Polish KarlDNS production UI and docs

router_dyndns/ddns_models.py

@@ -5,10 +5,12 @@ import urllib.parse
 from dataclasses import dataclass
 from pathlib import Path
 
-from pydantic import BaseModel, Field, field_validator
+from pydantic import BaseModel, ConfigDict, Field, field_validator
 
 
 class DdnsSettings(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
     database_path: Path = Field(default=Path("ddns.sqlite3"))
     shared_secret: str = Field(default="")
     admin_password: str = Field(default="")
@@ -37,6 +39,8 @@ class DdnsSettings(BaseModel):
     cleanup_interval_seconds: int = Field(default=3600, ge=1, le=24 * 60 * 60)
     dashboard_unlock_seconds: int = Field(default=24 * 60 * 60, ge=60, le=30 * 24 * 60 * 60)
     dashboard_stay_unlocked_seconds: int = Field(default=30 * 24 * 60 * 60, ge=60, le=30 * 24 * 60 * 60)
+    dashboard_cookie_secret: str = Field(default="")
+    redacted_access_log: bool = Field(default=False)
     ttl: int = Field(default=60, ge=60, le=86400)
 
     @field_validator("public_base_url")
@@ -61,16 +65,22 @@ class DdnsSettings(BaseModel):
             raise ValueError("admin_path may only contain URL-safe path characters")
         reserved_paths = {
             "/accounts",
+            "/admin.css",
+            "/admin-tables.js",
             "/api",
             "/app.js",
             "/claim",
+            "/clipboard.js",
             "/d",
             "/docs",
             "/favicon.ico",
             "/healthz",
             "/install.sh",
             "/ip",
+            "/bootstrap-subset.css",
             "/logo.png",
+            "/logo-nav.webp",
+            "/logo.webp",
             "/m",
             "/magic",
             "/nic",
@@ -78,7 +88,11 @@ class DdnsSettings(BaseModel):
             "/privacy",
             "/redoc",
             "/robots.txt",
+            "/sitemap.xml",
             "/site.webmanifest",
+            "/social-preview.png",
+            "/social-preview.webp",
+            "/theme.js",
             "/u",
             "/uninstall.sh",
         }
@@ -104,6 +118,10 @@ class DdnsSettings(BaseModel):
             return
         if len(self.admin_password) < 16:
             raise RuntimeError("DDNS_ADMIN_PASSWORD must be at least 16 characters when DDNS_REQUIRE_DNS_PROVIDER=1")
+        if len(self.dashboard_cookie_secret or self.admin_password) < 32:
+            raise RuntimeError(
+                "DDNS_DASHBOARD_COOKIE_SECRET or DDNS_ADMIN_PASSWORD must be at least 32 characters for dashboard cookie signing when DDNS_REQUIRE_DNS_PROVIDER=1"
+            )
         if not self.hostname_suffix:
             raise RuntimeError("DDNS_HOSTNAME_SUFFIX is required when DDNS_REQUIRE_DNS_PROVIDER=1")
         if not self.effective_trusted_hosts: