diff --git a/infrastructure/ana-colo-port-map.md b/infrastructure/ana-colo-port-map.md
new file mode 100644
index 0000000..16d830f
--- /dev/null
+++ b/infrastructure/ana-colo-port-map.md
@@ -0,0 +1,101 @@
+---
+created: '2026-04-16T00:45:31+00:00'
+id: 7cf418e8-d700-43dc-a870-78c333a08e58
+keywords:
+- traefik
+- port-forward
+- phasefinal.com
+- VIP
+- virtual-host
+- synapse
+- element
+- gitea
+- seafile
+- vaultwarden
+- mattermost
+- mailrise
+links: []
+modified: '2026-04-16T00:45:31+00:00'
+summary: Complete public-to-internal port map for all ana-colo services, including
+  Traefik virtual host routes and direct port forwards.
+tags:
+- infrastructure
+- ana-colo
+- network
+- ports
+- traefik
+- docker
+title: Ana Colo — Public Port Map
+---
+
+# Ana Colo — Public Port Map
+
+> **Last surveyed:** 2026-04-15
+
+## Via 38.120.12.44 → ana-docker (10.250.50.70)
+
+| Public Port | Internal Port | Service | Notes |
+|---|---|---|---|
+| :80 | :80 | Traefik HTTP | Routes all HTTP vhosts |
+| :443 | :443 | Traefik HTTPS | Routes all HTTPS vhosts with TLS |
+| :8025 | :8025 | Mailrise | Apprise notification relay |
+| :8443 | :8443 | Mattermost calls | UDP/WebRTC |
+| (service) | (multi) | RustDesk | hbbs + hbbr on host network |
+
+## Via 38.120.12.44 → ana-nas (10.250.50.50)
+
+| Public Port | Internal Port | Service | Notes |
+|---|---|---|---|
+| :8444 | :8444 | WebDAV (NAS) | Raw TCP — see security issue #5 |
+
+## Via 38.120.12.45 → ana-webhost (10.250.50.52)
+
+| Public Port | Internal Port | Service | Notes |
+|---|---|---|---|
+| :80 | :80 | Webhost HTTP | |
+| :443 | :443 | Webhost HTTPS | |
+| (mapped) | :22 | Webhost SSH | Via ssh-mapped-2223 service |
+
+## Via 38.120.12.46 → ana-tacticalrmm (10.250.50.57)
+
+| Public Port | Internal Port | Service |
+|---|---|---|
+| :443 | :443 | TacticalRMM HTTPS |
+
+## Via 38.120.12.42 → various
+
+| Public Port | Target | Service |
+|---|---|---|
+| :8880 | 10.250.50.51:8880 | Kokoro TTS |
+| :31337 | 10.250.50.252:31337 | WireGuard |
+
+## Traefik Virtual Host Routes
+
+All routes via `*.phasefinal.com` → 38.120.12.44 (Traefik on ana-docker).
+
+| Hostname | Service | Internal Port | Notes |
+|---|---|---|---|
+| `matrix.phasefinal.com` | Synapse | :8008 | HTTP + WebSocket |
+| `chat.phasefinal.com` | Element Web | :80 | HTTP |
+| `gitea.phasefinal.com` | Gitea | :3000 | HTTP |
+| `seafile.phasefinal.com` | Seafile | :80 | HTTP |
+| `vaultwarden.phasefinal.com` | Vaultwarden | :80 | HTTP + WebSocket |
+| `mm.phasefinal.com` | Mattermost | :8065 | HTTP + WebSocket |
+| `*.phasefinal.com` | Traefik (catch-all) | — | Default route |
+
+## Direct-Port Services (not Traefik-routed)
+
+These services are exposed on direct ports rather than through the Traefik reverse proxy:
+
+| Service | Port | Host | Notes |
+|---|---|---|---|
+| SillyTavern | :8100 | ana-docker | Direct |
+| Open WebUI | :3100 | ana-docker | Direct |
+| Dockge | :5001 | ana-docker | Direct |
+| Portainer | :9000, :9001 | ana-docker | Direct — legacy, consider removal |
+| IT Tools | :8780 | ana-docker | Direct |
+| Mailrise | :8025 | ana-docker | Direct |
+| Traefik Dashboard | :8380 | ana-docker | Direct — unprotected, see security issue #12 |
+| RustDesk | Multi (host net) | ana-docker | Host network mode |
+
+See [Security Issues](ana-colo-security-issues.md) for related findings.
\ No newline at end of file