Domain outputs not being generated by environment variables

[tehniemer]

I'm trying to set this up using environment variables and the outputs section of my domain does not automatically generate, I had to manually add it to the .yml file.

These are the log messages directly related

2025-11-21 12:03:22  VERBOSE [domain] Loaded domain config for 'domain_01' (provider: , effective_inputs: [docker traefik], effective_outputs: [])

2025-11-21 12:03:07    FATAL [domain] Failed to initialize domain system: domain validation failed: domain configuration validation failed:
  - domain 'domain_01' has no destination configured (must have either a DNS provider or outputs)

I also am getting these errors in my logs, but I'm not sure if it's related.

[ERROR] ** [herald] POTENTIAL RUNAWAY DETECTECTED: Disabling '10-herald' service because it has tried restarting '10' times

/container/functions/10-herald: line 185: modify_config: command not found

[tehniemer]

Here's my compose snippit

  herald:
    image: nfrastack/herald:latest
    container_name: herald
    restart: always
    networks:
      - dockernet
    security_opt:
      - no-new-privileges=true
    volumes:
      - /opt/docker/herald:/config
    environment:
      - TIMEZONE=${TIMEZONE}
      - HERALD_SETUP_TYPE=auto
      - HERALD_USER=root
      - LOG_LEVEL=verbose
      - PROVIDER_01_TYPE=cloudflare
      - PROVIDER_01_CLOUDFLARE_API_TOKEN=${CLOUDFLARE_DNS_API_TOKEN}
      - CLOUDFLARE_API_TOKEN=${CLOUDFLARE_DNS_API_TOKEN}
      - DOMAIN_NAME=${DOMAINNAME}
      - DOCKER_API_URL=tcp://socket-proxy:2375
      - DOCKER_EXPOSE_CONTAINERS=TRUE
      - DOCKER_PROCESS_EXISTING=TRUE
      - DOCKER_RECORD_REMOVE_ON_STOP=TRUE
      - TRAEFIK_API_URL=http://traefik:8080/api/http/routers
      - TRAEFIK_INTERVAL=15
      - TRAEFIK_PROCESS_EXISTING=TRUE
      - TRAEFIK_RECORD_REMOVE_ON_STOP=TRUE
      - DOMAIN_01_PROVIDER=cloudflare
      - DOMAIN_01_ZONE_ID=${CLOUDFLARE_ZONEID}
      - DOMAIN_01_RECORD_TYPE=CNAME
      - DOMAIN_01_PROXIED=TRUE
      - DOMAIN_01_UPDATE_EXISTING_RECORD=TRUE
      - DOMAIN_01_ALLOW_MULTIPLE=false
      - DOMAIN_01_INPUT=docker,traefik
      - DOMAIN_01_OUTPUT=cloudflare

[tiredofit]

Thanks for the report. There are a few things happening here and will try to create on my end. These are early days for the container and working out quite a lot of other links related to the upstream images as well. Should have some feedback in the next few days.

[tiredofit]

There are new container images available (:latest / 2.3.1) that should build your domain configuration correctly now. All was related to a function I didn't properly deprecate in the config building routines in the image.

The process run away and the errors you were seeing on screen with modify_config all were byproducts. I ran a simple test on my end and everything seems good. It also prompted me to rework the automated image building routines to allow for new :latest builds without requiring tags/releases, so fixes to the container during this initial stage will be easier.

[tehniemer]

Just pulled the latest, still having the same issue

herald  | 2025-11-23.14:11:52 [STARTING] ** [herald] [10] Starting Herald 2.3.1
herald  | Starting Herald version: 2.3.1 
herald  | © 2025 Nfrastack https://nfrastack.com - BSD-3-Clause License
herald  | 
herald  | 2025-11-23 14:11:52     INFO [config] Using config file: /config//herald.yml
herald  | 2025-11-23 14:11:52    FATAL [domain] Failed to initialize domain system: domain validation failed: domain configuration validation failed:
herald  |   - domain 'domain_01' has no destination configured (must have either a DNS provider or outputs)
herald  | 2025-11-23 14:11:52  VERBOSE [domain] Loaded domain config for 'domain_01' (provider: , effective_inputs: [docker traefik], effective_outputs: [])
herald  | 2025-11-23.14:11:54 [ERROR] ** [herald] POTENTIAL RUNAWAY DETECTECTED: Disabling '10-herald' service because it has tried restarting '10' times

[tiredofit]

Thanks for reporting back - Will go at this with your compose file and see where things have gone sideways.

[tehniemer]

No problem, I've been a user of cloudflare-companion for years now, this looked interesting, so I figured I'd give it a try. Glad to help any way I can.

[tiredofit]

Thanks for being an early adopter - This is the next generation of that image, and I've been meaning to have this tested before I deprecate the image, so this bumps the priority of it.
I wrote the documentation and image well ahead of before herald became as full functioned as it is so there were all sorts of anomalies and design decisions that I needed to strip out of existing configuration, scripts and README file.

I think you should have good success with the following, insert any missing Traefik options obviously, but this will not correctly generate domain outputs. I intentionally limited the container image in its "AUTO" mode to avoid not getting into massive support issues with so many different ways the tool could be used - It closely mimics the old tiredofit/tcc image functionality - Once you create your own configuration however things get really interesting ;)

This should work:

      - TIMEZONE=America/Vancouver

      - HERALD_USER=root

      - LOG_TYPE=BOTH
      - LOG_LEVEL=verbose
      - LOG_PATH=/logs/
      - LOG_FILE=herald.log
      - LOG_TIMESTAMPS=TRUE

      - CLOUDFLARE_API_TOKEN=your-cloudflare-api-token   # see below DOMAIN_01_ZONE_ID
      - CLOUDFLARE_API_EMAIL=user@a.com
      
	  #- CLOUDFLARE_API_KEY=new-cloudflare-keys-that-dont-require_an_email
 
      - TRAEFIK_API_URL=http://traefik:8080/api/http/routers
      - TRAEFIK_INTERVAL=15
      - TRAEFIK_PROCESS_EXISTING=TRUE
      - TRAEFIK_RECORD_REMOVE_ON_STOP=TRUE
      
      # Docker Configuration
      - DOCKER_API_URL=unix:///var/run/docker.sock
      - DOCKER_EXPOSE_CONTAINERS=TRUE
      - DOCKER_PROCESS_EXISTING=TRUE
      - DOCKER_RECORD_REMOVE_ON_STOP=FALSE
      - DOCKER_SWARM_MODE=FALSE

      - DOMAIN_01_NAME=example.com
      #- DOMAIN_01_ZONE_ID=abcdef ## Needed if you are using Cloudflare Global API Email|Token
      - DOMAIN_01_RECORD_TARGET=host.example.com
      - DOMAIN_01_RECORD_TYPE=CNAME
      - DOMAIN_01_RECORD_PROXIED=TRUE
      - DOMAIN_01_RECORD_UPDATE_EXISTING=TRUE
      #- DOMAIN_01_RECORD_ALLOW_MULTIPLE=FALSE
      - DOMAIN_01_INPUT=docker,traefik
      #- DOMAIN_01_OUTPUT=cloudflare

You'll want to pull docker.io/nfastack/herald:latest for this one.
Let me know, I think we are getting closer.

[tehniemer]

Looks like latest is still 2.3.1 which was published two days ago, is that still the one I should be working with?

[tiredofit]

Apologies - looks like the github actions are not firing on commits to the container. I just pushed a manual amd64 image to :latest built from my own system.

[tehniemer]

Something is still goofy, the container is overwriting my outputs section to be blank on each restart. Sorry if I'm missing something.

herald.yml

general:
  log_level: verbose
  log_timestamps: true
inputs:
  docker:
    type: docker
    api_url: tcp://socket-proxy:2375
    process_existing: true
    expose_containers: true
    swarm_mode: false
    record_remove_on_stop: true
    tls:
      verify: true
  traefik:
    type: traefik
    api_url: http://traefik:8080/api/http/routers
    interval: 15s
    process_existing: true
    record_remove_on_stop: true
    tls:
      verify: true
outputs: {}
domains:
  domain_01:
    name: mydomain.com
    profiles:
      inputs:
        - docker
      outputs:
        - cloudflare
    record:
      type: CNAME
      ttl: 300
      target: mydomain.com
      update_existing: false
      allow_multiple: false
    zone_id: redacted

compose file (I am using the non-email api token for cloudflare)

  herald:
    image: nfrastack/herald:latest
    container_name: herald
    restart: always
    networks:
      - dockernet
    security_opt:
      - no-new-privileges=true
    volumes:
      - /opt/docker/herald:/config
    environment:
      - TIMEZONE=${TIMEZONE}
      - HERALD_USER=root
      - LOG_TYPE=BOTH
      - LOG_LEVEL=verbose
      - LOG_PATH=/config/logs/
      - LOG_FILE=herald.log
      - LOG_TIMESTAMPS=TRUE
      - CLOUDFLARE_API_KEY=${CLOUDFLARE_DNS_API_TOKEN}
      - TRAEFIK_API_URL=http://traefik:8080/api/http/routers
      - TRAEFIK_INTERVAL=15
      - TRAEFIK_PROCESS_EXISTING=TRUE
      - TRAEFIK_RECORD_REMOVE_ON_STOP=TRUE
      - DOCKER_API_URL=tcp://socket-proxy:2375
      - DOCKER_EXPOSE_CONTAINERS=TRUE
      - DOCKER_PROCESS_EXISTING=TRUE
      - DOCKER_RECORD_REMOVE_ON_STOP=TRUE
      - DOCKER_SWARM_MODE=FALSE
      - DOMAIN_01_NAME=${DOMAINNAME}
      - DOMAIN_01_ZONE_ID=${CLOUDFLARE_ZONEID}
      - DOMAIN_01_RECORD_TARGET=${DOMAINNAME}
      - DOMAIN_01_RECORD_TYPE=CNAME
      - DOMAIN_01_PROXIED=TRUE
      - DOMAIN_01_UPDATE_EXISTING_RECORD=TRUE
      #- DOMAIN_01_ALLOW_MULTIPLE=FALSE
      - DOMAIN_01_INPUT=docker,traefik
      #- DOMAIN_01_OUTPUT=cloudflare

[tiredofit]

Thanks, as I said almost there ;) Good news is that I've fixed CI. Taking your variables and going to recreate on my end and look into before EOD.

[tehniemer]

What's the need for both DOMAIN_01_NAME and DOMAIN_01_RECORD_TARGET?

[tiredofit]

So in this case, the NAME looks up against your provider - so, example.com

TARGET is if you are using either an A record to make the DNS record point to eg container.example.com -> 192.168.2.1. If CNAME destination.example.com - I see in your example they are the same which shouldn't cause issues.

I assume for your domain example.com it's an A record that points to a valid server so it shouldnt be an issue.

My quick test shows its related to the CLOUDFLARE_API_KEY. Let me circle back to that and see how I'm using things on my end.