Document edge routing updates and align Nextcloud proxy target

Co-Authored-By: Oz <oz-agent@warp.dev>

docs/cloudflare-networking.md

@@ -18,6 +18,18 @@ Create forwards to this server's LAN IP:
 - TCP 80 -> `<server_lan_ip>:80` (ACME challenge + redirect)
 - TCP 443 -> `<server_lan_ip>:443` (HTTPS via Caddy)
 - TCP 2222 -> `<server_lan_ip>:2222` (Git SSH)
+
+## Shared edge ports currently in use (verified 2026-04-19)
+On this homelab WAN edge, additional TCP ports are currently reachable for other `*.bhatfamily.in` services:
+- `3000` (Gemma Open WebUI direct)
+- `8000` (vLLM API direct)
+- `8082` (Nextcloud HTTP direct)
+- `8445` (OpenVPN-AS admin/direct)
+- `8447` (Nextcloud HTTPS direct)
+- `943` (OpenVPN-AS client web/direct)
+
+If you want `git.bhatfamily.in` to be the only internet-exposed service on this host, close the extra forwards/firewall allows above.
+
 ## Firewall alignment
 If UFW is active, use install flag to open public web ports:
 - `./scripts/install.sh --with-tls --open-public-web`