next ai changes

.env.example

@@ -1,6 +1,6 @@
 # Copy to .env, fill in, then: chmod 600 .env
-# Values here are rendered into unbound.conf, authproxy.cfg and pam_radius
-# config at container start — this is the ONLY place DC IPs live.
+# Values here are rendered into authproxy.cfg, pam_radius config and the
+# Technitium forwarder zones at container start — the ONLY place DC IPs live.
 
 # ── Domain controllers ────────────────────────────────────────────────
 # AHDC01 (Trochalakis, 192.168.20.0/24)
@@ -27,3 +27,16 @@ DUO_SECURITY_GROUP_DN=
 # ── OpenVPN ↔ Duo Auth Proxy RADIUS shared secret ─────────────────────
 # Generate with: openssl rand -hex 24
 RADIUS_SECRET=
+
+# ── Technitium DNS web console admin password ─────────────────────────
+# Applied on FIRST start only; change later via the console itself.
+TECHNITIUM_ADMIN_PASSWORD=
+
+# ── Optional (defaults shown) ─────────────────────────────────────────
+# Duo Auth Proxy version; pin (e.g. 6.5.1) for deterministic updates
+#DUO_AUTHPROXY_VERSION=latest
+# Service directories — only set these when the stack lives in /opt
+# (the Ansible deploy writes them automatically)
+#OPENVPN_DIR=/opt/openvpn
+#DUO_DIR=/opt/duo-authproxy
+#TECHNITIUM_DIR=/opt/technitium