diff --git a/infrastructure/ana-colo-overview.md b/infrastructure/ana-colo-overview.md
new file mode 100644
index 0000000..14919e2
--- /dev/null
+++ b/infrastructure/ana-colo-overview.md
@@ -0,0 +1,56 @@
+---
+created: '2026-04-16T00:45:29+00:00'
+id: d8ea2189-ba56-4cde-81c3-b22a1bb5f675
+keywords:
+- ana-colo
+- ana-docker
+- ana-gw
+- FortiGate-80F
+- colocation
+- infrastructure
+links: []
+modified: '2026-04-16T00:45:29+00:00'
+summary: 'Top-level overview of the ana-colo colocation environment: single colo,
+  5 network zones, 1 FortiGate-80F firewall, ~10 servers, and ~20 Docker containers
+  on the primary Docker host.'
+tags:
+- infrastructure
+- ana-colo
+- network
+- docker
+- security
+title: Ana Colo — Infrastructure Overview
+---
+
+# Ana Colo — Infrastructure Overview
+
+> **Last surveyed:** 2026-04-15
+
+## Environment Summary
+
+| Property | Value |
+|---|---|
+| Site | Ana colocation |
+| Firewall | FortiGate-80F (`ana-gw`), v7.2.10, NAT mode, standalone |
+| Network zones | 5 (internal, userland, servers, sfsrv, mgmt) |
+| Servers | ~10 (see [server map](ana-colo-network.md#server-map)) |
+| Primary Docker host | `ana-docker` (10.250.50.70) — ~20 containers |
+| VPN tunnels | 4 (2 WireGuard, 2 IPsec) |
+| Public IPs | 5 (38.120.12.41–46) |
+
+## Sub-Documents
+
+| Document | Description |
+|---|---|
+| [Network Topology](ana-colo-network.md) | FortiGate zones, server map, VPN tunnels, firewall policies |
+| [Port Map](ana-colo-port-map.md) | All public-to-internal port mappings and Traefik virtual hosts |
+| [Docker Services](ana-docker-services.md) | Full container inventory on ana-docker with configs and issues |
+| [Security Issues](ana-colo-security-issues.md) | All security and quality findings from the survey |
+| [Conventions](ana-colo-conventions.md) | Established conventions and planned changes |
+
+## Quick Reference
+
+- **Public IPs:** 38.120.12.41 (gateway) · 38.120.12.42 (WireGuard/Kokoro) · 38.120.12.44 (Docker/Traefik/NAS) · 38.120.12.45 (Webhost) · 38.120.12.46 (TacticalRMM)
+- **Primary service host:** `ana-docker` — 10.250.50.70 (via .44)
+- **File server:** `ana-nas` — 10.250.50.50 (NFS, WebDAV)
+- **Reverse proxy:** Traefik on ana-docker, wildcard DNS `*.phasefinal.com` → 38.120.12.44
\ No newline at end of file