diff --git a/network-map.md b/network-map.md
new file mode 100644
index 0000000..2833a3e
--- /dev/null
+++ b/network-map.md
@@ -0,0 +1,292 @@
+# 🌐 Network Map & Topology
+
+**Last Updated:** October 31, 2025  
+**Network Range:** 192.168.68.0/22  
+**Maintained By:** Weston
+
+---
+
+## 📊 Quick Reference
+
+| Device | IP Address | Purpose |
+|--------|-----------|---------|
+| **TP-Link Router** | 192.168.68.1 | Gateway, DHCP, Mesh Primary |
+| **Foxtrot (Gaming PC)** | 192.168.68.50 | Workstation |
+| **Unraid Server (Tower)** | 192.168.68.51 | Main infrastructure |
+| **PiKVM** | 192.168.68.53 | Server out-of-band management |
+| **Pi-hole (Pi Zero 2W)** | 192.168.68.61 | DNS + Ad-blocking + Unbound |
+| **Code-Server VM** | 192.168.68.70 | Ubuntu headless + VS Code |
+| **TP-Link Mesh Node** | 192.168.71.250 | Office WiFi extender |
+
+---
+
+## 🗺️ Physical Network Topology
+
+```
+                         Internet
+                            │
+                            │ (WAN)
+                            │
+                    ┌───────┴────────┐
+                    │  TP-Link Router│
+                    │  192.168.68.1  │
+                    │ (Mesh Primary) │
+                    └───────┬────────┘
+                            │ (LAN - Mesh Network)
+                            │
+             ┌──────────────┼──────────────┐
+             │              │              │
+        ┌────┴─────┐   ┌────┴─────┐  ┌────┴─────┐
+        │TP-Link   │   │  Unraid  │  │Pi Zero   │
+        │Mesh Node │   │  Server  │  │Pi-hole   │
+        │ .71.250  │   │  Tower   │  │Unbound   │
+        │ (Office) │   │  .68.51  │  │ .68.61   │
+        └────┬─────┘   └────┬─────┘  └──────────┘
+             │              │
+        ┌────┼────┐    ┌────┼─────┐
+        │    │    │    │    │     │
+   ┌────┴┐ ┌─┴────┐ ┌─┴──┐ │  ┌──┴────┐
+   │Foxtrot│Laptop│ │PiKVM│ │  │VM:    │
+   │Gaming│(WiFi)│ │.68.53│ │  │Code   │
+   │  PC  │      │ │(Direct│ │  │Server │
+   │.68.50│      │ │to Svr)│ │  │.68.70 │
+   └──────┘ └─────┘ └──────┘ │  └───────┘
+                              │
+                         (Server VMs)
+```
+
+---
+
+## 🖥️ Unraid Server Virtual Network
+
+```
+Physical: eth0 (2.5GbE) → bond0 → br0 (192.168.68.51)
+                                    │
+               ┌────────────────────┼────────────────────┐
+               │                    │                    │
+          ┌────┴─────┐        ┌─────┴──────┐      ┌─────┴─────┐
+          │   VMs    │        │  Docker    │      │ Tailscale │
+          │          │        │            │      │    VPN    │
+          └────┬─────┘        └─────┬──────┘      └───────────┘
+               │                    │           100.122.220.126
+               │               ┌────┴─────┐
+          ┌────┴─────┐        │ docker0  │
+          │Code-Srvr │        │172.17.0.1│
+          │ .68.70   │        └────┬─────┘
+          │ (Ubuntu) │             │
+          └──────────┘        ┌────┼────────┬──────┐
+                              │    │        │      │
+                         ┌────┴┐ ┌─┴──┐ ┌───┴──┐ ┌─┴───┐
+                         │open-│ │NPM │ │Gitea │ │Guac │
+                         │webui│ │ .4 │ │  .3  │ │ .2  │
+                         │ .5  │ └────┘ └──────┘ └─────┘
+                         └─────┘
+```
+
+---
+
+## 📍 Complete IP Address Table
+
+### Infrastructure & Services
+
+| Device/Service | IP Address | MAC | Type | Notes |
+|---------------|-----------|-----|------|-------|
+| **TP-Link Router** | 192.168.68.1 | - | Physical | Gateway, DHCP, primary mesh |
+| **Foxtrot (Gaming PC)** | 192.168.68.50 | - | Physical | Workstation, static IP |
+| **Unraid Server** | 192.168.68.51 | 58:47:ca:7b:97:b0 | Physical | Main server, static IP |
+| **PiKVM** | 192.168.68.53 | - | Physical | Direct to server, management |
+| **Pi-hole (Pi Zero 2W)** | 192.168.68.61 | - | Physical | DNS/ad-block/Unbound, static |
+| **Code-Server VM** | 192.168.68.70 | - | Virtual | Ubuntu + VS Code, KVM/QEMU |
+| **Laptop** | DHCP | - | Physical | Mobile device, WiFi |
+| **TP-Link Mesh Node** | 192.168.71.250 | - | Physical | Office WiFi extender |
+
+### Docker Containers (172.17.0.0/16)
+
+| Container | Docker IP | Host Port | Purpose |
+|-----------|-----------|-----------|---------|
+| **ApacheGuacamole** | 172.17.0.2 | 4000 | Remote desktop gateway |
+| **Gitea** | 172.17.0.3 | 3002, 22 | Git server |
+| **NginxProxyManager** | 172.17.0.4 | 1880, 7818, 18443 | Reverse proxy |
+| **open-webui** | 172.17.0.5 | 3000 | LLM interface |
+| **Cloudflared** | 172.17.0.6 | 46495 | Cloudflare tunnel |
+| **Vaultwarden** | 172.17.0.7 | 4743 | Password manager |
+
+### VPN
+
+| Service | IP | Network | Purpose |
+|---------|----|---------| --------|
+| **Tailscale** | 100.122.220.126 | 100.64.0.0/10 | Secure remote access |
+
+---
+
+## 🌐 Network Details
+
+**Subnet:** 192.168.68.0/22  
+**Netmask:** 255.255.252.0  
+**Usable Range:** 192.168.68.1 - 192.168.71.254 (1022 hosts)  
+**Gateway:** 192.168.68.1  
+**Primary DNS:** 192.168.68.61 (Pi-hole)  
+**Secondary DNS:** 9.9.9.9 (Quad9)  
+**Broadcast:** 192.168.71.255
+
+---
+
+## 🔌 Port Reference Guide
+
+### Unraid Server Ports
+
+| Service | Port | Protocol | URL |
+|---------|------|----------|-----|
+| **Unraid WebUI** | 80 | HTTP | http://192.168.68.51 |
+| **Unraid SSL** | 443 | HTTPS | https://192.168.68.51 |
+| **SMB** | 445 | TCP | \\\\192.168.68.51 |
+| **SSH** | 22 | TCP | ssh root@192.168.68.51 |
+
+### Container Access
+
+| Service | URL | Port | Notes |
+|---------|-----|------|-------|
+| **open-webui** | http://192.168.68.51:3000 | 3000 | LLM chat interface |
+| **Gitea** | http://192.168.68.51:3002 | 3002 | Git web UI |
+| **Gitea (domain)** | https://gitea.segelschiff.app | 443 | Via Cloudflare |
+| **NPM Web** | http://192.168.68.51:1880 | 1880 | Proxy frontend |
+| **NPM Admin** | http://192.168.68.51:7818 | 7818 | Management UI |
+| **Guacamole** | http://192.168.68.51:4000 | 4000 | Remote desktop |
+| **Vaultwarden** | http://192.168.68.51:4743 | 4743 | Password vault |
+
+### Infrastructure Access
+
+| Service | URL | Default Port |
+|---------|-----|--------------|
+| **PiKVM** | https://192.168.68.53 | 443 |
+| **Pi-hole Admin** | http://192.168.68.61/admin | 80 |
+| **Code-Server** | http://192.168.68.70:8080 | 8080 (typical) |
+
+---
+
+## 🛡️ DNS Configuration
+
+**Primary:** Pi-hole (192.168.68.61)
+- Ad-blocking
+- Local DNS records
+- Query logging
+- DHCP relay
+
+**Upstream:** Unbound (same device)
+- Recursive DNS resolver
+- No forwarding to ISP
+- Privacy-focused
+- DNSSEC validation
+
+**Resolution Flow:**
+```
+Client → Pi-hole (192.168.68.61) → Unbound → Root Servers
+```
+
+**Fallback:** 9.9.9.9 (Quad9) - Privacy-respecting public DNS
+
+---
+
+## 🌐 Remote Access
+
+### Cloudflare Tunnel
+```
+Internet → Cloudflare Edge → Tunnel → NPM → Services
+```
+- **Domain:** *.segelschiff.app
+- **Services Exposed:** Gitea (and others via NPM)
+- **Benefits:** No open ports, DDoS protection, SSL
+- **Container:** Cloudflared (172.17.0.6)
+
+### Tailscale VPN
+```
+Remote Device → Encrypted Tunnel → Unraid (100.122.220.126)
+```
+- **Network:** 100.64.0.0/10 (CGNAT)
+- **Protocol:** WireGuard
+- **Benefits:** Zero-trust, peer-to-peer, NAT traversal
+- **Access:** Full homelab as if local
+
+---
+
+## 📊 Network Performance
+
+| Link | Capacity | Usage | Status |
+|------|----------|-------|--------|
+| **Unraid NIC** | 2.5 Gbps | <1% | Underutilized |
+| **Mesh Backhaul** | Unknown | Unknown | Check model specs |
+| **Internet WAN** | Unknown | Unknown | ISP dependent |
+
+**Observed (eth0):** ~2 Mbps average = 0.08% of 2.5G capacity
+
+---
+
+## 🔧 Troubleshooting Commands
+
+### Connectivity Tests
+```bash
+# Test key infrastructure
+ping 192.168.68.1    # Router
+ping 192.168.68.51   # Unraid
+ping 192.168.68.61   # Pi-hole
+ping 192.168.68.70   # Code-Server VM
+ping 8.8.8.8         # Internet
+
+# DNS tests
+nslookup google.com 192.168.68.61  # Test Pi-hole
+dig @192.168.68.61 example.com     # Detailed DNS query
+```
+
+### Network Status (from Unraid)
+```bash
+# Interfaces
+ip addr show
+ip link show
+
+# Routes
+ip route show
+
+# Active connections
+ss -tulpn
+
+# Docker networks
+docker network ls
+docker network inspect bridge
+```
+
+### VM Network (Code-Server)
+```bash
+# List VMs
+virsh list --all
+
+# Get VM IP
+virsh domifaddr <vm-name>
+
+# VM network info
+virsh net-info default
+```
+
+---
+
+## 📝 Recommendations
+
+### Security
+1. ⚠️ **Separate Gitea SSH port** - Currently conflicts with Unraid SSH (both port 22)
+2. ⚠️ **Implement VLANs** - Segment management/services/workstations
+3. ⚠️ **Firewall hardening** - Move from ACCEPT-all to explicit rules
+
+### Performance
+1. Monitor mesh performance between nodes
+2. Document ISP speeds and plan accordingly
+3. Consider 10GbE upgrade path (future)
+
+### Documentation
+1. ✅ Document Code-Server VM configuration
+2. ✅ Record TP-Link mesh model and capabilities
+3. ✅ Map exact ISP speeds and plan
+
+---
+
+**Last Updated:** October 31, 2025  
+**Next Review:** When network topology changes  
+**Quick Access:** See README.md for service URLs