feat: separate Public IP for DNS records from Server IP, improve settings help texts

- Add public_ip field to Settings for DNS A records (proxy/load balancer IP)
- DNS records now use public_ip, falling back to server_ip if empty
- Server IP renamed to "Server IP (Docker Host)" for clarity
- Public IP labeled "Public IP (DNS Target)"
- Updated help texts for domain, server IP, public IP, and Docker network
- DB migration + schema for public_ip column

internal/api/dns.go

@@ -12,6 +12,15 @@ import (
 	"github.com/go-chi/chi/v5"
 )
 
+// dnsTargetIP returns the IP to use for DNS A records.
+// Prefers PublicIP (the proxy/NPM host), falls back to ServerIP.
+func dnsTargetIP(settings store.Settings) string {
+	if settings.PublicIP != "" {
+		return settings.PublicIP
+	}
+	return dnsTargetIP(settings)
+}
+
 // dnsRecordView is the response format for DNS records with consumer context.
 type dnsRecordView struct {
 	FQDN         string `json:"fqdn"`
@@ -56,7 +65,7 @@ func (s *Server) listDNSRecords(w http.ResponseWriter, r *http.Request) {
 			views = append(views, dnsRecordView{
 				FQDN:         fqdn,
 				Type:         "A",
-				Content:      settings.ServerIP,
+				Content:      dnsTargetIP(settings),
 				ConsumerType: consumerType,
 				ConsumerName: name,
 				ConsumerID:   consumerID,
@@ -107,7 +116,7 @@ func (s *Server) listDNSRecords(w http.ResponseWriter, r *http.Request) {
 	// Process local records: check if they exist in provider.
 	for _, local := range localRecords {
 		status := "missing"
-		content := settings.ServerIP
+		content := dnsTargetIP(settings)
 		if pRec, ok := providerByFQDN[local.FQDN]; ok {
 			status = "synced"
 			content = pRec.Content
@@ -292,7 +301,7 @@ func (s *Server) syncDNSRecords(w http.ResponseWriter, r *http.Request) {
 			continue
 		}
 
-		recordID, err := provider.EnsureRecord(r.Context(), fqdn, settings.ServerIP)
+		recordID, err := provider.EnsureRecord(r.Context(), fqdn, dnsTargetIP(settings))
 		if err != nil {
 			slog.Warn("dns sync: failed to create record", "fqdn", fqdn, "error", err)
 			continue

internal/api/settings.go

@@ -21,6 +21,7 @@ import (
 type settingsRequest struct {
 	Domain           string `json:"domain"`
 	ServerIP         string `json:"server_ip"`
+	PublicIP         string `json:"public_ip"`
 	Network          string `json:"network"`
 	SubdomainPattern string `json:"subdomain_pattern"`
 	NotificationURL  string `json:"notification_url"`
@@ -59,6 +60,7 @@ func (s *Server) getSettings(w http.ResponseWriter, r *http.Request) {
 	respondJSON(w, http.StatusOK, map[string]any{
 		"domain":                    settings.Domain,
 		"server_ip":                 settings.ServerIP,
+		"public_ip":                 settings.PublicIP,
 		"network":                   settings.Network,
 		"subdomain_pattern":         settings.SubdomainPattern,
 		"notification_url":          settings.NotificationURL,
@@ -107,6 +109,9 @@ func (s *Server) updateSettings(w http.ResponseWriter, r *http.Request) {
 	if req.ServerIP != "" {
 		updated.ServerIP = req.ServerIP
 	}
+	if req.PublicIP != "" {
+		updated.PublicIP = req.PublicIP
+	}
 	if req.Network != "" {
 		updated.Network = req.Network
 	}