add cloud vs self-hosted

about/how-pangolin-works.mdx

@@ -29,7 +29,7 @@ Pangolin relies on several components that work together to provide secure netwo
 
 The Pangolin server is the central coordination component for your network. It stores configuration changes, manages access policies, and coordinates connections between clients and sites. The server handles user authentication, generates access control lists that determine what resources each user can reach, hosts the UI and API, and more. It is the brains of your Pangolin network.
 
-You can use [Pangolin Cloud](https://app.pangolin.net/auth/signup), which is fully managed, or you can self-host your own Pangolin server for complete control over your infrastructure and data.
+You can use [Pangolin Cloud](https://app.pangolin.net/auth/signup), which is fully managed, or you can self-host your own Pangolin server for complete control over your infrastructure and data. See [Pangolin Cloud vs. Self-Hosted](/about/pangolin-cloud-vs-self-hosted).
 
 <Card title="Try free on Pangolin Cloud" icon="cloud" href="https://app.pangolin.net/auth/signup" arrow="true" cta="Sign up free">
   Fastest way to get started with the fully managed control plane. No credit card required.

about/pangolin-cloud-vs-self-hosted.mdx

@@ -0,0 +1,60 @@
+---
+title: "Cloud vs. Self-Hosted"
+description: "Choose managed Pangolin Cloud or run the same software on your own infrastructure"
+---
+
+You can run Pangolin as [Pangolin Cloud](https://app.pangolin.net/auth/signup) or [self-host](/self-host/quick-install) the same open-source software. Sites, resources, and clients work the same way in both. The difference is who operates the server: the control plane, DNS, certificates, and the nodes that terminate tunnels.
+
+## Pangolin Cloud
+
+Cloud is the managed control plane. You create an account, install [sites](/manage/sites/install-site) and [clients](/manage/clients/install-client), and define resources. Pangolin runs the dashboard, database, certificates, and globally distributed nodes.
+
+Use Cloud when you want high availability, automatic updates, and less operational work. You can still keep traffic on infrastructure you control with [remote nodes](/manage/remote-node/understanding-nodes).
+
+## Self-Hosted
+
+Self-hosted Pangolin runs on a server you operate. You supply a public IP, a domain, and the listener ports. See [Quick Install](/self-host/quick-install) and [DNS and Networking](/self-host/dns-and-networking). You are responsible for updates, backups, certificates, and uptime.
+
+Two editions:
+
+- **Community Edition** is the core platform.
+- **[Enterprise Edition](/self-host/enterprise-edition)** uses the `ee` image and a license key. It unlocks extra identity, logging, and management features. Compare tiers on the [Self-Hosted pricing page](https://pangolin.net/pricing#Self-Hosted-identity-and-access-management).
+
+<Check>
+Enterprise Edition is **free** for personal use and organizations with less than $100,000 USD gross annual revenue. You still need a license key. Larger organizations need a paid license.
+</Check>
+
+## Remote Nodes (Hybrid)
+
+[Remote nodes](/manage/remote-node/understanding-nodes) are a middle path but are part of Pangolin Cloud. You run the node (tunnels, TLS, relay) on your server and bandwidth. Cloud still handles the dashboard, DNS, certificates, and failover. If your node goes down, traffic can fail over to other nodes or cloud points of presence.
+
+Public TCP/UDP listeners that bind a port on the Pangolin host are a self-hosted-server feature. On Cloud, deploy a remote node for that. See [TCP / UDP](/manage/resources/public/raw-resources).
+
+## Quick Comparison
+
+| | Pangolin Cloud | Self-hosted |
+|---|---|---|
+| **Control plane** | Managed | You run Pangolin, Traefik, and Gerbil |
+| **Traffic path** | Cloud nodes, or your [remote nodes](/manage/remote-node/understanding-nodes) | Your server |
+| **DNS and certificates** | Managed | You configure DNS and Let's Encrypt |
+| **Updates and backups** | Included | You operate them |
+| **High availability** | Included | You design it ([clustering](/self-host/advanced/clustering) on Enterprise) |
+| **Identity and logs** | Cloud plans | Community core; extra IdPs, streaming, and AI session logs on [Enterprise Edition](/self-host/enterprise-edition) |
+| **Data residency** | Cloud regions, or traffic on your remote nodes | Entirely on your infrastructure |
+| **Best for** | Fast start and less ops | Air-gapped networks, full control, compliance that requires self-hosting |
+
+Cloud and self-hosted plans are listed separately on [pricing](https://pangolin.net/pricing). Click "Self-Hosted" at the top to toggle between deployment options.
+
+## When to Use Each
+
+Use **Pangolin Cloud** if you want to start quickly, get HA and certificate management included, and optionally attach remote nodes so tunnel traffic stays on your network.
+
+Use **self-hosted** if the control plane and data must stay on infrastructure you operate, you need an air-gapped or fully isolated deployment, or you already run Pangolin as Community or Enterprise Edition.
+
+<Card title="Start on Pangolin Cloud" icon="cloud" href="https://app.pangolin.net/auth/signup" arrow="true" cta="Sign up">
+  Managed control plane. Install sites and clients, then define resources.
+</Card>
+
+<Card title="Self-host Pangolin" icon="server" href="/self-host/quick-install">
+  Install Community Edition or Enterprise Edition with the quick installer.
+</Card>

docs.json

@@ -29,7 +29,8 @@
                         "pages": [
                             "about/how-pangolin-works",
                             "about/pangolin-vs-reverse-proxy-vs-vpn",
-                            "about/pangolin-vs-bifrost-vs-litellm"
+                            "about/pangolin-vs-bifrost-vs-litellm",
+                            "about/pangolin-cloud-vs-self-hosted"
                         ]
                     },
                     {

index.mdx

@@ -37,6 +37,8 @@ Users access public resources through any web browser with authentication. Users
 
 ## Deployment Options
 
+See [Pangolin Cloud vs. Self-Hosted](/about/pangolin-cloud-vs-self-hosted) for the differences, including [remote nodes](/manage/remote-node/understanding-nodes) as a hybrid.
+
 <Columns cols={2}>
   <Card title="Pangolin Cloud" icon="cloud" href="https://app.pangolin.net/auth/signup">
     Use Cloud for low-maintenance, highly available remote access. Optionally self-host a node to keep your traffic private.

manage/ai/overview.mdx

@@ -3,7 +3,7 @@ title: "AI Gateway Overview"
 description: "Route coding agents and AI clients through Pangolin with centralized providers and access control"
 ---
 
-An AI Gateway resource is a normal Pangolin resource that proxies requests to one or more upstream AI providers (OpenAI, Anthropic, Google Gemini, Bedrock, Vertex AI, or a custom endpoint). Point a client at the resource's URL instead of the provider's, and Pangolin handles auth, access control, and logging in front of it.
+An AI Gateway resource is a normal Pangolin resource that proxies requests to one or more upstream AI providers (OpenAI, Anthropic, Google Gemini, Bedrock, Vertex AI, or a custom endpoint). Point a client at the resource's URL instead of the provider's, and Pangolin handles auth, access control, and logging in front of it. See [Pangolin vs. Bifrost vs. LiteLLM](/about/pangolin-vs-bifrost-vs-litellm) if you are comparing Pangolin to a traditional LLM gateway.
 
 ## How It Fits Together