ipabusedb-docker-ssh: autoload .env via godotenv, document DOCKER_HOST passthrough, surface docker CLI errors

ipabusedb-docker-ssh/README.md

@@ -21,10 +21,21 @@ Categories are `18,22` (Brute-Force, SSH).
 
 ## Configuration
 
-| Variable                | Purpose                                          |
-| ----------------------- | ------------------------------------------------ |
-| `DOCKER_CONTAINER_NAME` | container whose logs are read (required)         |
-| `IPABUSEDB_API_KEY`     | AbuseIPDB API key (required only with `--submit`) |
+A `.env` file in the working directory is loaded at startup (see
+`.env.example`; `.env` is gitignored). Variables already set in the
+shell take precedence over the file.
+
+| Variable                | Purpose                                                  |
+| ----------------------- | -------------------------------------------------------- |
+| `DOCKER_CONTAINER_NAME` | container whose logs are read (required)                 |
+| `IPABUSEDB_API_KEY`     | AbuseIPDB API key (required only with `--submit`)        |
+| `DOCKER_HOST`           | passed through to the `docker` CLI to target a remote daemon |
+
+Because the program shells out to the `docker` CLI with its own
+environment, `DOCKER_HOST` (and `DOCKER_CONTEXT`, `DOCKER_TLS_VERIFY`,
+`DOCKER_CERT_PATH`) work exactly as they do for `docker` itself. Set
+`DOCKER_HOST=ssh://user@host` in `.env` to read logs from a remote
+daemon while the AbuseIPDB key never leaves the local machine.
 
 Flags:
 
@@ -34,6 +45,7 @@ Flags:
 | `-o FILE`       | write the CSV to `FILE` instead of stdout                 |
 | `--input FILE`  | parse `FILE` (or `-` for stdin) instead of `docker logs`  |
 | `--submit`      | POST the CSV to the AbuseIPDB bulk-report endpoint        |
+| `--env FILE`    | env file to autoload (default `.env`; missing is ignored) |
 
 ## Usage