diff --git a/docs/homelab_topology.md b/docs/homelab_topology.md
index 38f98e3..689a86c 100644
--- a/docs/homelab_topology.md
+++ b/docs/homelab_topology.md
@@ -107,7 +107,9 @@ All Kubernetes resources are hosted on the **Compute VLAN (VLAN 20 — `140.44.4
 
 External WAN traffic hitting `174.106.252.96` is forwarded to internal hosts as follows:
 
-1.  **Nginx Reverse Proxy:** Ports `80` & `443` forward to **`140.44.4.74`** (Legacy NPM/Pi-hole VM in Swarm).
+1.  **Nginx Reverse Proxy:** Ports `80` & `443` forward to **`140.44.4.74`** (`snshpd4lnxswm04` in Docker Swarm).
+    *   *Real Client IP Preservation:* NPM runs with `mode: host` (`PublishMode: host`) pinned to `snshpd4lnxswm04`. This eliminates Docker Swarm overlay ingress SNAT (which previously masked all clients as `10.0.0.6`), ensuring `X-Forwarded-For` and `X-Real-IP` preserve the true WAN or LAN client IP.
+    *   *Conditional Authentik MFA:* Authentik's `default-authentication-flow-authenticator-validate-stage` evaluates the real client IP. Connections from internal subnets (`14.4.4.0/24`, `14.44.4.0/24`, `140.44.4.0/24`, `14.10.10.0/24`) bypass MFA for frictionless homelab usage, while external WAN connections strictly enforce MFA.
 2.  **Dev Machine/Gaming:** Ports `8443`, `10823` & `27015-27050` forward to **`14.4.4.15`** (Desktop PC).
 3.  **Zabbix Trapper:** Ports `10051` & `10052` forward to **`140.44.4.51`** (Klipper ServiceLB on worker `sninfr0lnxwrk01` $\rightarrow$ routes to primary Zabbix server pod in `spaceport`).
 
@@ -129,7 +131,6 @@ This table records how subdomains on `*.snarfnet.net` route to internal IP addre
 | `pihole.snarfnet.net` | HTTP | `140.44.4.70` (Swarm VIP) | 8041 | Legacy Swarm Pi-hole 1 |
 | `pihole2.snarfnet.net` | HTTP | `140.44.4.70` (Swarm VIP) | 8042 | Legacy Swarm Pi-hole 2 |
 | `shipyard.snarfnet.net` | HTTPS | `140.44.4.71` (Swarm 01) | 9443 | Portainer Server Console |
-| `gaia.snarfnet.net` | HTTP | `140.44.4.72` (Swarm 02) | 80 | Gaia Web app / Stack |
 | `shipyardcontrol.snarfnet.net` | HTTPS | `140.44.4.7` (AI Node) | 443 | Turing Pi Management / Hardware Panel |
 | `ai.snarfnet.net` | HTTP | `140.44.4.8` (AI Web Node) | 8080 | Open WebUI Inference Interface |
 | `aerodrome.snarfnet.net` | HTTPS | `140.44.4.34` (K3s VIP) | 443 | Rancher Management Console |
diff --git a/scripts/customize_authentik_dashboard.py b/scripts/customize_authentik_dashboard.py
index fbc20ae..b97ca8a 100644
--- a/scripts/customize_authentik_dashboard.py
+++ b/scripts/customize_authentik_dashboard.py
@@ -340,15 +340,6 @@ APPLICATIONS = [
         "meta_launch_url": "https://homebox.snarfnet.net",
         "open_in_new_tab": True,
     },
-    {
-        "slug": "gaia",
-        "name": "Gaia Web App",
-        "group": "Portals & Dashboards",
-        "meta_icon": "https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/open-webui.png",
-        "meta_description": "Swarm Services & AI Stack Portal",
-        "meta_launch_url": "https://gaia.snarfnet.net",
-        "open_in_new_tab": True,
-    },
     {
         "slug": "dakboard",
         "name": "Dakboard Display",