[dethos]

Some time ago, I built a similar project: https://github.com/dethos/worker-ddns

The main difference is that, for security reasons, it uses a "Cloudflare worker" to change the DNS record.

> Since Cloudflare API Token permissions aren't granular enough to limit the token access to a single DNS record, we place a worker in front of it (this way the token with extra priviledges never leaves cloudflare's servers).

It works very well, no complaints until now.