milestone 17: real deadlines, validator holes, upstream editor, trusted proxies, contract samples, badvers

docs/how-to/back-up-and-restore.md

@@ -52,14 +52,18 @@ Without `--out` the export goes to stdout, where the file mode is your
 redirect's problem:
 
 ```sh
-nxdns export --data-dir /tmp/nxdns-lab/data | head -6
+nxdns export --data-dir /tmp/nxdns-lab/data | head -10
 ```
 
 ```
 // nxdns configuration
 // generated by `nxdns export` — the database is the source of truth
 .{
-    .upstream = .{ .read_timeout_ms = 3000, .total_timeout_ms = 5000 },
+    .upstream = .{
+        .attempt_timeout_ms = 2500,
+        .read_timeout_ms = 3000,
+        .total_timeout_ms = 5000,
+    },
     .dns = .{
         .bind_ipv4 = "127.0.0.1",
 ```

docs/how-to/install-with-docker.md

@@ -123,7 +123,7 @@ A healthy first start logs the seeding and the bound sockets:
 
 ```
 info(config_bootstrap): seeded the database from '/etc/nxdns/config.zon'
-info(nxdns): nxdns 0.1.0-dev serving on udp [::]:53 tcp [::]:53 tcp 0.0.0.0:53; 1 upstream(s); blocklist generation 1
+info(nxdns): nxdns <version> serving on udp [::]:53 tcp [::]:53 tcp 0.0.0.0:53; 1 upstream(s); blocklist generation 1
 info(web_server): web interface listening on 0.0.0.0:8080
 ```
 

docs/how-to/install-with-systemd.md

@@ -203,7 +203,7 @@ journalctl -u nxdns -f
 A healthy start logs a line naming every socket it bound:
 
 ```
-info(nxdns): nxdns 0.1.0-dev serving on udp [::]:53 tcp [::]:53 tcp 0.0.0.0:53; 1 upstream(s); blocklist generation 1
+info(nxdns): nxdns <version> serving on udp [::]:53 tcp [::]:53 tcp 0.0.0.0:53; 1 upstream(s); blocklist generation 1
 ```
 
 nxdns writes to stderr and systemd captures that into the journal; logging

docs/how-to/set-up-admin-authentication.md

@@ -259,6 +259,22 @@ interface at the very least, and preferably set a password.
   wrong, and they would retype a password that can never verify.
 - Requests from the box itself skip the API rate limit by default
   (`web.api_localhost_exempt`).
+- **If you put a reverse proxy in front of the admin interface, configure
+  `web.trusted_proxies` or turn `web.api_localhost_exempt` off.** A proxy on the
+  same box connects from loopback, so every request arrives exempt and the API
+  limiter — the only brake on guessing the admin password — stops applying to
+  anyone. Listing the proxy's address in `web.trusted_proxies` makes nxdns read
+  the client's address from the `X-Forwarded-For` the proxy appends, so the
+  limiter and the SSE connection cap bind each real client again:
+
+  ```zig
+  .web = .{
+      .trusted_proxies = "127.0.0.1",
+  },
+  ```
+
+  The proxy must append its own entry to that header. A proxy that forwards a
+  client-supplied `X-Forwarded-For` unchanged is not one to trust.
 - `web.session_ttl_hours`, `web.api_rate_limit_per_min` and the rest are in the
   [configuration reference](../reference/configuration.md); the routes are in
   the [API reference](../reference/api.md).

docs/how-to/upgrade.md

@@ -139,7 +139,7 @@ OK: no problems found
 >
 > ```
 > $ nxdns version
-> nxdns 0.1.0-dev (unknown)
+> nxdns <version> (unknown)
 > zig 0.16.0
 > ```
 >