diff --git a/infrastructure/networking/NETWORK_ARCHITECTURE.md b/infrastructure/networking/NETWORK_ARCHITECTURE.md
index 43c3b2e..8d45470 100644
--- a/infrastructure/networking/NETWORK_ARCHITECTURE.md
+++ b/infrastructure/networking/NETWORK_ARCHITECTURE.md
@@ -1,6 +1,6 @@
 # BasicStack k3s Cluster Network Architecture
 
-**Last Updated:** 2026-07-06  
+**Last Updated:** 2026-08-02  
 **Cluster Version:** k3s v1.36.2+k3s1
 
 ## Overview
@@ -15,9 +15,16 @@ This document provides comprehensive documentation of the network configuration
                             ┌──────────┴──────────┐
                             │  DNS (basicstack.de) │
                             │  *.basicstack.de     │
+                            │  → 138.199.128.63    │
                             └──────────┬──────────┘
                                        |
                      ┌─────────────────┴─────────────────┐
+                     │   Hetzner Load Balancer           │
+                     │   IP: 138.199.128.63              │
+                     │   Targets: k3s-cp-1 + workers 1-5 │
+                     └─────────────────┬─────────────────┘
+                                       |
+                     ┌─────────────────┴─────────────────┐
                      │   Hetzner Cloud (fw-k3s)          │
                      │   Firewall: Port 80, 443, 25,     │
                      │             587, 465, 143, 993     │
@@ -261,23 +268,26 @@ Ports:
 #### Required DNS Records
 
 **A Records (HTTP/HTTPS Services):**
-All HTTPS services point to LoadBalancer IPs. Since we use multiple LoadBalancer IPs, DNS should point to the most stable/accessible IPs:
+All services point to the Hetzner Load Balancer IP address.
 
-- Recommended: Point to worker node private IPs (10.42.1.2, 10.42.1.3, 10.42.1.5) OR
-- Alternative: Point to control-plane public IP (178.105.17.239)
+**Current Configuration:**
+All domains and subdomains point to: **138.199.128.63** (Hetzner Load Balancer)
 
 **Wildcard Option:**
 ```
-*.basicstack.de → 178.105.17.239 (or round-robin to worker IPs)
+*.basicstack.de → 138.199.128.63
 ```
 
 **Specific Records:**
 ```
-basicstack.org → 178.105.17.239
-www.basicstack.org → 178.105.17.239
-paperclip.basicstack.de → 178.105.17.239
-mail.basicstack.de → 178.105.17.239
-auth.basicstack.de → 178.105.17.239
+basicstack.org → 138.199.128.63
+www.basicstack.org → 138.199.128.63
+paperclip.basicstack.de → 138.199.128.63
+mail.basicstack.de → 138.199.128.63
+auth.basicstack.de → 138.199.128.63
+forgejo.basicstack.de → 138.199.128.63
+directus.basicstack.de → 138.199.128.63
+books.basicstack.de → 138.199.128.63
 (etc. for all services)
 ```
 
@@ -424,9 +434,12 @@ Database and cache services (PostgreSQL, Redis) have restrictive policies that o
 ### Ingress Traffic (HTTP/HTTPS)
 
 ```
-Internet → DNS → Hetzner Firewall (fw-k3s)
-    → LoadBalancer IP (any worker node)
-    → Traefik Ingress Controller (Pod on control-plane)
+Internet → DNS (→ 138.199.128.63)
+    → Hetzner Load Balancer
+    → k3s Node (k3s-cp-1 or k3s-worker-1 through k3s-worker-5)
+    → Hetzner Firewall (fw-k3s)
+    → NodePort (auto-assigned by k3s ServiceLB)
+    → Traefik Ingress Controller
     → Backend Service (ClusterIP)
     → Application Pods
 ```