karldns.de/.env.example

# Required for a public KarlDNS instance.
DDNS_ADMIN_PASSWORD=change-me-long-random-admin-password
DDNS_ADMIN_PATH=/admin
DDNS_DASHBOARD_COOKIE_SECRET=change-me-long-random-cookie-signing-secret
DDNS_PUBLIC_BASE_URL=https://karldns.de
DDNS_HOSTNAME_SUFFIX=karldns.de

# Required DNS backend. Use a least-privilege Cloudflare token for this zone only.
DDNS_REQUIRE_DNS_PROVIDER=1
DDNS_DNS_PROVIDER=cloudflare
DDNS_CLOUDFLARE_API_TOKEN=change-me-cloudflare-token
DDNS_CLOUDFLARE_ZONE_ID=change-me-cloudflare-zone-id

# Usually leave these defaults alone.
DDNS_DATABASE=/data/ddns.sqlite3
DDNS_TTL=60

# Optional hardening/tuning.
# Keep app access logs disabled unless request URLs are redacted; update links are bearer secrets.
# Run a single Uvicorn worker by default. Rate-limit counters and per-host update locks are process-local.
# DDNS_TRUSTED_HOSTS=karldns.de,www.karldns.de
# DDNS_DNS_ZONES=karldns.de
# Trust CF-Connecting-IP / X-Forwarded-For when the direct peer is a private/local reverse proxy.
# This is the normal Docker + Nginx Proxy Manager setup. Set to 0 if the app port is reachable by untrusted LAN clients.
# DDNS_TRUST_PRIVATE_PROXY_HEADERS=1
# DDNS_TRUSTED_PROXY_IPS=127.0.0.1,::1
# DDNS_RATE_LIMIT_PER_MINUTE=60
# DDNS_ADMIN_RATE_LIMIT_PER_MINUTE=20
# DDNS_MAX_REQUEST_BODY_BYTES=16384
# DDNS_REDACTED_ACCESS_LOG=0
# DDNS_CLEANUP_PENDING_ACCOUNT_HOURS=24
# DDNS_CLEANUP_UNUSED_ACCOUNT_HOURS=1080
# DDNS_CLEANUP_EVENT_HISTORY_HOURS=4320
# DDNS_CLEANUP_INTERVAL_SECONDS=3600
# DDNS_DASHBOARD_UNLOCK_SECONDS=86400
# DDNS_DASHBOARD_STAY_UNLOCKED_SECONDS=2592000