diff --git a/.env.example b/.env.example
index 9c1545b..55d9af7 100644
--- a/.env.example
+++ b/.env.example
@@ -20,7 +20,9 @@ OIDC_ENABLED=false
 OIDC_ISSUER_URL=https://192.168.1.208:9443/application/o/homelab-monitor/
 OIDC_CLIENT_ID=
 OIDC_CLIENT_SECRET=
-OIDC_REDIRECT_URI=http://192.168.1.103:8090/api/auth/oidc/callback
+# Public URL is primary since issue #13 shipped; the LAN URL is also registered
+# in Authentik as a fallback (see docs/oidc-setup.md) if you need to switch back.
+OIDC_REDIRECT_URI=https://monitor.jerodrigged.com/api/auth/oidc/callback
 # Authentik's cert is self-signed on the LAN, same situation as Proxmox's API.
 OIDC_ALLOW_INSECURE_TLS=true
 
diff --git a/CLAUDE.md b/CLAUDE.md
index d6b47e2..e0dc4a0 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -52,12 +52,22 @@ One login instead of logging into Proxmox, Zabbix, OMV, and every service separa
   see `docs/ssh-collector-key-setup.md`.
 - **Authentik OIDC provider**: set up via an Authentik blueprint on CT121 (not a manual UI step) — see
   `docs/oidc-setup.md`. Purely additive, didn't touch any existing Authentik user/credential.
-- **NPM proxy host**: `monitor.jerodrigged.com` → 192.168.1.103:8090 created (id 14 in NPM), but **no
-  DNS/Cloudflare tunnel route yet** — the hostname won't resolve until issue #13 finishes (needs a
-  Cloudflare API token from the user). No SSL cert requested yet either (Let's Encrypt HTTP-01 needs the
-  domain to actually resolve first).
+- **Public exposure (done, issue #13 closed)**: `https://monitor.jerodrigged.com` is live. Chain is
+  Cloudflare Tunnel (existing tunnel `ac3a4440-...`, added a Public Hostname pointing at NPM, not
+  directly at the dashboard) → NPM proxy host id 14 (`192.168.1.185:80` → `192.168.1.103:8090`) → app.
+  NPM cert is Let's Encrypt (id 18). **`ssl_forced` must stay `false`** on this proxy host — Cloudflare
+  is in Flexible SSL mode (terminates TLS at the edge, talks plain HTTP to the tunnel origin), so
+  `ssl_forced: true` causes an infinite redirect loop. Hit this exact bug once already; don't re-enable it.
+  `COOKIE_SECURE` also stays `false` for the same underlying reason — the Fastify process never sees an
+  HTTPS connection even when the *browser* is on HTTPS, since TLS terminates before it.
+- **Authentik redirect URIs**: both the public (`https://monitor.jerodrigged.com/...`, now primary in
+  `.env`) and LAN (`http://192.168.1.103:8090/...`) callback URLs are registered in the blueprint, so
+  OIDC login still works if the tunnel/DNS is ever down.
 - **Vaultwarden**: dashboard admin credentials saved as "Homelab Monitor (dashboard admin)". OIDC client
   credentials not yet saved there (pending a `BW_SESSION` from the user).
+- **Not yet verified**: nobody has actually clicked "Sign in with Authentik" through a real browser —
+  the redirect chain and params are confirmed correct via curl, but the final interactive consent/login
+  step needs a human.
 
 ## Zabbix: intentionally skipped, not blocked
 
diff --git a/docs/oidc-setup.md b/docs/oidc-setup.md
index 1cea615..b8eb024 100644
--- a/docs/oidc-setup.md
+++ b/docs/oidc-setup.md
@@ -17,8 +17,9 @@ touch any existing user, group, or admin credential.
 - Provider: confidential client, `default-provider-authorization-implicit-consent` flow
   (auto-approve — reasonable for a single-user personal dashboard), signed with
   Authentik's existing self-signed cert.
-- Redirect URI: `http://192.168.1.103:8090/api/auth/oidc/callback` (LAN-only for now;
-  will need a second redirect URI added once issue #13's public exposure lands).
+- Redirect URIs (both registered): `https://monitor.jerodrigged.com/api/auth/oidc/callback` (primary,
+  set in `.env`) and `http://192.168.1.103:8090/api/auth/oidc/callback` (LAN fallback, works if the
+  tunnel/DNS is down).
 - Application slug: `homelab-monitor`.
 
 To change anything (redirect URI, flow, scopes), edit the blueprint file on CT121 and