diff --git a/docs/md/ansipa-setup.md b/docs/md/ansipa-setup.md
index 9f20f6b..d4ab2a0 100644
--- a/docs/md/ansipa-setup.md
+++ b/docs/md/ansipa-setup.md
@@ -97,6 +97,75 @@ docker compose logs -f freeipa      # watch first-boot (~10 min)
 
 ---
 
+## Firewall
+
+All ansipa traffic is **client-initiated**, so the client firewall needs almost
+nothing open inbound; the server firewall is where you open ports.
+
+### Server — inbound (open these)
+
+Minimum for identity + policy enforcement:
+
+| Port(s) | Proto | Why |
+|---------|-------|-----|
+| 389, 636 | TCP | LDAP / LDAPS — SSSD directory lookups |
+| 88, 464 | TCP+UDP | Kerberos KDC + kpasswd |
+| 443 | TCP | FreeIPA web UI + enrollment (also behind the gateway) |
+
+Add per feature you use:
+
+| Port(s) | Proto | Feature |
+|---------|-------|---------|
+| 137-138 | UDP | SMB (policy store, scan upload, LUKS keys) |
+| 139, 445 | TCP | SMB |
+| 8090 | TCP | CheckMK web UI |
+| 8000 | TCP | CheckMK agent receiver — **required for NAT/push clients** |
+| 6557 | TCP | CheckMK livestatus (only if external tools query it) |
+| 8080, 8443 | TCP | Keycloak (usually only via the gateway, not exposed directly) |
+| 8088 | TCP | nginx gateway — the one port your reverse proxy talks to |
+
+> If you front everything with the nginx gateway + your own reverse proxy, the
+> only web port that needs to be reachable from outside is the one your reverse
+> proxy uses to reach **8088** (or your proxy’s own 443). LDAP/Kerberos/SMB are
+> still needed directly by enrolled clients and are not proxied.
+
+### Client — inbound
+
+| Port | Proto | When |
+|------|-------|------|
+| 6556 | TCP | **only** if using CheckMK pull mode (server reaches client). Not needed — and not possible — for NAT clients, which use push mode (outbound to server :8000). |
+| 22 | TCP | only if you manage the client over SSH |
+
+Push-mode and policy enforcement need **no inbound ports on the client**.
+
+### Example rules (server)
+
+**firewalld** (RHEL/Fedora/Rocky):
+
+```bash
+for p in 389/tcp 636/tcp 88/tcp 88/udp 464/tcp 464/udp 443/tcp \
+         137/udp 138/udp 139/tcp 445/tcp 8090/tcp 8000/tcp 8088/tcp; do
+    firewall-cmd --permanent --add-port=$p
+done
+firewall-cmd --reload
+```
+
+**ufw** (Debian/Ubuntu):
+
+```bash
+for p in 389 636 88 464 443 139 445 8090 8000 8088; do ufw allow $p/tcp; done
+for p in 88 464 137 138; do ufw allow $p/udp; done
+```
+
+**nftables** (excerpt for an `inet filter` input chain):
+
+```nft
+tcp dport { 389, 636, 88, 464, 443, 139, 445, 8090, 8000, 8088 } accept
+udp dport { 88, 464, 137, 138 } accept
+```
+
+---
+
 ## The nginx gateway (portal + reverse proxy)
 
 The `ansipa-nginx` service fronts all three web UIs on **one hostname/port** and
diff --git a/docs/md/freeipa-ansible.md b/docs/md/freeipa-ansible.md
index d0f5886..2d7e72b 100644
--- a/docs/md/freeipa-ansible.md
+++ b/docs/md/freeipa-ansible.md
@@ -1,6 +1,6 @@
 # FreeIPA & Ansible
 
-The FreeIPA/Ansible system provides centralised identity management for a fleet of Arch Linux machines: single sign-on, host-group-driven package and module deployment, policy enforcement, LUKS backup key collection, scan-result aggregation, and automatic Keycloak configuration.
+The FreeIPA/Ansible system ("ansipa") provides centralised identity management for a mixed Linux fleet (Arch, Fedora, RHEL/Rocky/AlmaLinux, Debian/Ubuntu): single sign-on, host-group-driven package and module deployment, policy enforcement, CheckMK monitoring, LUKS backup key collection, scan-result aggregation, and automatic Keycloak configuration. For a full deployment walkthrough — ports, the nginx portal/reverse proxy, firewall rules, NAT behaviour, and Proxmox LXC — see the [ansipa Setup Guide](ansipa-setup.md).
 
 All relevant files live under `setup/modules/FreeipaAnsible/`.
 
@@ -156,6 +156,15 @@ The container exposes two Samba shares, both configured by `ansipa-smb-setup.sh`
 
 ## Client Enrollment
 
+`freeipa-enroll.sh` supports **Arch, Fedora, RHEL/Rocky/AlmaLinux, and
+Debian/Ubuntu** — it auto-detects the distro and uses the right package manager
+and package names. On Arch, `ipa-client-install` comes from the AUR
+`freeipa-client` package; the enroll script first builds the bundled
+`autofs-pkgbuild/` (the stock AUR `autofs` is currently broken — its pinned
+tarball 404s), so expect the first Arch enrollment to take a while as the AUR
+FreeIPA suite compiles. See the [ansipa Setup Guide](ansipa-setup.md#arch-caveat--autofs--freeipa-client-from-the-aur)
+for details.
+
 ### Via Installer Module
 
 Select `freeipa-client` during `tui-install.sh` or `install-modules.sh`.