diff --git a/docs/orientation.md b/docs/orientation.md
index 66dd5cf..bfc1fa3 100644
--- a/docs/orientation.md
+++ b/docs/orientation.md
@@ -164,6 +164,25 @@ These caught us once; don't let them catch you twice.
 - **irv-ml1 was `ana-ml1`** before a physical move; OS hostname still
   says `ana-ml1` pending an explicit rename. Doesn't affect services.
 
+### Git / gitea
+
+- **Colo/fleet hosts must reach gitea over the INTERNAL route, not the
+  public IP.** `gitea.phasefinal.com` resolves to the **public** IP
+  `38.120.12.44` (ana-srv1); gitea itself is a container on **ana-docker**
+  with git-SSH at **`10.250.50.70:222`** (`222→22`) and HTTP at `:3000`.
+  A fleet host that egresses to the public `:22` gets its egress IP
+  **fail2ban-banned** after any retrying git/deploy loop, which silently
+  wedges automation — e.g. a gitea-webhook auto-deploy whose `git fetch`
+  then times out under `set -euo pipefail` and never reaches the `reset`.
+  Point each host's gitea ssh alias at `HostName 10.250.50.70` /
+  `Port 222` with the repo deploy key; the internal route is ban-immune
+  and treats the cause. Bit irv-ml1's arbo deploy on 2026-06-13 (the
+  `gitea-arbo` alias pointed at the public host → fetch timeout → the
+  v0.11.7 frontend wouldn't serve until the alias was repointed internal).
+- **`:22` on `10.250.50.70` is ana-docker's HOST sshd, not gitea.** A
+  gitea deploy key there returns `Permission denied (publickey)` — gitea's
+  git-SSH is the container port `:222`. (HTTP/clone-over-HTTPS is `:3000`.)
+
 ### Workflow
 
 - **Terminal word-wrap breaks long pasted commands.** Never embed a