diff --git a/scripts/apply_h21_authentik.py b/scripts/apply_h21_authentik.py
new file mode 100644
index 0000000..d425763
--- /dev/null
+++ b/scripts/apply_h21_authentik.py
@@ -0,0 +1,143 @@
+import paramiko
+
+c = paramiko.SSHClient()
+c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+c.connect("140.44.4.71", username="root", key_filename=r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet', timeout=10)
+
+adv_config = """# Buffer tuning for Authentik headers
+proxy_buffers 8 16k;
+proxy_buffer_size 32k;
+
+# Outpost verification route - plain HTTP to internal VIP
+location /outpost.goauthentik.io {
+    auth_request off;
+    proxy_pass              http://140.44.4.29:9000/outpost.goauthentik.io;
+    proxy_set_header        Host authentik.snarfnet.net;
+    proxy_set_header        X-Original-URL $scheme://$http_host$request_uri;
+    add_header              Set-Cookie $auth_cookie;
+    auth_request_set        $auth_cookie $upstream_http_set_cookie;
+    proxy_pass_request_body off;
+    proxy_set_header        Content-Length "";
+}
+
+# Redirect to Authentik when unauthenticated
+location @goauthentik_proxy_signin {
+    internal;
+    auth_request off;
+    add_header Set-Cookie $auth_cookie;
+    return 302 https://authentik.snarfnet.net/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
+}
+
+# Protected Topology HTML (Interactive)
+location = /topology.html {
+    auth_request /outpost.goauthentik.io/auth/nginx;
+    error_page 401 = @goauthentik_proxy_signin;
+    auth_request_set $auth_cookie $upstream_http_set_cookie;
+    add_header Set-Cookie $auth_cookie;
+
+    alias /data/topology/snarfnet_homelab_topology.html;
+    default_type text/html;
+}
+
+# Protected Topology PNG (High-Res Image)
+location = /topology.png {
+    auth_request /outpost.goauthentik.io/auth/nginx;
+    error_page 401 = @goauthentik_proxy_signin;
+    auth_request_set $auth_cookie $upstream_http_set_cookie;
+    add_header Set-Cookie $auth_cookie;
+
+    alias /data/topology/snarfnet_homelab_topology.png;
+    default_type image/png;
+}
+
+location = /snarfnet_homelab_topology.html {
+    auth_request /outpost.goauthentik.io/auth/nginx;
+    error_page 401 = @goauthentik_proxy_signin;
+    auth_request_set $auth_cookie $upstream_http_set_cookie;
+    add_header Set-Cookie $auth_cookie;
+
+    alias /data/topology/snarfnet_homelab_topology.html;
+    default_type text/html;
+}
+
+location = /snarfnet_homelab_topology.png {
+    auth_request /outpost.goauthentik.io/auth/nginx;
+    error_page 401 = @goauthentik_proxy_signin;
+    auth_request_set $auth_cookie $upstream_http_set_cookie;
+    add_header Set-Cookie $auth_cookie;
+
+    alias /data/topology/snarfnet_homelab_topology.png;
+    default_type image/png;
+}
+"""
+
+# Upload adv_config to a file on remote
+stdin, stdout, stderr = c.exec_command("cat > /tmp/adv_config_h21.txt")
+stdin.write(adv_config)
+stdin.close()
+stdout.read()
+
+remote_script = """import sqlite3, shutil, os
+
+db_path = '/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite'
+conf_path = '/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/21.conf'
+
+with open('/tmp/adv_config_h21.txt', 'r') as f:
+    adv = f.read()
+
+# 1. Backup
+shutil.copy(db_path, db_path + '.bak_authentik')
+shutil.copy(conf_path, conf_path + '.bak_authentik')
+
+# 2. Update DB
+conn = sqlite3.connect(db_path)
+cur = conn.cursor()
+cur.execute("UPDATE proxy_host SET advanced_config = ? WHERE id = 21", (adv,))
+conn.commit()
+conn.close()
+print("Updated database for host 21.")
+
+# 3. Read conf, replace or insert adv
+with open(conf_path, 'r') as f:
+    conf = f.read()
+
+if '# Buffer tuning for Authentik headers' not in conf:
+    idx = conf.find('location / {')
+    if idx != -1:
+        new_conf = conf[:idx] + adv + "\\n\\n  " + conf[idx:]
+    else:
+        new_conf = conf.rstrip().rstrip('}') + "\\n\\n" + adv + "\\n}\\n"
+    with open(conf_path, 'w') as f:
+        f.write(new_conf)
+    print("Updated 21.conf.")
+else:
+    print("21.conf already has Authentik configuration.")
+"""
+
+stdin, stdout, stderr = c.exec_command("cat > /tmp/apply_h21.py")
+stdin.write(remote_script)
+stdin.close()
+stdout.read()
+
+stdin, stdout, stderr = c.exec_command("python3 /tmp/apply_h21.py")
+print("Remote python stdout:", stdout.read().decode())
+print("Remote python stderr:", stderr.read().decode())
+
+# Test nginx config inside container
+stdin, stdout, stderr = c.exec_command("docker exec $(docker ps -q --filter 'name=nginx-proxy-manager_app') nginx -t")
+out = stdout.read().decode()
+err = stderr.read().decode()
+print("nginx -t stdout:", out)
+print("nginx -t stderr:", err)
+
+if "successful" in out or "successful" in err:
+    print("Nginx syntax OK! Reloading nginx...")
+    stdin, stdout, stderr = c.exec_command("docker exec $(docker ps -q --filter 'name=nginx-proxy-manager_app') nginx -s reload")
+    print("Reload stdout:", stdout.read().decode())
+    print("Reload stderr:", stderr.read().decode())
+else:
+    print("FAILED nginx -t test! Restoring backups...")
+    c.exec_command("cp /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/21.conf.bak_authentik /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/21.conf")
+    c.exec_command("cp /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite.bak_authentik /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite")
+
+c.close()
diff --git a/scripts/cat_21_conf.py b/scripts/cat_21_conf.py
new file mode 100644
index 0000000..6333b07
--- /dev/null
+++ b/scripts/cat_21_conf.py
@@ -0,0 +1,9 @@
+import paramiko
+
+c = paramiko.SSHClient()
+c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+c.connect('140.44.4.71', username='root', key_filename=r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet', timeout=10)
+cmd = "docker exec $(docker ps -q --filter name=nginx-proxy-manager_app) cat /data/nginx/proxy_host/21.conf"
+_, o, _ = c.exec_command(cmd)
+print(o.read().decode())
+c.close()
diff --git a/scripts/check_homepage_html.py b/scripts/check_homepage_html.py
new file mode 100644
index 0000000..c4f7793
--- /dev/null
+++ b/scripts/check_homepage_html.py
@@ -0,0 +1,15 @@
+import urllib.request, ssl, re
+
+ctx = ssl.create_default_context()
+ctx.check_hostname = False
+ctx.verify_mode = ssl.CERT_NONE
+
+req = urllib.request.Request('https://homepage.snarfnet.net/', headers={'User-Agent': 'Mozilla/5.0'})
+resp = urllib.request.urlopen(req, context=ctx)
+html = resp.read().decode('utf-8')
+
+for pat in [r'href="([^"]+)"', r'src="([^"]+)"']:
+    matches = re.findall(pat, html)
+    for m in matches:
+        if any(k in m for k in ['argo', 'tempest', 'weather', 'icon', 'png', 'svg']):
+            print(m)
diff --git a/scripts/check_npm_db.py b/scripts/check_npm_db.py
index 023eb2e..d7cc328 100644
--- a/scripts/check_npm_db.py
+++ b/scripts/check_npm_db.py
@@ -2,14 +2,14 @@ import paramiko
 
 ssh = paramiko.SSHClient()
 ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
-ssh.connect('140.44.4.71', username='snarf', key_filename=r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet', timeout=10)
+ssh.connect('140.44.4.71', username='root', key_filename=r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet', timeout=10)
 
-cmd = "sudo docker exec $(sudo docker ps -q --filter 'name=nginx-proxy-manager_app') sh -c \"python3 -c \\\"import sqlite3; con = sqlite3.connect('/data/database.sqlite'); cur = con.cursor(); print('\\n'.join(str(r) for r in cur.execute('SELECT id, domain_names, forward_host, forward_port, forward_scheme, enabled FROM proxy_host WHERE is_deleted=0')))\\\"\""
-stdin, stdout, stderr = ssh.exec_command(cmd)
+stdin, stdout, stderr = ssh.exec_command("docker exec $(docker ps -q --filter 'name=nginx-proxy-manager_app') cat /app/templates/proxy_host.conf")
+print("--- TEMPLATE ---")
+print(stdout.read().decode())
+
+stdin, stdout, stderr = ssh.exec_command("cat /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/21.conf")
+print("--- 21.CONF ---")
 print(stdout.read().decode())
-err = stderr.read().decode()
-if err:
-    print("ERR:", err)
 
 ssh.close()
-
diff --git a/scripts/copy_topology_to_npm.py b/scripts/copy_topology_to_npm.py
new file mode 100644
index 0000000..917bf35
--- /dev/null
+++ b/scripts/copy_topology_to_npm.py
@@ -0,0 +1,35 @@
+import paramiko
+
+c = paramiko.SSHClient()
+c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+c.connect("140.44.4.71", username="root", key_filename=r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet', timeout=10)
+
+# Create /data/topology directory on host
+c.exec_command("mkdir -p /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/topology")
+
+# Read topology files locally
+with open('docs/snarfnet_homelab_topology.html', 'r', encoding='utf-8') as f:
+    html_data = f.read()
+
+with open('docs/snarfnet_homelab_topology.png', 'rb') as f:
+    png_data = f.read()
+
+# Send html
+stdin, stdout, stderr = c.exec_command("cat > /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/topology/snarfnet_homelab_topology.html")
+stdin.write(html_data)
+stdin.close()
+stdout.read()
+
+# Send png
+stdin, stdout, stderr = c.exec_command("cat > /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/topology/snarfnet_homelab_topology.png")
+stdin.write(png_data)
+stdin.close()
+stdout.read()
+
+# Verify files inside NPM container
+cmd = "docker exec $(docker ps -q --filter name=nginx-proxy-manager_app) ls -la /data/topology"
+_, o, e = c.exec_command(cmd)
+print("Files inside NPM container at /data/topology:\n" + o.read().decode())
+print("Stderr:\n" + e.read().decode())
+
+c.close()
diff --git a/scripts/inspect_host21.py b/scripts/inspect_host21.py
new file mode 100644
index 0000000..bf2bbd7
--- /dev/null
+++ b/scripts/inspect_host21.py
@@ -0,0 +1,28 @@
+import paramiko
+
+c = paramiko.SSHClient()
+c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+c.connect("140.44.4.71", username="root", key_filename=r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet', timeout=10)
+
+py_script = """import sqlite3
+
+conn = sqlite3.connect('/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite')
+cur = conn.cursor()
+cur.execute('SELECT id, domain_names, forward_host, forward_port, advanced_config FROM proxy_host WHERE id = 21')
+r = cur.fetchone()
+print('Host 21:', r[1], '->', r[2], r[3])
+print('Advanced config length:', len(r[4]) if r[4] else 0)
+if r[4]:
+    print(r[4])
+conn.close()
+"""
+
+stdin, stdout, stderr = c.exec_command("cat > /tmp/check_h21.py")
+stdin.write(py_script)
+stdin.close()
+stdout.read()
+
+stdin, stdout, stderr = c.exec_command("python3 /tmp/check_h21.py")
+print(stdout.read().decode())
+print(stderr.read().decode())
+c.close()
diff --git a/scripts/inspect_npm_container.py b/scripts/inspect_npm_container.py
new file mode 100644
index 0000000..14d7d75
--- /dev/null
+++ b/scripts/inspect_npm_container.py
@@ -0,0 +1,14 @@
+import paramiko
+
+c = paramiko.SSHClient()
+c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+c.connect('140.44.4.71', username='root', key_filename=r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet', timeout=10)
+
+_, o, _ = c.exec_command('docker ps --filter name=nginx')
+print("Docker ps:\n" + o.read().decode())
+
+cmd = "docker inspect $(docker ps -q --filter name=nginx-proxy-manager_app) --format '{{json .Mounts}}'"
+_, o, _ = c.exec_command(cmd)
+print("Mounts:\n" + o.read().decode())
+
+c.close()
diff --git a/scripts/test_npm_exec.py b/scripts/test_npm_exec.py
new file mode 100644
index 0000000..8cce269
--- /dev/null
+++ b/scripts/test_npm_exec.py
@@ -0,0 +1,11 @@
+import paramiko
+
+ssh = paramiko.SSHClient()
+ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+ssh.connect('140.44.4.71', username='root', key_filename=r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet', timeout=10)
+
+cmd = "docker exec $(docker ps -q --filter 'name=nginx-proxy-manager_app') ls -la /data/topology"
+stdin, stdout, stderr = ssh.exec_command(cmd)
+print("ls /data/topology:", stdout.read().decode())
+
+ssh.close()