diff --git a/infrastructure/ana-colo-security-issues.md b/infrastructure/ana-colo-security-issues.md
new file mode 100644
index 0000000..4a941fa
--- /dev/null
+++ b/infrastructure/ana-colo-security-issues.md
@@ -0,0 +1,161 @@
+---
+created: '2026-04-16T00:45:34+00:00'
+id: fd7ea587-115c-4dfd-85d6-64a71da67f98
+keywords:
+- DNS amplification
+- hardcoded secrets
+- plaintext credentials
+- no firewall
+- no health checks
+- no resource limits
+- no monitoring
+- traefik debug
+- portainer outdated
+- rustdesk outdated
+- UTM stale
+links: []
+modified: '2026-04-16T00:45:34+00:00'
+summary: All 23 security and quality issues found during the ana-colo infrastructure
+  survey on 2026-04-15, organized by severity with remediation notes.
+tags:
+- infrastructure
+- ana-colo
+- security
+- issues
+- remediation
+title: Ana Colo — Security and Quality Issues
+---
+
+# Ana Colo — Security and Quality Issues
+
+> **Survey date:** 2026-04-15
+> **Total findings:** 23 (3 critical, 7 medium, 13 low)
+
+---
+
+## 🔴 Critical
+
+### 1. DNS exposed to the internet (FortiGate policy 61)
+
+- **Policy:** wan1 → internal DNS ALLOW ALL
+- **Risk:** DNS amplification attack vector — anyone on the internet can query the internal DNS resolver
+- **Fix:** Restrict DNS source to internal zones and known VPN subnets only
+
+### 2. Hardcoded secrets in Docker compose files
+
+- **Affected files:**
+  - `synapse/compose.yaml` — Postgres password
+  - `seafile/compose.yaml` — MySQL root password (also duplicated in .env)
+  - `gitea/compose.yaml` — DB password
+- **Risk:** Secrets committed to git, visible to anyone with compose file access
+- **Fix:** Move all secrets to `.env` files with 600 permissions; never commit secrets to version control
+
+### 3. Plaintext secrets in config files
+
+- **Affected files:**
+  - `synapse/homeserver.yaml` — DB password, registration secret, macaroon key, form secret, appservice tokens
+  - `mattermost/config.json` — SendGrid API key, SMTP password, encryption keys, salts
+  - `mailrise/mailrise.conf` — SendGrid API key, Mattermost webhook tokens
+- **Risk:** Credentials stored in version-controllable files, exposed to anyone with read access
+- **Fix:** Externalize to `.env` or a secrets manager; add config files to `.gitignore`
+
+---
+
+## 🟡 Medium
+
+### 4. Disabled but present ollama VIP + open policy
+
+- **Details:** VIP "ollama-in" is disabled (good) but firewall policy 31 still allows :11434 from WAN
+- **Fix:** Remove both the VIP and the policy
+
+### 5. WebDAV without TLS
+
+- **Details:** Port 8444 to NAS — raw TCP; NAS may not serve TLS
+- **Fix:** Route through Traefik for TLS termination, or verify NAS is serving TLS
+
+### 6. No health checks on most services
+
+- **Details:** 13 of 20 containers have no health checks configured
+- **Fix:** Add `healthcheck` directives to all compose files
+
+### 7. No resource limits on any container
+
+- **Details:** 20 containers sharing 16GB RAM with no memory or CPU limits
+- **Fix:** Add `deploy.resources.limits` to all compose files
+
+### 8. No monitoring stack
+
+- **Details:** No Prometheus, Grafana, Loki, or log aggregation deployed
+- **Fix:** Deploy monitoring (separate task)
+
+### 9. No backup automation visible
+
+- **Details:** Restic server exists but no client backup jobs found
+- **Fix:** Define and deploy backup schedules for all critical data
+
+### 10. FortiGate UTM features stale
+
+- **Details:** Virus DB: 2018, IPS DB: 2015
+- **Fix:** Update subscriptions or confirm this is intentional
+
+---
+
+## 🟢 Low
+
+### 11. Traefik debug logging in production
+
+- **Details:** `--log.level=DEBUG` is running in production
+- **Fix:** Set to INFO or WARN
+
+### 12. Traefik dashboard unprotected on :8380
+
+- **Fix:** Add basic auth or restrict to internal sources
+
+### 13. Stale commented-out configs in traefik.yml
+
+- **Details:** Old Route53 DNS challenge, multiple cert resolvers
+- **Fix:** Clean up
+
+### 14. Portainer CE 3 years old + agent 2 years old
+
+- **Fix:** Update images or remove (Dockge is the replacement)
+
+### 15. RustDesk image 13 months old
+
+- **Fix:** Update image
+
+### 16. IT Tools image 13 months old
+
+- **Fix:** Update image
+
+### 17. Dockge backup uses untagged custom image (9392b1d81976)
+
+- **Fix:** Tag the image or document its source
+
+### 18. Firewall policy named "DELETE"
+
+- **Details:** Policy 50: internal → mgmt ALLOW ALL
+- **Fix:** Remove or rename
+
+### 19. Redundant firewall policies
+
+- **Details:** Policies 1 and 6 both do internal → wan1 ALLOW ALL
+- **Fix:** Consolidate into a single policy
+
+### 20. wan2 has no IP (DHCP failed/disabled)
+
+- **Fix:** Configure the interface or disable it
+
+### 21. Inconsistent restart policies across stacks
+
+- **Details:** Some use `unless-stopped`, some have none
+- **Fix:** Standardize to `unless-stopped`
+
+### 22. No logging configuration on any container
+
+- **Fix:** Add logging driver options (`max-size`, `max-file`)
+
+### 23. Several services exposed on direct ports instead of through Traefik
+
+- **Affected:** SillyTavern :8100, Open WebUI :3100, Dockge :5001, Portainer :9000/:9001, IT Tools :8780, Mailrise :8025
+- **Note:** Some may be intentional (admin tools). Document the reason for each or add Traefik routing.
\ No newline at end of file