Secure log shipper docs: no public services or IPs

monitoring/exporting-logs.html.md

@@ -46,20 +46,34 @@ fly secrets set LOGTAIL_TOKEN=<token provided by logtail source>
 
 You can configure as many providers as you'd like by adding more secrets. The secrets needed are determined by [which provider(s)](https://github.com/superfly/fly-log-shipper#provider-configuration+external) you want to use.
 
-Before launching your application, you should edit the generated `fly.toml` file and delete the entire `[[services]]` section. Replace it with this:
+The Log Shipper pulls logs from Fly.io's internal log stream and doesn't need to accept inbound connections, so it shouldn't have any public services or IP addresses. Before deploying, edit the generated `fly.toml` file and delete the entire `[http_service]` (or `[[services]]`) section.
 
-```toml
-[[services]]
-  http_checks = []
-  internal_port = 8686
+Then deploy without allocating a public IP address:
+
+```cmd
+fly deploy --no-public-ips
 ```
 
-Then you can deploy it:
+If you already deployed a Log Shipper with a public IP address, list its addresses with `fly ips list` and remove them with `fly ips release <address>`.
 
-```cmd
-fly deploy
+## Add a health check
+
+The Log Shipper can occasionally stop shipping logs without exiting, so it's a good idea to add a health check. Vector serves a `/health` endpoint on port 8686. Since the app has no services, use a top-level [`[checks]` section](/docs/reference/configuration/#the-checks-section) in `fly.toml`, which doesn't require a public service or IP address:
+
+```toml
+[checks]
+  [checks.vector]
+    port = 8686
+    type = "http"
+    method = "get"
+    path = "/health"
+    grace_period = "10s"
+    interval = "30s"
+    timeout = "5s"
 ```
 
+Check the health status with `fly checks list`.
+
 ## Shipping specific logs
 
 By default, the log shipper gets logs from every app running within your organization (organization is set by the `ORG` secret/environment variable).

styles/config/vocabularies/fly-terms/accept.txt

@@ -28,6 +28,7 @@ containerd
 [Cc]ron(jobs?|job)?\b
 [Cc]rontabs?\b
 datacenters?\b
+Datadog
 datasource
 datatypes?\b
 declaratively