diff --git a/hashicorp-stack.md b/hashicorp-stack.md
index bbac864..b1c412e 100644
--- a/hashicorp-stack.md
+++ b/hashicorp-stack.md
@@ -1,106 +1,154 @@
-# HashiCorp Stack - hf-pdocker-01
+# HashiCorp Stack - hobbs.farm
 
 ## Overview
 
-Production HashiCorp stack deployed on `hf-pdocker-01` (192.168.86.192) providing orchestration, service discovery, and secrets management.
+Production HashiCorp stack providing container orchestration, service discovery, and secrets management across the hobbs.farm infrastructure.
 
-## Components
-
-| Service | Version | Port | UI URL |
-|---------|---------|------|--------|
-| Consul | 1.17.1 | 8500 | http://192.168.86.192:8500 |
-| Nomad | 1.7.3 | 4646 | http://192.168.86.192:4646 |
-| Vault | 1.15.4 | 8200 | http://192.168.86.192:8200 |
-
-## Architecture
+## Cluster Architecture
 
 ```
-┌─────────────────────────────────────────────────────────┐
-│              hf-pdocker-01 (192.168.86.192)             │
-├─────────────────────────────────────────────────────────┤
-│  Consul Server  →  Service Discovery, KV Store          │
-│  Nomad Server   →  Workload Orchestration               │
-│  Nomad Client   →  Runs containers                      │
-│  Vault Server   →  Secrets Management (Consul backend)  │
-└─────────────────────────────────────────────────────────┘
+┌─────────────────────────────────────────────────────────────────────┐
+│                        hobbs.farm Cluster                           │
+├────────────────────────────────┬────────────────────────────────────┤
+│     hf-pdocker-01              │     hf-pdocker-02                  │
+│     192.168.86.192             │     192.168.86.45                  │
+│     (Primary)                  │     (Legacy)                       │
+├────────────────────────────────┼────────────────────────────────────┤
+│  Consul Server (Leader)        │  Consul Client                     │
+│  Nomad Server                  │  Nomad Client                      │
+│  Nomad Client                  │  node_class: legacy                │
+│  Vault Server                  │  meta: disk_status=failing         │
+└────────────────────────────────┴────────────────────────────────────┘
 ```
 
-## Nomad Host Volumes
+## Services
 
-| Volume Name | Path | Purpose |
-|-------------|------|---------|
-| media | /data/media | Shared media files (movies, tv, downloads) |
+| Service | Version | Port | Primary URL | Notes |
+|---------|---------|------|-------------|-------|
+| Consul | 1.17.1 | 8500 | http://192.168.86.192:8500 | Service discovery, KV store |
+| Nomad | 1.7.3 | 4646 | http://192.168.86.192:4646 | Container orchestration |
+| Vault | 1.15.4 | 8200 | http://192.168.86.192:8200 | Secrets management |
+
+## Deployed Jobs
+
+### media-stack (service)
+| Service | Port | Health | URL |
+|---------|------|--------|-----|
+| Jellyfin | 8096 | ✅ | http://192.168.86.192:8096 |
+| Sonarr | 8989 | ✅ | http://192.168.86.192:8989 |
+| Radarr | 7878 | ✅ | http://192.168.86.192:7878 |
+| SABnzbd | 8082 | ✅ | http://192.168.86.192:8082 |
+| NZBHydra2 | 5076 | ✅ | http://192.168.86.192:5076 |
+| Jellyseerr | 5055 | ✅ | http://192.168.86.192:5055 |
+
+### traefik (system)
+| Service | Port | Health | URL |
+|---------|------|--------|-----|
+| HTTP | 80 | ✅ | Redirects to HTTPS |
+| HTTPS | 443 | ✅ | Reverse proxy |
+| Dashboard | 8088 | ✅ | http://192.168.86.192:8088 |
+
+## Host Volumes (hf-pdocker-01)
+
+| Volume | Path | Purpose |
+|--------|------|---------|
+| media | /data/media | Movies, TV, downloads |
 | jellyfin-config | /data/configs/jellyfin | Jellyfin configuration |
 | sonarr-config | /data/configs/sonarr | Sonarr configuration |
 | radarr-config | /data/configs/radarr | Radarr configuration |
 | sabnzbd-config | /data/configs/sabnzbd | SABnzbd configuration |
 | nzbhydra-config | /data/configs/nzbhydra | NZBHydra2 configuration |
 | jellyseerr-config | /data/configs/jellyseerr | Jellyseerr configuration |
+| traefik-data | /data/traefik | Traefik certs & config |
 
-## Vault Secrets Structure
+## Vault Secrets
 
 ```
 secret/
-└── media/
-    ├── jellyfin
-    ├── sonarr
-    ├── radarr
-    ├── sabnzbd
-    ├── nzbhydra
-    └── jellyseerr
-```
-
-## Deployed Jobs
-
-### media-stack
-Combined job running all media services:
-- Jellyfin (8096) - Media streaming
-- Sonarr (8989) - TV show management
-- Radarr (7878) - Movie management
-- SABnzbd (8082) - Usenet downloader
-- NZBHydra2 (5076) - Indexer aggregator
-- Jellyseerr (5055) - Media requests
-
-## Commands
-
-```bash
-# Cluster status
-consul members
-nomad server members
-nomad node status
-vault status
-
-# Job management
-nomad job run <job.hcl>
-nomad job status <job>
-nomad job stop <job>
-
-# View logs
-nomad alloc logs <alloc-id>
-
-# Vault secrets
-export VAULT_ADDR='http://127.0.0.1:8200'
-vault kv list secret/media/
-vault kv get secret/media/<service>
+├── media/
+│   ├── jellyfin
+│   ├── sonarr
+│   ├── radarr
+│   ├── sabnzbd
+│   ├── nzbhydra
+│   └── jellyseerr
+└── traefik/
+    └── cloudflare (email, api_token)
 ```
 
 ## Configuration Files
 
+### hf-pdocker-01 (Server)
 | Service | Config Path |
 |---------|-------------|
 | Consul | /etc/consul.d/consul.hcl |
 | Nomad | /etc/nomad.d/nomad.hcl, client.hcl |
 | Vault | /etc/vault.d/vault.hcl |
 
-## Systemd Services
+### hf-pdocker-02 (Client)
+| Service | Config Path |
+|---------|-------------|
+| Consul | /etc/consul.d/consul.hcl |
+| Nomad | /etc/nomad.d/nomad.hcl, client.hcl |
 
+## Operations
+
+### Check Cluster Health
 ```bash
-systemctl status consul nomad vault
-systemctl restart consul nomad vault
-journalctl -u nomad -f
+# Consul cluster
+consul members
+
+# Nomad cluster
+nomad server members
+nomad node status
+
+# Vault status
+vault status
 ```
 
+### Job Management
+```bash
+# Deploy job
+nomad job run <job.hcl>
+
+# Check job status
+nomad job status <job-name>
+
+# View allocations
+nomad job allocs <job-name>
+
+# View logs
+nomad alloc logs <alloc-id> <task-name>
+
+# Stop job
+nomad job stop <job-name>
+```
+
+### Service Restarts
+```bash
+# On hf-pdocker-01
+systemctl restart consul nomad vault
+
+# On hf-pdocker-02
+systemctl restart consul nomad
+```
+
+## IaC Repository
+
+All job specifications are stored in Gitea:
+- **Repo:** `jeremy/ansible-homelab`
+- **Path:** `nomad-jobs/`
+  - `media-stack.nomad.hcl`
+  - `traefik.nomad.hcl`
+
+## Security Notes
+
+- Vault root token stored in `/tmp/vault-init.json` on hf-pdocker-01 (move to secure location)
+- Consul encryption enabled with shared key
+- mTLS not configured (internal network only)
+- Cloudflare API token in Vault for Let's Encrypt DNS challenge
+
 ---
 
-*Deployed: 2026-02-04*
+*Last Updated: 2026-02-04*
 *Maintained by: Pluto 🪐*