diff --git a/log.md b/log.md
index 07224f7..f970c52 100644
--- a/log.md
+++ b/log.md
@@ -27,7 +27,7 @@
 - Velero backups PartiallyFailed for 121 days — all PVCs skipped
 - Fix 1: Created VolumeSnapshotClass `ceph-rbd-snapclass` (rbd.csi.ceph.com)
 - Fix 2: Migrated ArgoCD repoURLs from dead Gitea (10.0.30.105) to new (ssh://git@10.0.30.202:22)
-  - Gitea SSH user is `git` not `gitea`; git.schoen.codes → Traefik (10.0.30.203), SSH on 10.0.30.202
+  - Gitea SSH user is `git` not `gitea`; git.schoen.codes → Traefik (10.0.30.208), SSH on 10.0.30.202
   - New SSH deploy key generated, added to Gitea repo
 - Fix 3: `features: EnableCSI` must be under `configuration:` in Velero Helm values (not top-level)
   - Must be string, not array — array form breaks Helm template
diff --git a/reference/ip-map.md b/reference/ip-map.md
index c8dc3ed..98491f7 100644
--- a/reference/ip-map.md
+++ b/reference/ip-map.md
@@ -55,14 +55,23 @@ modified: "2026-07-24"
 | 10.0.30.141 | CT141 | Monitoring (Prometheus/Grafana) |
 | 10.0.30.145 | CT145 | Voice Pipeline (PJSIP :5060) |
 
-## K8s LoadBalancers (10.0.30.2xx)
-| IP | Service | Namespace |
-|----|---------|-----------|
-| 10.0.30.201 | Hindsight API :9177 | hindsight |
-| 10.0.30.204 | InfluxDB :8086 | influxdb |
-| 10.0.30.205 | Grafana | monitoring |
-| 10.0.30.206 | Prometheus :9090 | monitoring |
-| 10.0.30.207 | Loki :3100 | logging |
+## K8s LoadBalancers (10.0.30.2xx) — Cilium LB IPAM, all pinned
+| IP | Service | Namespace | Port |
+|----|---------|-----------|------|
+| 10.0.30.200 | Gitea SSH | gitea | 22 |
+| 10.0.30.201 | Grafana | monitoring | 3000 |
+| 10.0.30.202 | Prometheus | monitoring | 9090 |
+| 10.0.30.203 | Traefik (K8s Ingress) | kube-system | 80/443 |
+| 10.0.30.204 | InfluxDB | influxdb | 8086 |
+| 10.0.30.205 | PostgreSQL (CNPG rw LB) | postgres | 5432 |
+| 10.0.30.208 | Hindsight API | hindsight | 9177 |
+
+## External CTs (10.0.30.xxx)
+| IP | CT/VM | Service | Notes |
+|----|-------|---------|-------|
+| 10.0.30.99 | CT111 | Seafile v13.0.19 (Docker) | cloud.familie-schoen.com, routed via K8s Traefik IngressRoute |
+
+> All IPs pinned via `io.cilium/lb-ipam-ips` annotation. Pool: 10.0.30.200–250.
 
 ## DMZ / Reverse Proxies (10.0.60.x)
 | IP | Host | Service |
diff --git a/reference/ports.md b/reference/ports.md
index 7c88942..78efd83 100644
--- a/reference/ports.md
+++ b/reference/ports.md
@@ -23,7 +23,7 @@ modified: "2026-07-24"
 | 9090 | Prometheus | 10.0.30.206 | LB |
 | 9093 | Alertmanager | K8s internal | |
 | 9095 | HolmesGPT Adapter | K8s internal | Alertmgr → HolmesGPT |
-| 9177 | Hindsight API | 10.0.30.201 | LB, NOT localhost |
+| 9177 | Hindsight API | 10.0.30.208 | LB, NOT localhost |
 | 9221 | PVE Exporter | 10.0.30.141 | |
 | 9283 | Ceph Prometheus | 10.0.20.91 | active mgr |
 | 9345 | RKE2 Server URL | 10.0.30.50 | cp-01 |
diff --git a/systems/hindsight.md b/systems/hindsight.md
index 30cbc3e..21e17bf 100644
--- a/systems/hindsight.md
+++ b/systems/hindsight.md
@@ -10,8 +10,8 @@ modified: "2026-07-24"
 
 ## Deployment
 - **Namespace:** hindsight (K8s)
-- **API:** LoadBalancer `10.0.30.201:9177` (**NICHT localhost**)
-- **Health:** `curl -s http://10.0.30.201:9177/health`
+- **API:** LoadBalancer `10.0.30.208:9177` (**NICHT localhost**)
+- **Health:** `curl -s http://10.0.30.208:9177/health`
 - **Backend:** PostgreSQL + pgvector
 - **Config:** `~/.hermes/hindsight/config.json` (api_url gesetzt)
 
diff --git a/systems/rke2-kubernetes.md b/systems/rke2-kubernetes.md
index 98a098e..f874e9f 100644
--- a/systems/rke2-kubernetes.md
+++ b/systems/rke2-kubernetes.md
@@ -31,7 +31,7 @@ modified: "2026-07-24"
 ## GitOps
 - **ArgoCD**: SSH Deploy Keys (read-only) auf Gitea
 - 15 Applications via SSH (`ssh://git@10.0.30.202:22/dominik/iac-homelab.git`)
-- **Gitea SSH user is `git`, not `gitea`** — `git.schoen.codes` resolves to Traefik (10.0.30.203, HTTP only), SSH is on 10.0.30.202:22
+- **Gitea SSH user is `git`, not `gitea`** — `git.schoen.codes` resolves to Traefik (10.0.30.208, HTTP only), SSH is on 10.0.30.202:22
 - Workflow: IaC repo auschecken → ändern → commit+push → ArgoCD sync → verify → lokale Kopie löschen
 - Siehe [[concepts/gitops-workflow]]