v0.32.5

docs/SETTINGS.md

@@ -607,3 +607,30 @@ The sample charts are browser-local, bounded and reset on a changed config
 revision, logout or source unavailability. They are not computed while hidden.
 No additional polling, SQLite schema migration or new administrator endpoint
 is introduced. Existing Stream widgets remain independent.
+
+
+## Dynamic DNS / DDNS client ACL (0.32.5)
+
+In **ACL profiles**, add an **Allow** rule and select **DNS / DDNS** instead of
+IP/CIDR. Enter the hostname without a URL, port or wildcard, for example:
+
+```text
+allow myoffice.example.ddns.net
+```
+
+Apply the profile to the desired vhost. Use the **Allow exceptions** preset
+(default deny) to admit only resolved addresses (and any other explicitly
+allowed IP/country exceptions). Host policies and inline vhost/location ACLs
+accept the same rule format. A/AAAA records are refreshed every 60 seconds,
+with immediate refresh on published configuration changes. No request-path DNS
+lookup is performed. The initial state and failed, empty, oversized, or expired
+DNS results **do not authorize any client IP** for that DNS rule. Only
+**allow** rules may contain DNS names; `deny example.com` is rejected.
+
+Limits: 128 distinct names across active ACLs, 32 returned IPs/name, four-
+second lookup timeout and eight parallel DNS lookups. Successful answers expire
+after 180 seconds if the refresh task stalls. DNS changes may take up to the
+next poll interval to take effect. The chosen DDNS provider controls which IPs
+receive access; always trust the provider and protect its credentials. Existing
+IP/CIDR ACLs and country rules are unchanged. No new admin access path or
+backend origin DNS exceptions are created by this feature.