DeepSeek AI suggested:
I haven't looked into this. How did you check it?
When you paste the script or blocklist for disabling the allowlist into your repo, does it have red underlines?
Check out GitHub Actions, under Create or update rules and lists there's number of processed domains. Then open HaGeZi's list in the browser and see the number of entries. The number needs to be exact match, however, it's always 80-90 off meaning some domains aren't added to the list for some reason. I haven't been able to figure out which exactly, but something is missing.
No, I don't see anything underlined. The problem arrives when I save the changes and the action fails immediately and throws an error from screenshot.
My current one that works? That would the original file you linked in your guide (with cron execution time changed).
name: Update Filter Lists
on:
schedule:
- cron: "0 */4 * * *" # Runs every 4 hours
push:
branches:
- main
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
env:
NODE_ENV: production
jobs:
cgps:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4 # Using v4 (downgraded from v6)
with:
repository: "mrrfv/cloudflare-gateway-pihole-scripts"
ref: "6d3025bf07d2ae9c6dfc9f7a74df4176295a2742" # Specific commit hash
- name: Install Node.js
uses: actions/setup-node@v4 # Using v4 (downgraded from v6)
with:
node-version: '24' # Using Node.js version 24
- name: Install npm dependencies
run: npm ci
- name: Download blocklists
run: |
touch allowlist.txt # Ensures empty allowlist file exists
npm run download:blocklist
env:
BLOCKLIST_URLS: ${{ vars.BLOCKLIST_URLS }}
ALLOWLIST_URLS: "" # Empty string disables allowlist functionality
- name: Create or update rules and lists
run: npm run cloudflare-create
env:
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
keepalive:
if: github.event_name == 'schedule'
runs-on: ubuntu-latest
permissions:
actions: write
steps:
- uses: liskin/gh-workflow-keepalive@v1I wonder if there is a minimum-entries rule for a file list. If a file list needs at least 100 entries, it will skip a list with less, so I have 162 lists.
I don't think so, I successfully created a list with just one domain. It wouldn't make sense to have minimum set. I think it's the script acting up.
You may test this; it's my YAML file with no comments.
I'll try @SeriousHoax's script later today.
I tried @SeriousHoax's script.
Interesting. Now I really wonder what happened to the missing domains.
Oh, I see. That's expected. In my script at least, the hagezi policy is deleted every time github action runs and then is created again with the latest filter. So, it will go to the bottom as it's created last. But that's not an issue. Your other rules abvove the block rule as well as the hagezi rules all of them should work correctly.
- name: Download allowlists
run: npm run download:allowlist
env:
ALLOWLIST_URLS: ${{ vars.ALLOWLIST_URLS }}- name: Create empty allowlist
run: echo '' > allowlist.txtI asked if
example.com domain is on the list and something.example.com as well, will script send both or just example.com and the answer is just example.com goes to the Cloudflare.
Whenever I found myself in unfamiliar UI I go everywhere in it to get familiar with it. I did same with Cloudflare because it's UI drastically changed since the last time I used it and it get many new features I have no idea what they are about. Once you get familiar with UI, it's relatively easy.Although I have a Bachelor in IT (but only worked 1,5 year as programmer, 3.5 year as designer before becoming a program manager and have not done anything in IT for at least 35 years) and a Master in Business Administration, it took me an hour to configure cloudflare zero trust. There are so many options to choose from and offers so much granular control that I am very impressed by the members who have set it up in just 10 minutes.
Let's agree it's not for the average user (the majority of users); okay for advanced ones.
Average user doesn't even know what DNS is and uses the ISP provided ones.
