diff --git a/.gitignore b/.gitignore
index e737230..ea8c8cf 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 compose/production/traefik/traefik.toml
+.envs/
diff --git a/README.md b/README.md
index 8a5bbf2..cd8f12c 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,10 @@
 # Mistborn
 A platform for easily managing your cloud server and Wireguard access
 
-## What is Mistborn
+# Table of Contents
+[[_TOC_]]
+
+# What is Mistborn
 The term [Mistborn](http://www.brandonsanderson.com/the-mistborn-saga-the-original-trilogy) comes from a type of powerful Allomancer in Brandon Sanderson's Cosmere.
 
 Mistborn started as a passion project for a husband and father protecting his family. Certain family members insisted on connecting their devices to free WiFi networks. We needed a way to secure all family devices with a solid VPN (Wireguard). Once we had that we wanted to control DNS to block ads to all devices and block malicious and pornographic websites across all family devices. Then we wanted chat, file-sharing, and webchat services that we could use for ourselves without entrusting our data to some big tech company. And then... home automation. I know I'll be adding services as I go so I made that easy to do.
@@ -18,7 +21,7 @@ These tools are not vital to Mistborn itself but are integrated to enhance secur
 - [DNScrypt](https://www.dnscrypt.org): prevents DNS spoofing via cryptographic signatures to verify that responses originate from the chosen DNS resolver and haven't been tampered
 - [Traefik](https://docs.traefik.io): A modern, efficient reverse-proxy
 
-Within Mistborn is a panel to enable and manage these free extra services, locally hosted in Docker containers:
+Within Mistborn is a panel to enable and manage these free extra services (off by default), locally hosted in Docker containers:
 - [Home Assistant](https://www.home-assistant.io): Open source home automation that puts local control and privacy first
 - [Nextcloud](https://nextcloud.com): Nextcloud offers the industry-leading, on-premises content collaboration platform. It combines the convenience and ease of use of consumer-grade solutions like Dropbox and Google Drive with the security, privacy and control business needs.
 - [BitWarden](https://bitwarden.com): Password manager. The easiest and safest way for individuals, teams, and business organizations to store, share, and sync sensitive data.
@@ -27,9 +30,18 @@ Within Mistborn is a panel to enable and manage these free extra services, local
 - [Rocket.Chat](https://rocket.chat): Free, Open Source, Enterprise Team Chat.
 - [Jellyfin](https://jellyfin.org): The Free Media Software System.
 - [Tor](https://www.torproject.org): The Onion Router. One tool in the arsenal of online security and privacy.
+- [Jitsi](https://jitsi.org): Multi-platform open-source video conferencing
+
+# Network Diagram
+![Mistborn Network Diagram](https://gitlab.com/cyber5k/public/-/raw/master/graphics/mistborn_network.png)
+
+Mistborn protects your data in a variety of ways:
+- All of your devices are protected wherever they go with the Wireguard VPN protocol
+- The Mistborn firewall blocks unsolicited incoming internet packets
+- Pi-hole running on Mistborn blocks outgoing internet requests to configurable blocked domains (ads, malicious/phishing domains, etc.) 
 
-## Installation
-Mistborn is regularly tested on Ubuntu 18.04 LTS. It has also been successfully used on Debian and Raspbian systems (though not regularly tested).
+# Installation
+Mistborn is regularly tested on Ubuntu 18.04 LTS (DigitalOcean droplet with 2 GB RAM). It has also been successfully used on Debian Buster and Raspbian Buster systems (though not regularly tested).
 
 Clone the git repository and run the install script:
 ```
@@ -40,7 +52,7 @@ sudo bash ./mistborn/scripts/install.sh
 Running `install.sh` will do the following:
 - create a `mistborn` system user
 - clone the mistborn repo to `/opt/mistborn`
-- setup iptables and ip6tables rules
+- setup iptables and ip6tables rules and chains
 - install iptables-persistent
 - install Docker
 - install OpenSSH
@@ -48,6 +60,8 @@ Running `install.sh` will do the following:
 - install Cockpit
 - create a `cockpit` system user
 - configure unattended-upgrades
+- generate a self-signed TLS certificate/key (WebRTC functionality requires TLS)
+- create and populate traefik.toml
 - create `/opt/mistborn_volumes` and setup folders for services that will be mounted within
 - backup original contents of `/opt/mistborn_volumes` in `/opt/mistborn_backup`
 - Pull docker images for base.yml
@@ -56,15 +70,15 @@ Running `install.sh` will do the following:
 - copy Mistborn systemd service files to `/etc/systemd/system`
 - start and enable Mistborn-base
 
-## Post-Installation
+# Post-Installation
 When Mistborn-base starts up it will create volumes, initialize the PostgreSQL database, start pihole, run Django migrations and then check to see if a Mistborn superuser named `admin` exists yet. If not, it will create the superuser along with an accompanying Wireguard configuration file and start the Wireguard service. You can watch all of this happen with:
 ```
-journalctl -xfu Mistborn-base
+sudo journalctl -xfu Mistborn-base
 ```
 
 The client Wireguard configuration file may be obtained via:
 ```
-docker-compose -f /opt/mistborn/base.yml run --rm django python manage.py getconf admin default
+sudo docker-compose -f /opt/mistborn/base.yml run --rm django python manage.py getconf admin default
 ```
 Please notice that the following lines are **NOT** part of the Wireguard config:
 ```
@@ -102,6 +116,7 @@ Endpoint = <Mistborn public IP address>:39207
 - Run `sudo systemctl enable wg-quick@wg_admin`
 - Open your browser and go to "http://home.mistborn"
 - Browse your Mistborn system!
+**Note:** The home.mistborn server takes a minute to come up after Mistborn is up (collectstatic on all that frontend JavaScript and CSS)
 
 ## Wireguard Management
 Mistborn users can be added (non-privileged or superuser) and removed by superusers. Multiple Wireguard profiles can be created for each user. A non-privileged user can create profiles for themselves.
@@ -115,36 +130,58 @@ Mistborn makes extra services available.
 Mistborn functions as a network firewall and provides metrics on blocked probes from the internet.
 ![Mistborn Metrics](https://gitlab.com/cyber5k/public/-/raw/master/graphics/home.mistborn_metrics.png)*Mistborn Firewall Metrics*
 
-## Troubleshooting
+# Mistborn Subdomains
+Mistborn uses the following domains (that can be reached by all Wireguard clients):
+
+| Service | Domain | Default Status |
+| ------- | ------ | -------------- |
+| **Home** | home.mistborn | On |
+| **Pihole** | pihole.mistborn | On |
+| **Cockpit** | cockpit.mistborn | On |
+| Nextcloud | nextcloud.mistborn | Off |
+| Rocket.Chat | chat.mistborn | Off |
+| Home Assistant | homeassistant.mistborn | Off |
+| Bitwarden | bitwarden.mistborn | Off |
+| Jellyfin | jellyfin.mistborn | Off |
+| Syncthing | syncthing.mistborn | Off |
+| OnlyOffice | onlyoffice.mistborn | Off |
+| Jitsi | jitsi.mistborn | Off |
+
+# Troubleshooting
 
 Once you're connected to Wireguard you should see .mistborn domains and the internet should work as expected. Be sure to use http (http://home.mistborn). Wireguard is the encrypted channel so we're not bothering with TLS certs. Here are some things to check if you have issues:
 
 See if any docker containers are stopped:
 ```
-docker container ls -a
+sudo docker container ls -a
 ```
 
 Check the running log for Mistborn-base:
 ```
-journalctl -xfu Mistborn-base
+sudo journalctl -xfu Mistborn-base
 ```
 
 Mistborn-base is a systemd process and at any time restarting it should get you to a working state:
 ```
-systemctl restart Mistborn-base
+sudo systemctl restart Mistborn-base
 ```
 
 The Wireguard processes run independently of Mistborn and will still be up if Mistborn is down. You can check running Wireguard interfaces with:
 ```
-wg show
+sudo wg show
 ```
 Note the Mistborn naming convention for Wireguard interfaces on the server is wg<listening port>. So if the particular Wireguard process is listening on UDP port 56392 then the interface will be named wg56392 and the config will be in `/etc/wireguard/wg56392.conf`
 
-## Contact
+The `dev/` folder contains a script for completing a hard reset: destroying and rebuilding the system from the original backup:
+```
+sudo ./dev/rebuild.sh
+```
+
+# Contact
 
 Contact me at [steven@cyber5k.com](mailto:steven@cyber5k.com)
 
-## Support
+# Support
 
 Please consider supporting the project via:
 - [Patreon](https://www.patreon.com/cyber5k)
diff --git a/dev/rebuild.sh b/dev/rebuild.sh
new file mode 100755
index 0000000..08e8611
--- /dev/null
+++ b/dev/rebuild.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+sudo systemctl stop Mistborn-base
+sudo rm -rf /opt/mistborn_volumes/*
+sudo docker container prune -f
+sudo docker image prune -f
+sudo docker volume prune -f
+sudo eval "$(dirname "${BASH_SOURCE[0]}")/wg_clean.sh"
+
+pushd .
+cd /opt/mistborn
+tar -xzvf ../mistborn_backup/mistborn_volumes_backup.tar.gz -C ../
+git pull
+git submodule update --init
+sudo docker-compose -f base.yml build
+popd
+
+sudo systemctl start Mistborn-base
+sudo journalctl -xfu Mistborn-base
diff --git a/dev/wg_clean.sh b/dev/wg_clean.sh
new file mode 100755
index 0000000..e80ed9b
--- /dev/null
+++ b/dev/wg_clean.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+pushd .
+cd /etc/wireguard
+
+for filename in ./*.conf; do
+    
+    iface="$(basename $filename | cut -d'.' -f1)" 
+    
+    if sudo wg show $iface 1>/dev/null 2>&1 ; then
+        # interface exists
+        if sudo wg show $iface | grep -qF 'latest handshake' ; then
+            echo 'connected'
+        else
+            echo 'never connected'
+            echo "stoppping, disabling, and removing  $iface"
+            sudo systemctl stop wg-quick@$iface && sudo systemctl disable wg-quick@$iface && rm ./$filename
+        fi
+    fi
+
+done
+
+
+popd
diff --git a/scripts/subinstallers/iptables.sh b/scripts/subinstallers/iptables.sh
index b3db5ab..750c899 100755
--- a/scripts/subinstallers/iptables.sh
+++ b/scripts/subinstallers/iptables.sh
@@ -50,7 +50,7 @@ fi
 # docker rules
 sudo iptables -N MISTBORN_DOCKER_INPUT
 sudo iptables -A MISTBORN_DOCKER_INPUT -i br-+ -j ACCEPT
-#sudo iptables -A INPUT ! -i $iface -s 172.16.0.0/12 -j ACCEPT
+#sudo iptables -A MISTBORN_DOCKER_INPUT -i docker0 -j ACCEPT
 
 # last rules
 sudo iptables -A INPUT -j MISTBORN_DOCKER_INPUT
diff --git a/scripts/update.sh b/scripts/update.sh
index a268028..8f3d639 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -2,7 +2,7 @@
 
 set -e
 
-docker-compose -f /opt/mistborn/base.yml pull
-docker-compose -f /opt/mistborn/base.yml build
+sudo docker-compose -f /opt/mistborn/base.yml pull
+sudo docker-compose -f /opt/mistborn/base.yml build
 
-systemctl restart Mistborn-base
+sudo systemctl restart Mistborn-base