I kept all my certificates separate - have I been wasting time with 15 subdomains each with their own cert and A record? I have wondered. And then set in my reverse proxy a single domain.tld cert for each entry? TIA.

I wrote bash scripts to run via cron to keep my IPs updated, using Cloudflare API. It's probably useful to other folk but as I used to need just v4 addresses I made one separate script for v4 IPs, v6 IPs and proxied, but it wouldn't take long to combine. Here's my v4:

#!/bin/bash
CLOUDFLARE_API_TOKEN="<api_here>"
ZONE_ID="<zone_id_here"
DOMAINS=({subdomains.,www.}domain.tld)
log="/opt/ddns/log_$(date +%F).txt"
result=""
CURL="/usr/bin/curl"
JQ="/usr/bin/jq"
IP=$($CURL -s http://ipv4.icanhazip.com/)
echo $(date +"%FT%T")>>$log
echo "Performing v4 proxied domain IP address check...">>$log

# Get v4 records
for DNS_RECORD in ${DOMAINS[@]}; do
DNS_RECORD_ID=$($CURL -s -X GET "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records?type=A&name=$DNS_RECORD" \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  -H "Content-Type: application/json" | $JQ -r '{"result"}[] | .[0] | .id')

# Get each record's IP
current_ip=$($CURL -s -X GET "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$DNS_RECORD_ID" \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  -H "Content-Type: application/json" | $JQ -r '.result.content')

# Check if the IP addresses are different
if [[ "$IP" == "$current_ip" ]] || [[ "$IP" == "" ]]; then
  continue
fi

echo "IP address for $DNS_RECORD has changed from $current_ip to $IP. Updating record...">>$log
result="$result${DNS_RECORD%%.*}, "

# Sets the new IP if different
response=$($CURL -s -X PUT "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$DNS_RECORD_ID" \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "type": "'"A"'",
    "name": "'"$DNS_RECORD"'",
    "content": "'"$IP"'",
    "ttl": 120,
    "proxied": true
  }')

if [[ $response == *"\"success\":true"* ]]; then
echo "DNS record updated successfully">>$log
else
echo "Failed to update DNS record for $DNS_RECORD. Response: $response">>$log
result="$result\nFailed. See log."
fi

# Sends information to webhook
unset DNS_RECORD_ID
done
if [ -n "$result" ]; then
  $CURL -X POST -d '{"result": "'"$result"'\n'"$current_ip"' -> '"$IP"'"}' "<home_assistant_local_webhook-delete_this_block_if_unwanted>" -H "Content-Type:application/json"
fi
echo $result>>$log
echo $'Done.\n'>>$log
/opt/ddns/cloudflare_ddns_v4_direct.sh # This triggers the next script