fixup: refine Cloudflare trace troubleshooting

Author: favonia

README.markdown

@@ -35,7 +35,7 @@ A feature-rich and robust Cloudflare DDNS updater with a small Docker image. It
 
 ### 🔒 Security and Privacy
 
-- 🙈 By default, public IP detection stays with Cloudflare: the `cloudflare.trace` provider contacts Cloudflare-operated HTTPS trace endpoints, and the updater already contacts Cloudflare to update DNS records. See [IP Detection](#ip-detection) for the current endpoint list.
+- 🙈 By default, public IP detection stays with Cloudflare: the `cloudflare.trace` provider contacts [HTTPS trace endpoints operated by Cloudflare](https://developers.cloudflare.com/fundamentals/reference/cdn-cgi-endpoint/), and the updater already contacts Cloudflare to update DNS records. See [IP Detection](#ip-detection) for the current endpoint list.
 
 - 🛡️ By default, the updater uses only HTTPS or [DNS over HTTPS](https://en.wikipedia.org/wiki/DNS_over_HTTPS) to detect IP addresses. This makes it harder for someone else to trick the updater into updating your DNS records with wrong IP addresses. See the [Security Model](docs/designs/features/network-security-model.markdown) for more information.
 
@@ -440,15 +440,15 @@ There have been reports of intermittent issues with the default provider `cloudf
 
 ### 🤔 I got <code>context deadline exceeded</code> and IP detection failed
 
-First check the updater logs to identify the provider and IP family that timed out. If the failed provider is `cloudflare.trace`, test every current built-in endpoint from a diagnostic container that uses the same Docker network and proxy settings as the updater. The commands below match the README's `network_mode: host` setup and test IPv4; replace `--ipv4` with `--ipv6` for an IPv6 failure. If the updater uses another Docker network, attach the diagnostic container to that network instead.
+First check the updater logs to identify the provider and IP family that timed out. If the failed provider is `cloudflare.trace`, test every current built-in endpoint from a diagnostic container that uses the same Docker network and proxy settings as the updater. The commands below match the README's `network_mode: host` setup and test IPv4; replace `--ipv4` with `--ipv6` for an IPv6 failure. If the updater uses another Docker network, replace `--network host` with `--network <network-name>`. If the updater receives explicit proxy environment variables, pass the same variables to the diagnostic container.
 
 ```bash
 docker run --rm --network host curlimages/curl:latest --fail --show-error --silent --ipv4 https://api.cloudflare.com/cdn-cgi/trace
 docker run --rm --network host curlimages/curl:latest --fail --show-error --silent --ipv4 https://www.cloudflare.com/cdn-cgi/trace
 docker run --rm --network host curlimages/curl:latest --fail --show-error --silent --ipv4 https://connectivity.cloudflareclient.com/cdn-cgi/trace
 ```
 
-If curl reports `Could not resolve host`, fix DNS resolution in the container network. Any other curl failure means that HTTPS endpoint is unavailable under the tested network and IP family. One failed endpoint does not by itself mean detection must fail, because another endpoint can return a valid response first. However, restrictive outbound policies should allow all three hosts to preserve fallback behavior. If all three commands succeed but detection still times out, check the updater logs for response-validation failures, then try increasing `DETECTION_TIMEOUT` (for example, `DETECTION_TIMEOUT=1m`).
+If curl reports `Could not resolve host`, fix DNS resolution in the container network. Any other curl failure means that HTTPS endpoint is unavailable under the tested network and IP family. One failed endpoint does not by itself mean detection must fail, because another endpoint can return a valid response first. However, restrictive outbound policies should allow all three hosts to preserve fallback behavior. If any of the three commands succeeds but detection still times out, check the updater logs for response-validation failures, then try increasing `DETECTION_TIMEOUT` (for example, `DETECTION_TIMEOUT=1m`).
 
 If that still does not help, please [open a GitHub issue](https://github.com/favonia/cloudflare-ddns/issues/new/choose) and include your setup details, relevant configs with secrets redacted, and any logs you have so that we can investigate further.
 
@@ -589,7 +589,7 @@ The emoji “🧪” marks experimental features, and the emoji “🤖” marks
 
 | Provider Name                                             | Explanation                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 | --------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `cloudflare.trace`                                        | <p>Get the IP address from Cloudflare’s HTTPS trace endpoints. The current built-in endpoints are `https://api.cloudflare.com/cdn-cgi/trace`, `https://www.cloudflare.com/cdn-cgi/trace`, and `https://connectivity.cloudflareclient.com/cdn-cgi/trace`.</p><p>During one detection, the updater may contact more than one endpoint and uses the first valid response received before `DETECTION_TIMEOUT` expires. **This is the default provider.**</p><p>⚠️ If outbound HTTPS is restricted by hostname, allow all three hosts.</p>                                                                                                                                                                                                                                              |
+| `cloudflare.trace`                                        | <p>Get the IP address from Cloudflare’s HTTPS trace endpoints. The current built-in endpoints are <https://api.cloudflare.com/cdn-cgi/trace>, <https://www.cloudflare.com/cdn-cgi/trace>, and <https://connectivity.cloudflareclient.com/cdn-cgi/trace>.</p><p>During one detection, the updater may contact more than one endpoint and uses the first valid response received before `DETECTION_TIMEOUT` expires. **This is the default provider.**</p><p>⚠️ If outbound HTTPS is restricted by hostname, allow all three hosts.</p>                                                                                                                                                                                                                                              |
 | `cloudflare.doh`                                          | Get the IP address by querying `whoami.cloudflare.` against [Cloudflare via DNS-over-HTTPS](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `local`                                                   | <p>Get the IP address via local network interfaces and routing tables. The updater will use the local address that _would have_ been used for outbound UDP connections to Cloudflare servers. (No data will be transmitted.)</p><p>⚠️ The updater needs access to the host network (such as `network_mode: host` in Docker Compose) for this provider, for otherwise the updater will detect the addresses inside [the default bridge network in Docker](https://docs.docker.com/engine/network/drivers/bridge/) instead of those in the host network.</p>                                                                                                                                                                                                                         |
 | 🧪 `local.iface:<iface>` (available since version 1.15.0) | <p>🧪 Get IP addresses via the specific local network interface `iface`. Since version 1.16.0, the updater collects all matching global unicast addresses of the selected IP family (IPv4 or IPv6) instead of just the first one, then reconciles DNS records and WAF lists against that full set.</p><p>⚠️ The updater needs access to the host network (such as `network_mode: host` in Docker Compose) for this provider, for otherwise the updater cannot access host network interfaces.</p><p>🤖 The updater ignores the prefix length reported by the interface, because it commonly describes its local subnet, not the range the updater should claim. The updater uses the default prefix lengths from `IP4_DEFAULT_PREFIX_LEN` or `IP6_DEFAULT_PREFIX_LEN` instead.</p> |