  -tl 300 -tlr 0 -sl 0.1 -p 10 -o result.csv
head -n 2 result.csv

read -rsp 'Cloudflare API Token: ' TOKEN
echo
ZONE='替换为你的 Zone ID'
API='https:'//'api.cloudflare.com/client/v4'
URL="${API}/zones/${ZONE}/dns_records"
 
curl -fsS -G -H "Authorization: Bearer ${TOKEN}" --data-urlencode 'type=A' --data-urlencode 'name=cdn.ljhboard.cn' "${URL}" | jq -r '.result[0].id'
 
unset TOKEN

/opt/cloudflare-speed-test/
├── cfst
├── ip.txt
├── cloudflare-fastip
└── cloudflare-fastip.env

# 以下五项全部必填
CF_API_TOKEN='替换为最小权限 Token'
CF_ZONE_ID='替换为 Zone ID'
CF_DNS_RECORD_ID='替换为 cdn.ljhboard.cn 的 Record ID'
CF_DNS_NAME='cdn.ljhboard.cn'
CF_VERIFY_HOSTS='blog.ljhboard.cn'

chown root:root /opt/cloudflare-speed-test/cloudflare-fastip.env
chmod 600 /opt/cloudflare-speed-test/cloudflare-fastip.env

#!/usr/bin/env bash
set -Eeuo pipefail
 
BASE_DIR='/opt/cloudflare-speed-test'
CFST_BIN="${BASE_DIR}/cfst"
IP_FILE="${BASE_DIR}/ip.txt"
RESULT_FILE="${BASE_DIR}/result.csv"
API='https:'//'api.cloudflare.com/client/v4'
 
: "${CF_API_TOKEN:?CF_API_TOKEN 未填写}"
: "${CF_ZONE_ID:?CF_ZONE_ID 未填写}"
: "${CF_DNS_RECORD_ID:?CF_DNS_RECORD_ID 未填写}"
: "${CF_DNS_NAME:?CF_DNS_NAME 未填写}"
: "${CF_VERIFY_HOSTS:?CF_VERIFY_HOSTS 未填写}"
 
exec 9>"${BASE_DIR}/cloudflare-fastip.lock"
flock -n 9 || { echo '已有任务正在运行，本次退出'; exit 0; }
 
"${CFST_BIN}" -f "${IP_FILE}" -n 50 -t 4 -dn 10 -dt 10 \
  -tl 300 -tlr 0 -sl 0.1 -p 10 -o "${RESULT_FILE}"
 
CANDIDATE_IP="$({ awk -F, 'NR == 2 { gsub(/\r/, "", $1); print $1 }' "${RESULT_FILE}"; } || true)"
if [[ ! "${CANDIDATE_IP}" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
  echo "没有得到有效 IPv4：${CANDIDATE_IP:-<空>}" >&2
  exit 1
fi
 
verify_ip() {
  local ip="$1" host
  IFS=',' read -ra hosts <<< "${CF_VERIFY_HOSTS}"
  for host in "${hosts[@]}"; do
    curl -fsS --connect-timeout 10 --max-time 20 \
      --resolve "${host}:443:${ip}" \
      -o /dev/null "https://${host}/"
  done
}
 
echo "验证候选 IP：${CANDIDATE_IP}"
verify_ip "${CANDIDATE_IP}"
 
RECORD_URL="${API}/zones/${CF_ZONE_ID}/dns_records/${CF_DNS_RECORD_ID}"
AUTH_HEADER="Authorization: Bearer ${CF_API_TOKEN}"
CURRENT_JSON="$(curl -fsS -H "${AUTH_HEADER}" "${RECORD_URL}")"
 
jq -e --arg name "${CF_DNS_NAME}" '
  .success == true and
  .result.type == "A" and
  .result.name == $name and
  .result.proxied == false
' >/dev/null <<< "${CURRENT_JSON}" || {
  echo 'Record ID、记录名、类型或灰云状态不符合预期，拒绝更新' >&2
  exit 1
}
 
OLD_IP="$(jq -r '.result.content' <<< "${CURRENT_JSON}")"
if [[ "${OLD_IP}" == "${CANDIDATE_IP}" ]]; then
  echo "仍是当前 IP，无需更新：${OLD_IP}"
  exit 0
fi
 
make_payload() {
  jq -n --arg name "${CF_DNS_NAME}" --arg ip "$1" '{
    type: "A", name: $name, content: $ip, ttl: 60, proxied: false
  }'
}
 
update_record() {
  curl -fsS -X PATCH "${RECORD_URL}" \
    -H "${AUTH_HEADER}" \
    -H 'Content-Type: application/json' \
    --data "$(make_payload "$1")" |
    jq -e '.success == true' >/dev/null
}
 
echo "更新 ${CF_DNS_NAME}：${OLD_IP} -> ${CANDIDATE_IP}"
update_record "${CANDIDATE_IP}"
 
READBACK_IP="$(curl -fsS -H "${AUTH_HEADER}" "${RECORD_URL}" | jq -r '.result.content')"
if [[ "${READBACK_IP}" != "${CANDIDATE_IP}" ]] || ! verify_ip "${CANDIDATE_IP}"; then
  echo "更新后验证失败，回滚到 ${OLD_IP}" >&2
  update_record "${OLD_IP}"
  exit 1
fi
 
echo "更新完成：${CF_DNS_NAME} -> ${CANDIDATE_IP}"

apt-get update
apt-get install -y curl jq util-linux
chmod 755 /opt/cloudflare-speed-test/cloudflare-fastip

set -a
. /opt/cloudflare-speed-test/cloudflare-fastip.env
set +a
/opt/cloudflare-speed-test/cloudflare-fastip

set -a; . /opt/cloudflare-speed-test/cloudflare-fastip.env; set +a; /opt/cloudflare-speed-test/cloudflare-fastip

dig +short cdn.ljhboard.cn
dig +short blog.ljhboard.cn
curl -I https://blog.ljhboard.cn/
curl -I 'https://ljhboard.cn/posts?from=root'