Build KarlDNS self-hosted DynDNS service

.env.example

@@ -1,18 +1,31 @@
+# Required for a public KarlDNS instance.
 DDNS_ADMIN_PASSWORD=change-me-long-random-admin-password
+DDNS_ADMIN_PATH=/admin
 DDNS_PUBLIC_BASE_URL=https://karldns.de
 DDNS_HOSTNAME_SUFFIX=karldns.de
-DDNS_DATABASE=/data/ddns.sqlite3
-DDNS_TRUSTED_HOSTS=karldns.de
-DDNS_DNS_PROVIDER=cloudflare
-DDNS_DNS_ZONES=karldns.de
+
+# Required DNS backend. Use a least-privilege Cloudflare token for this zone only.
 DDNS_REQUIRE_DNS_PROVIDER=1
+DDNS_DNS_PROVIDER=cloudflare
 DDNS_CLOUDFLARE_API_TOKEN=change-me-cloudflare-token
 DDNS_CLOUDFLARE_ZONE_ID=change-me-cloudflare-zone-id
+
+# Usually leave these defaults alone.
+DDNS_DATABASE=/data/ddns.sqlite3
 DDNS_TTL=60
-DDNS_RATE_LIMIT_PER_MINUTE=60
-DDNS_ADMIN_RATE_LIMIT_PER_MINUTE=20
-DDNS_MAX_REQUEST_BODY_BYTES=16384
-DDNS_CLEANUP_CHALLENGE_HOURS=72
-DDNS_CLEANUP_UNUSED_ACCOUNT_HOURS=1080
-DDNS_CLEANUP_INTERVAL_SECONDS=3600
-DDNS_TRUSTED_PROXY_IPS=127.0.0.1,::1
+
+# Optional hardening/tuning.
+# Keep app access logs disabled unless request URLs are redacted; update links are bearer secrets.
+# Run a single Uvicorn worker by default. Rate-limit counters and per-host update locks are process-local.
+# DDNS_TRUSTED_HOSTS=karldns.de,www.karldns.de
+# DDNS_DNS_ZONES=karldns.de
+# DDNS_TRUSTED_PROXY_IPS=127.0.0.1,::1
+# DDNS_RATE_LIMIT_PER_MINUTE=60
+# DDNS_ADMIN_RATE_LIMIT_PER_MINUTE=20
+# DDNS_MAX_REQUEST_BODY_BYTES=16384
+# DDNS_CLEANUP_CHALLENGE_HOURS=72
+# DDNS_CLEANUP_UNUSED_ACCOUNT_HOURS=1080
+# DDNS_CLEANUP_EVENT_HISTORY_HOURS=4320
+# DDNS_CLEANUP_INTERVAL_SECONDS=3600
+# DDNS_DASHBOARD_UNLOCK_SECONDS=86400
+# DDNS_DASHBOARD_STAY_UNLOCKED_SECONDS=2592000