tiny update

.env.example

@@ -57,6 +57,84 @@
 # Leave empty to auto-generate and persist to save.json
 # OVERLORD_AGENT_TOKEN=
 
+# Recommended: pin browser Origin/CSRF checks to the externally visible origin.
+# This is especially important behind TLS offload or a reverse proxy.
+# OVERLORD_PUBLIC_ORIGIN=https://overlord.example.com
+
+# When forwarding headers arrive from a public-address reverse proxy, list the
+# proxy's immediate IP here (comma-separated). Only loopback peers are trusted
+# automatically; private container/LAN proxy addresses must also be listed.
+# OVERLORD_TRUSTED_PROXY_IPS=203.0.113.10
+
+# Legacy query-token clients remain supported. Prefer X-Agent-Token for new
+# clients; set this to false once every deployed client has migrated.
+# OVERLORD_ALLOW_AGENT_TOKEN_QUERY=false
+# Legacy password-protected file-share links remain supported. Prefer the
+# X-Download-Password header; set this to false to reject query secrets.
+# OVERLORD_ALLOW_FILE_SHARE_PASSWORD_QUERY=false
+
+# Bound unapproved identity storage if an agent token is leaked. Pending rows
+# expire after seven days and are capped globally/per observed source IP.
+# OVERLORD_PENDING_ENROLLMENT_TTL_HOURS=168
+# OVERLORD_MAX_PENDING_ENROLLMENTS=100000
+# OVERLORD_MAX_PENDING_ENROLLMENTS_PER_IP=10000
+# OVERLORD_MAX_PREAUTH_SOCKETS_GLOBAL=100000
+# OVERLORD_MAX_PREAUTH_SOCKETS_PER_IP=10000
+# OVERLORD_MAX_ENROLLMENT_VERIFICATIONS=4096
+# OVERLORD_ENROLLMENT_VERIFICATION_ATTEMPTS_PER_SECOND=100000
+# OVERLORD_ENROLLMENT_VERIFICATION_ATTEMPT_BURST=200000
+
+# Generous defaults avoid dropping frames in large fleets; lower these if the
+# server operator wants explicit memory/backpressure limits.
+# OVERLORD_THUMBNAIL_PENDING_MAX_COUNT=512
+# OVERLORD_THUMBNAIL_PENDING_MAX_BYTES=536870912
+# OVERLORD_THUMBNAIL_QUEUE_MAX=512
+# OVERLORD_THUMBNAIL_CACHE_MAX_BYTES=1073741824
+# OVERLORD_THUMBNAIL_REQUEST_MAX=4096
+# OVERLORD_THUMBNAIL_WAITER_ID_MAX=4096
+# OVERLORD_THUMBNAIL_WAITER_MAX=8192
+
+# Notification screenshot storage is bounded transactionally. Byte values are
+# raw bytes. Uncomment to impose lower operator-selected retention limits.
+# OVERLORD_NOTIFICATION_SCREENSHOT_CLIENT_MAX_COUNT=10000
+# OVERLORD_NOTIFICATION_SCREENSHOT_CLIENT_MAX_BYTES=1073741824
+# OVERLORD_NOTIFICATION_SCREENSHOT_GLOBAL_MAX_COUNT=100000
+# OVERLORD_NOTIFICATION_SCREENSHOT_GLOBAL_MAX_BYTES=17179869184
+
+# Notification metadata history is also bounded per client and fleet-wide.
+# Oldest rows and linked screenshots are pruned atomically at these limits.
+# OVERLORD_NOTIFICATION_HISTORY_CLIENT_MAX_COUNT=100000
+# OVERLORD_NOTIFICATION_HISTORY_CLIENT_MAX_BYTES=1073741824
+# OVERLORD_NOTIFICATION_HISTORY_GLOBAL_MAX_COUNT=1000000
+# OVERLORD_NOTIFICATION_HISTORY_GLOBAL_MAX_BYTES=17179869184
+
+# Chat-plugin fleet retention quotas. These prevent many approved client
+# identities from multiplying the built-in per-client message/attachment caps.
+# OVERLORD_CHAT_PLUGIN_GLOBAL_MAX_MESSAGES=1000000
+# OVERLORD_CHAT_PLUGIN_GLOBAL_MAX_MESSAGE_BYTES=17179869184
+# OVERLORD_CHAT_PLUGIN_GLOBAL_MAX_ATTACHMENT_BYTES=17179869184
+
+# Fleet-wide archived keylog quotas supplement the built-in per-client cap.
+# Oldest rows and their full-text-search entries are pruned first.
+# OVERLORD_INPUT_ARCHIVE_GLOBAL_MAX_FILES=1000000
+# OVERLORD_INPUT_ARCHIVE_GLOBAL_MAX_BYTES=68719476736
+
+# Audit retention is opt-in. Uncomment either setting to prune old history.
+# OVERLORD_AUDIT_RETENTION_DAYS=90
+# OVERLORD_AUDIT_MAX_ROWS=250000
+
+# Web Push subscriptions are capped per account and server-wide. When an
+# account reaches its cap, registering a new browser replaces its oldest entry.
+# Delivery uses small batches so a large installation cannot create an
+# unbounded number of simultaneous outbound requests.
+# OVERLORD_MAX_PUSH_SUBSCRIPTIONS_PER_USER=10
+# OVERLORD_MAX_PUSH_SUBSCRIPTIONS=10000
+# OVERLORD_PUSH_SUBSCRIPTION_RATE_LIMIT_MAX=20
+# OVERLORD_PUSH_SUBSCRIPTION_RATE_LIMIT_WINDOW_SECONDS=60
+# OVERLORD_PUSH_SUBSCRIPTION_RATE_LIMIT_LOCKOUT_SECONDS=60
+# OVERLORD_WEB_PUSH_DELIVERY_CONCURRENCY=8
+# OVERLORD_WEB_PUSH_DELIVERY_BATCH_SIZE=100
+
 # OPTIONAL: Solana publisher RPC request limits (per signed-in user)
 # OVERLORD_SOL_PUBLISH_RATE_LIMIT_MAX=3
 # OVERLORD_SOL_PUBLISH_RATE_LIMIT_WINDOW_SECONDS=300