added Heimdall

Documents ALLOW_INTERNAL_REQUESTS=false, which blocks enhanced-app
lookups to private IPs by default and makes every LAN tile fail silently.
Also that the data dir holds the API keys of every enhanced app.

heimdall/.env.example

@@ -0,0 +1,29 @@
+# Copy to .env and adjust. .env is git-ignored; this file is not.
+#
+# compose.yaml currently writes these as bare ${PUID} / ${PGID} / ${TZ},
+# with no defaults, so a clone without a .env starts the container with
+# empty values instead of failing. Set all three -- or add `:-` defaults
+# to compose.yaml, which is what the rest of this repo does.
+
+# ─── Identity ───────────────────────────────────────────────────────
+# Must own the data directory, or Heimdall can't write its database.
+#   id -u ; id -g
+PUID=1000
+PGID=1000
+TZ=Europe/Paris
+
+# ─── Paths ──────────────────────────────────────────────────────────
+# Mounted at /config. Holds the SQLite database, uploaded icons, the
+# nginx config -- and the API keys of every "enhanced" app you add.
+# Back it up; never commit it.
+#DATA_PATH=./data
+
+# ─── Ports ──────────────────────────────────────────────────────────
+#PORT=4080
+#HTTPS_PORT=4043
+
+# ─── Reaching your own LAN ──────────────────────────────────────────
+# NOT set in compose.yaml, and the one you will most likely need.
+# Heimdall blocks enhanced-app lookups to private/reserved IPs by
+# default -- which is every service in your house. See the README.
+#ALLOW_INTERNAL_REQUESTS=true