diff --git a/docs/plans/remote-access.md b/docs/plans/remote-access.md
index e69d6e8..c185bfd 100644
--- a/docs/plans/remote-access.md
+++ b/docs/plans/remote-access.md
@@ -26,23 +26,18 @@ After evaluating WireGuard gateway vs Headscale (self-hosted Tailscale), the **W
 
 ```mermaid
 graph TD
-    clients["Laptop / Phone\n(WireGuard clients)"]
+    clients["Laptop / Phone"]
+    vps["VPS<br/>(WireGuard endpoint)"]
+    extgw["extgw01<br/>(gateway + bastion)"]
+    grafana["Grafana<br/>monitoring01:3000"]
+    jellyfin["Jellyfin<br/>jelly01:8096"]
+    arr["arr stack<br/>*-jail hosts"]
 
-    vps["VPS (OpenStack)\nWireGuard endpoint\nClient peers: laptop, phone\nRoutes 10.69.13.0/24 via tunnel"]
-
-    extgw["extgw01 (gateway + bastion)\nWireGuard tunnel to VPS\nFirewall (allowlist only)\nSSH + 2FA (full access)"]
-
-    internal["Internal network 10.69.13.0/24"]
-    grafana["monitoring01:3000\nGrafana"]
-    jellyfin["jelly01:8096\nJellyfin"]
-    arr["*-jail hosts\narr stack"]
-
-    clients -->|"WireGuard"| vps
-    vps -->|"WireGuard tunnel"| extgw
-    extgw -->|"allowed traffic only"| internal
-    internal --- grafana
-    internal --- jellyfin
-    internal --- arr
+    clients -->|WireGuard| vps
+    vps -->|WireGuard tunnel| extgw
+    extgw -->|allowed traffic| grafana
+    extgw -->|allowed traffic| jellyfin
+    extgw -->|allowed traffic| arr
 ```
 
 ### Existing path (unchanged)