docs: update infrastructure state and roadmap

docs/domains.md

@@ -6,6 +6,12 @@ This document contains the public domains used by SilverLinux and the services t
 
 All public services are routed through Nginx Proxy Manager.
 
+Verified proxy-host snapshot:
+
+```text
+2026-06-24
+```
+
 ---
 
 ## Primary Domain
@@ -22,7 +28,58 @@ Used for:
 
 ---
 
-## Active Domains
+## Nginx Proxy Manager Hosts
+
+| ID | Domain | Forward target | SSL Force | HTTP/2 | HSTS | WebSocket | Access List | Status |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| 1 | `portainer.silveressence.net` | `http://portainer:9000` | enabled | enabled | enabled | enabled | none | enabled |
+| 2 | `git.silveressence.net` | `http://gitea:3000` | disabled | disabled | disabled | enabled | none | enabled |
+| 3 | `meet.silveressence.net` | `http://jitsi-docker-jitsi-meet-aa76415-web-1:80` | disabled | disabled | disabled | enabled | none | enabled |
+| 5 | `team.silveressence.net` | `http://openproject:80` | enabled | enabled | disabled | enabled | none | enabled |
+| 6 | `nuget.silveressence.net` | `http://baget:80` | disabled | disabled | disabled | disabled | none | enabled |
+| 8 | `dbgate.silveressence.net` | `http://dbgate:3000` | disabled | disabled | disabled | enabled | none | enabled |
+
+All listed active inventory hosts have Block Exploits enabled.
+
+---
+
+## Additional Active Proxy Hosts
+
+These proxy hosts were present and enabled in Nginx Proxy Manager during the 2026-06-24 snapshot, but are not part of the current core infrastructure service inventory.
+
+| ID | Domain | Forward target | Reason |
+| --- | --- | --- | --- |
+| 7 | `cicd.silveressence.net` | `http://bobsAutowas:8080` | Active prototype deployment and test endpoint; may change frequently |
+| 9 | `exactsyncer.silveressence.net` | `http://exact-syncer:8080` | Active client-facing demo for the Exact Online syncer application |
+
+Action:
+
+* Keep `cicd.silveressence.net` documented as a fast-changing prototype endpoint.
+* Keep `exactsyncer.silveressence.net` documented as an intentional client-facing demo endpoint.
+* Document owner, authentication model and exposure policy for active non-core endpoints.
+
+Plane.so cleanup:
+
+* Plane.so containers were removed.
+* `plane.silveressence.net` was removed from Nginx Proxy Manager.
+* The unused Plane.so SSL certificate was removed from the server.
+
+---
+
+## Proxy Hardening Review
+
+Nginx Proxy Manager findings from the 2026-06-24 snapshot:
+
+* `portainer.silveressence.net` has SSL Force, HTTP/2 and HSTS enabled.
+* `team.silveressence.net` has SSL Force and HTTP/2 enabled.
+* `git.silveressence.net`, `meet.silveressence.net`, `nuget.silveressence.net` and `dbgate.silveressence.net` do not have SSL Force enabled.
+* No listed proxy host uses an Nginx Proxy Manager access list.
+* DbGate is a high-sensitivity database administration interface and should be prioritized for SSL Force and an access restriction policy.
+* Plane.so has been removed from containers, Nginx Proxy Manager and server certificate storage.
+
+---
+
+## Domain Details
 
 ### Gitea
 
@@ -87,7 +144,7 @@ Purpose:
 Container Stack:
 
 ```text
-jitsi
+jitsi-docker-jitsi-meet-aa76415-web-1
 ```
 
 ---
@@ -243,4 +300,5 @@ portainer
 
 * docs/server.md
 * docs/security.md
+* docs/network.md
 * nginx-proxy-manager/README.md