diff --git a/2025/xg-infra-upgrade-2025.md b/2025/xg-infra-upgrade-2025.md
index d9c0798..962ede3 100644
--- a/2025/xg-infra-upgrade-2025.md
+++ b/2025/xg-infra-upgrade-2025.md
@@ -30,7 +30,8 @@ tags:
 	* Samba
 	* VTVBB sync + go tooling
 	* Cache: pkg + freebsd update (for jails)
-	* Reverse caddy SSL proxy
+	* Reverse caddy HTTP + SSL proxy
+	* Bastion SSH host
 	* Wireguard VPN
 		* https://genneko.github.io/playing-with-bsd/networking/freebsd-wireguard-jail/
 * Data partitioning
@@ -39,7 +40,9 @@ tags:
 		* /data/home
 
 Host OS services:
- * SSH + sshguard
+ * SSH
+ * sshguard
+ * pf firewall
 
 Improvements & things to not forget:
 * ZFS disable atime https://www.unixtutorial.org/zfs-performance-basics-disable-atime/