From 1f3594efa56a695837f8218f532aec4de9dcf473 Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Tue, 3 Mar 2026 11:09:35 +0100
Subject: [PATCH] Fix Cloudflare API token handling

---
 nix-system-configs/modules/system/traefik.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix
index 7191ddf..02eab7f 100644
--- a/nix-system-configs/modules/system/traefik.nix
+++ b/nix-system-configs/modules/system/traefik.nix
@@ -613,7 +613,7 @@ in {
                   source "${envFile}"
                 fi
 
-                if [ -z "$CLOUDFLARE_API_TOKEN" ]; then
+                if [ -z "$${CLOUDFLARE_API_TOKEN:-}" ]; then
                   echo "CLOUDFLARE_API_TOKEN is not set in ${envFile}, aborting" >&2
                   exit 2
                 fi
@@ -633,7 +633,7 @@ in {
                   local fqdn="$1"
                   # Query existing A records for fqdn
                   res=$(curl -sS -X GET "$API_BASE/zones/${zoneId}/dns_records?type=A&name=$fqdn" \
-                    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
+                    -H "Authorization: Bearer $${CLOUDFLARE_API_TOKEN:-}" \
                     -H "Content-Type: application/json")
 
                   ok=$(echo "$res" | $jq -r '.success')
@@ -658,13 +658,13 @@ in {
                   if [ -n "$record_id" ]; then
                     echo "Updating $fqdn ($record_id) -> $CURRENT_IP"
                     curl -sS -X PUT "$API_BASE/zones/${zoneId}/dns_records/$record_id" \
-                      -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
+                      -H "Authorization: Bearer $${CLOUDFLARE_API_TOKEN:-}" \
                       -H "Content-Type: application/json" \
                       --data "$payload" | $jq -r '.'
                   else
                     echo "Creating record $fqdn -> $CURRENT_IP"
                     curl -sS -X POST "$API_BASE/zones/${zoneId}/dns_records" \
-                      -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
+                      -H "Authorization: Bearer $${CLOUDFLARE_API_TOKEN:-}" \
                       -H "Content-Type: application/json" \
                       --data "$payload" | $jq -r '.'
                   fi