docs(config): clarify ACME backend and DNS-01 configuration

vars.example

@@ -9,10 +9,10 @@
 # Base directory of dynTLS configuration (defaults to script directory)
 #set_var DYNTLS  "${0%/*}"
 
-# Main ACME client program used for certificate operations
-# You can set this to any compatible wrapper script or binary
-# https://github.com/bruncsak/ght-acme.sh
-#set_var DYNTLS_LE_PROGRAM  "contrib/acme/letsencrypt.sh"
+# Main ACME client program, relative to DYNTLS
+# The client must support the command-line interface used by dyntls.
+# Use the local backend for the customized BIND/nsupdate DNS-01 workflow.
+#set_var DYNTLS_LE_PROGRAM  "contrib/acme/letsencrypt_master_local.sh"
 
 # OpenSSL binary (path if not in $PATH)
 #set_var DYNTLS_OPENSSL  "openssl"
@@ -84,10 +84,24 @@
 # Force regenerating keys on renewal (0=no, 1=yes)
 #set_var DYNTLS_PKI_KEY_FORCE_RENEW  0
 
-# DNS validation (dns-01 challenge): server address and TSIG key file name
-#set_var DYNTLS_DNS_SERVER  "root-dns.example365.tld"
-#set_var DYNTLS_DNS_TSIG    "tsig.key"
-#set_var DYNTLS_DNS_ZONE    ""
+# DNS-01 validation settings for the local ACME backend
+# Wildcard certificates require DNS-01 validation.
+
+# DNS server receiving authenticated dynamic updates
+#set_var DYNTLS_DNS_SERVER  "dns-primary.example.net"
+
+# Explicit path to the TSIG/RNDC key file
+# The file must exist and be readable by the user running dyntls.
+#set_var DYNTLS_DNS_TSIG  "$DYNTLS/private/dns-primary_example_net.key"
+
+# DNS zone setting
+# The current wildcard workflow derives the zone from the certificate CN.
+#set_var DYNTLS_DNS_ZONE  ""
+
+# The local ACME backend discovers authoritative nameservers from the zone.
+# Before requesting validation, it checks all pending challenge TXT values
+# in up to 10 rounds, waiting 5 seconds between unsuccessful rounds.
+# No additional dyntls configuration variables are required for this check.
 
 # ------------------------------------------------------------------
 # LOGGING
@@ -145,13 +159,13 @@
 # Commands to run before issuing/renewing a cert
 #set_list DYNTLS_CMD_PRE_LIST   ""
 
-# Commands to run after successfully issuing/renewing a cert
+# Commands to run after the ACME client invocation
 #set_list DYNTLS_CMD_POST_LIST  ""
 
 # ------------------------------------------------------------------
 # BACKUP AND EXPIRATION
 # ------------------------------------------------------------------
 
-# Days to keep backuped certificates before removal
+# Days to retain certificate backups before removal
 # Set to 0 to disable automatic deletion of backups
 #set_var DYNTLS_BACKUP_EXPIRATION  360