The HOMEPAGE_ALLOWED_HOSTS bit is a good example of the config living somewhere other than where you'd look first. The point about Uptime Kuma is fair too. If a service has a health or API endpoint, pointing the check at that instead of the login page gets a bit closer to "actually working" than "online". For Vaultwarden, testing a restore from backup before trusting it with anything real is the step that tends to get skipped.