Add docs for #104

Author: AndrewGuenther

docs/configuration.md

@@ -16,6 +16,7 @@ The following describes available options:
 | `cwagent_enabled`       | If set, enables Cloudwatch agent and forward instance metrics to Cloudwatch. Requires `cwagent_cfg_param_name` to be set. |
 | `cwagent_cfg_param_name` | The name of the SSM Parameter holding the Cloudwatch agent configuration and which the agent shall pull from. Requires `cwagent_enabled` to be set. |
 | `ip_local_port_range`   | Overrides Linux's `net.ipv4.ip_local_port_range` sysctl for ephemeral source ports used by SNAT. Provide as two space‑separated integers `low high` (e.g., `1024 65535`). Useful to expand the ephemeral port range and reduce NAT port exhaustion and collisions. |
+| `nf_conntrack_max`      | Overrides Linux's `net.netfilter.nf_conntrack_max` sysctl to set the maximum number of concurrently tracked connections. Provide as an integer (e.g., `262144`). Increasing this can help high-connection workloads but consumes more memory; monitor conntrack metrics and AWS security group connection tracking quotas. |
 
 ## IAM Requirements