diff --git a/.cursorrules b/.cursorrules
index acec1e6..4ecf0a8 100644
--- a/.cursorrules
+++ b/.cursorrules
@@ -64,13 +64,11 @@ sleep 1
 | `/usr/local/bin/kiosk-restart` | Safe restart (kills Chromium + Python) |
 | `/etc/X11/xorg.conf.d/50-kiosk-hardening.conf` | Blocks TTY switching |
 
-## Gitea repo (private LAN only)
+## Gitea repo (homelab-configs is source of truth)
 
-- **URL**: `git@gitea.jgitta.com:jgitta/senior-kiosk.git` (SSH) or `https://gitea.jgitta.com/jgitta/senior-kiosk.git` (HTTPS)
-- **Branch**: `master`
-- **Exposure**: Internal only — LAN/VPN, not public internet. Never embed tokens in `git remote` URLs.
-- **Deploy**: `bash deploy.sh "message"` — push to Gitea, sync home screen, `kiosk-restart`.
-- **Secrets**: `credentials.md` is gitignored.
+- Gitea on **siklos:3002**, SSH on **port 2222** (not 22). HTTPS via Caddy `192.168.88.110`.
+- **Push senior-kiosk:** `https://gitea.jgitta.com/jgitta/senior-kiosk.git` (usual). Do not use `git@host:repo` without port 2222.
+- Infra docs: `jgitta/homelab-configs` on Gitea.
 
 ## Roundcube webmail
 
diff --git a/CLAUDE.md b/CLAUDE.md
index ece012a..37542a1 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -65,14 +65,25 @@ sleep 1
 | `/usr/local/bin/kiosk-restart` | Safe restart (kills Chromium + Python) |
 | `/etc/X11/xorg.conf.d/50-kiosk-hardening.conf` | Blocks TTY switching |
 
-## Gitea repo (private LAN only)
+## Gitea repo (see also `jgitta/homelab-configs`)
 
-- **URL**: `git@gitea.jgitta.com:jgitta/senior-kiosk.git` (SSH) or `https://gitea.jgitta.com/jgitta/senior-kiosk.git` (HTTPS)
-- **Branch**: `master`
-- **Exposure**: Internal only — `gitea.jgitta.com` resolves on LAN/VPN (Caddy at 192.168.88.110). Not public internet.
-- **Auth**: SSH key preferred (`git@gitea.jgitta.com:jgitta/senior-kiosk.git`) once the machine’s public key is in Gitea → Settings → SSH Keys. Until then use HTTPS without a token in the URL and `git config credential.helper store`. Rotate any token that was ever in a remote URL.
-- **Deploy**: `bash deploy.sh "message"` — push to Gitea, sync home screen, `kiosk-restart`; production via SSH on 192.168.88.x / Tailscale.
-- **Secrets**: `credentials.md` is gitignored; Roundcube passwords live on the mail server, not in this repo.
+Source of truth for infra: **https://gitea.jgitta.com/jgitta/homelab-configs**
+
+| Piece | Detail |
+|--------|--------|
+| Gitea app | Docker on **siklos** `192.168.88.27` — HTTP **3002**, SSH **2222** (not 22) |
+| Public URL | `gitea.jgitta.com` → **Caddy** `192.168.88.110` → proxies to Gitea :3002 |
+| DNS | MikroTik `192.168.88.1` / siklos; public DNS may resolve to WAN IP (still reaches Caddy :443) |
+
+**This repo (senior-kiosk):**
+
+- **HTTPS (usual — what worked before):** `https://gitea.jgitta.com/jgitta/senior-kiosk.git` — through Caddy. Auth via Gitea username + access token (`git config credential.helper store`), or token in URL (legacy on kiosk-dev).
+- **SSH:** Gitea SSH is on port **2222**, not 22. Plain `git@gitea.jgitta.com:...` hits port **22 on the WAN** and will **not** accept your Gitea password. Use either:
+  - `ssh://git@192.168.88.27:2222/jgitta/senior-kiosk.git` (LAN), or
+  - `~/.ssh/config`: `Host gitea.jgitta.com` → `Port 2222` (requires WAN/LAN port-forward 2222→siklos:2222 if using the hostname)
+- **Branch:** `master`
+- **Deploy:** `bash deploy.sh "message"` — push, sync home screen, `kiosk-restart`
+- **Secrets:** `credentials.md` gitignored
 
 ## Roundcube webmail
 
@@ -114,6 +125,6 @@ sleep 1
 - **Proxmox host**: jg-hud (main), siklos (192.168.88.27)
 - **TrueNAS**: 192.168.88.24
 - **Thinkstation** (dev desktop): 192.168.88.41
-- **Caddy reverse proxy**: 192.168.88.110 — handles *.jgitta.com
-- **Gitea**: gitea.jgitta.com (port 3002 internal)
+- **Caddy reverse proxy**: 192.168.88.110 — terminates HTTPS for `*.jgitta.com` (including `gitea.jgitta.com` → Gitea :3002)
+- **Gitea**: behind Caddy at `gitea.jgitta.com`; app listens on port 3002 on the Gitea host
 - **Headscale**: self-hosted Tailscale on siklos