docs: reorganize Use Cases navigation (#834)

* docs: consolidate scenario guides under /use-cases with redirects

Move 11 pages: feature-nested use cases from manage/networks,
manage/network-routes, manage/reverse-proxy, and the Kubernetes
integration into /use-cases/remote-access, /use-cases/cloud, and
/use-cases/security; the site-to-site decision page becomes
/use-cases/remote-access; the MikroTik guide becomes an install
guide at /get-started/install/mikrotik.

Add one redirect per moved page and flatten existing redirect
chains so every legacy URL resolves in a single hop. The
deprecated Routes site-to-site recipe stays put.

* docs: rebuild sidebar navigation for use-cases reorg

Remove the four nested Use Cases sublists from Manage NetBird;
keep the deprecated Routes recipe as a direct 'Site-to-Site
(legacy)' link. Rebuild USE CASES with Remote Access, Cloud &
Kubernetes, Security groups and a flat Homelab link. Add MikroTik
to Get Started > Platforms.

* docs: rebuild use-case index pages and refresh feature landing links

Turn /use-cases into an "I want to..." scenario finder. Retitle
the site-to-site decision page to Remote Access and point its
links at the new sibling URLs. Add the Kubernetes service and
private-proxy guides to the cloud and security indexes, refresh
the homelab landing links, and update the Networks, Routes,
Reverse Proxy, and Kubernetes landing pages to the new use-case
URLs.

* docs: update internal links to new use-case URLs

Point cross-links across the docs at the consolidated
/use-cases URLs. Links to the deprecated Routes site-to-site
recipe and all image paths under public/docs-static are left
unchanged.

* docs: shorten sidebar label to Site-to-Site

* docs: move Kubernetes into its own Use Cases section

Pull the entire Kubernetes integration out of Manage > Integrations
into a dedicated Kubernetes group under Use Cases at /use-cases/
kubernetes, and move the two Kubernetes cloud guides there too.
Rename the Cloud group (was 'Cloud & Kubernetes'); Integrations
keeps the MDM deployment pages. Add redirects for every moved page
and flatten existing chains.

* docs: drop 'NetBird on' prefix from cloud sidebar labels

* docs: alphabetize Remote Access use cases in sidebar

* ❯ add mikrotik to install index

* docs: fix duplicated word in remote-access link label on TV install pages

---------

Co-authored-by: Brandon Hopkins <brandon@techhut.tv>

next.config.mjs

@@ -38,7 +38,7 @@ const nextConfig = {
             },
             {
                 source: '/manage/network-routes/use-cases/by-scenario/site-to-vpn',
-                destination: '/manage/networks/use-cases/site-to-vpn',
+                destination: '/use-cases/remote-access/site-to-vpn',
                 permanent: true,
             },
             {
@@ -283,12 +283,12 @@ const nextConfig = {
             },
             {
                 source: '/how-to/routing-peers-and-kubernetes',
-                destination: '/use-cases/cloud/routing-peers-and-kubernetes',
+                destination: '/use-cases/kubernetes/routing-peers-and-kubernetes',
                 permanent: true,
             },
             {
                 source: '/how-to/client-on-mikrotik-router',
-                destination: '/use-cases/homelab/client-on-mikrotik-router',
+                destination: '/get-started/install/mikrotik',
                 permanent: true,
             },
             {
@@ -319,7 +319,7 @@ const nextConfig = {
             },
             {
                 source: '/how-to/access-home-network',
-                destination: '/manage/networks/use-cases/access-home-devices',
+                destination: '/use-cases/remote-access/access-home-devices',
                 permanent: true,
             },
             // documentation redirects for network-routes
@@ -330,7 +330,7 @@ const nextConfig = {
             },
             {
                 source: '/how-to/configuring-default-routes-for-internet-traffic',
-                destination: '/manage/network-routes/use-cases/exit-nodes',
+                destination: '/use-cases/remote-access/exit-nodes',
                 permanent: true,
             },
             {
@@ -499,7 +499,7 @@ const nextConfig = {
             },
             {
                 source: '/how-to/kubernetes-operator',
-                destination: '/manage/integrations/kubernetes',
+                destination: '/use-cases/kubernetes',
                 permanent: true,
             },
             // documentation redirects for public-api
@@ -551,10 +551,101 @@ const nextConfig = {
                 destination: '/manage/dns/custom-zones',
                 permanent: true,
             },
+            // Use cases reorg: scenario guides consolidated under /use-cases
+            {
+                source: '/manage/integrations/kubernetes',
+                destination: '/use-cases/kubernetes',
+                permanent: true,
+            },
+            {
+                source: '/manage/integrations/kubernetes/routing-peer',
+                destination: '/use-cases/kubernetes/routing-peer',
+                permanent: true,
+            },
+            {
+                source: '/manage/integrations/kubernetes/client-sidecar',
+                destination: '/use-cases/kubernetes/client-sidecar',
+                permanent: true,
+            },
+            {
+                source: '/manage/integrations/kubernetes/api-server-proxy',
+                destination: '/use-cases/kubernetes/api-server-proxy',
+                permanent: true,
+            },
+            {
+                source: '/manage/integrations/kubernetes/gateway-api',
+                destination: '/use-cases/kubernetes/gateway-api',
+                permanent: true,
+            },
+            {
+                source: '/use-cases/cloud/route-to-a-kubernetes-service',
+                destination: '/use-cases/kubernetes/route-to-a-kubernetes-service',
+                permanent: true,
+            },
+            {
+                source: '/use-cases/cloud/routing-peers-and-kubernetes',
+                destination: '/use-cases/kubernetes/routing-peers-and-kubernetes',
+                permanent: true,
+            },
+            {
+                source: '/use-cases/site-to-site',
+                destination: '/use-cases/remote-access',
+                permanent: true,
+            },
+            {
+                source: '/manage/networks/use-cases/site-to-site',
+                destination: '/use-cases/remote-access/site-to-site',
+                permanent: true,
+            },
+            {
+                source: '/manage/networks/use-cases/site-to-vpn',
+                destination: '/use-cases/remote-access/site-to-vpn',
+                permanent: true,
+            },
+            {
+                source: '/manage/networks/use-cases/cloud-to-on-premise',
+                destination: '/use-cases/remote-access/cloud-to-on-premise',
+                permanent: true,
+            },
+            {
+                source: '/manage/networks/use-cases/access-home-devices',
+                destination: '/use-cases/remote-access/access-home-devices',
+                permanent: true,
+            },
+            {
+                source: '/manage/networks/use-cases/reach-services-on-the-routing-peer',
+                destination: '/use-cases/remote-access/reach-services-on-the-routing-peer',
+                permanent: true,
+            },
+            {
+                source: '/manage/networks/use-cases/active-directory',
+                destination: '/use-cases/remote-access/active-directory',
+                permanent: true,
+            },
+            {
+                source: '/manage/network-routes/use-cases/exit-nodes',
+                destination: '/use-cases/remote-access/exit-nodes',
+                permanent: true,
+            },
+            {
+                source: '/manage/integrations/kubernetes/use-cases/route-to-a-kubernetes-service',
+                destination: '/use-cases/kubernetes/route-to-a-kubernetes-service',
+                permanent: true,
+            },
+            {
+                source: '/manage/reverse-proxy/use-cases/private-no-inbound',
+                destination: '/use-cases/security/private-no-inbound',
+                permanent: true,
+            },
+            {
+                source: '/use-cases/homelab/client-on-mikrotik-router',
+                destination: '/get-started/install/mikrotik',
+                permanent: true,
+            },
             // Site-to-site documentation restructure redirects
             {
                 source: '/use-cases/setup-site-to-site-access',
-                destination: '/use-cases/site-to-site',
+                destination: '/use-cases/remote-access',
                 permanent: true,
             },
             {
@@ -569,17 +660,17 @@ const nextConfig = {
             },
             {
                 source: '/manage/networks/homelab/access-home-network',
-                destination: '/manage/networks/use-cases/access-home-devices',
+                destination: '/use-cases/remote-access/access-home-devices',
                 permanent: true,
             },
             {
                 source: '/manage/networks/use-cases/by-scenario/access-home-devices',
-                destination: '/manage/networks/use-cases/access-home-devices',
+                destination: '/use-cases/remote-access/access-home-devices',
                 permanent: true,
             },
             {
                 source: '/manage/networks/use-cases/by-scenario/cloud-to-on-premise',
-                destination: '/manage/networks/use-cases/cloud-to-on-premise',
+                destination: '/use-cases/remote-access/cloud-to-on-premise',
                 permanent: true,
             },
             // Networks guides moved to use-cases
@@ -636,7 +727,7 @@ const nextConfig = {
             },
             {
                 source: '/manage/network-routes/configuring-default-routes-for-internet-traffic',
-                destination: '/manage/network-routes/use-cases/exit-nodes',
+                destination: '/use-cases/remote-access/exit-nodes',
                 permanent: true,
             },
             {
@@ -671,7 +762,7 @@ const nextConfig = {
             },
             {
                 source: '/manage/network-routes/use-cases/by-scenario/exit-nodes',
-                destination: '/manage/network-routes/use-cases/exit-nodes',
+                destination: '/use-cases/remote-access/exit-nodes',
                 permanent: true,
             },
             {
@@ -692,22 +783,22 @@ const nextConfig = {
             // Site-to-Site section redirects (overview and comprehensive guides)
             {
                 source: '/manage/site-to-site',
-                destination: '/use-cases/site-to-site',
+                destination: '/use-cases/remote-access',
                 permanent: true,
             },
             {
                 source: '/manage/site-to-site/connect-home-networks',
-                destination: '/use-cases/site-to-site',
+                destination: '/use-cases/remote-access',
                 permanent: true,
             },
             {
                 source: '/manage/site-to-site/connect-office-networks',
-                destination: '/use-cases/site-to-site',
+                destination: '/use-cases/remote-access',
                 permanent: true,
             },
             {
                 source: '/manage/site-to-site/connect-cloud-environments',
-                destination: '/use-cases/site-to-site',
+                destination: '/use-cases/remote-access',
                 permanent: true,
             },
             {
@@ -728,7 +819,7 @@ const nextConfig = {
             },
             {
                 source: '/use-cases/routing-peers-and-kubernetes',
-                destination: '/use-cases/cloud/routing-peers-and-kubernetes',
+                destination: '/use-cases/kubernetes/routing-peers-and-kubernetes',
                 permanent: true,
             },
             {
@@ -738,7 +829,7 @@ const nextConfig = {
             },
             {
                 source: '/use-cases/client-on-mikrotik-router',
-                destination: '/use-cases/homelab/client-on-mikrotik-router',
+                destination: '/get-started/install/mikrotik',
                 permanent: true,
             },
             {

src/components/NavigationDocs.jsx

@@ -71,6 +71,7 @@ export const docsNavigation = [
           { title: 'pfSense', href: '/get-started/install/pfsense' },
           { title: 'OPNsense', href: '/get-started/install/opnsense' },
           { title: 'OpenWrt', href: '/get-started/install/openwrt' },
+          { title: 'MikroTik', href: '/get-started/install/mikrotik' },
           { title: 'Raspberry Pi', href: '/get-started/install/raspberrypi' },
         ],
       },
@@ -203,36 +204,6 @@ export const docsNavigation = [
             title: 'Masquerade',
             href: '/manage/networks/masquerade',
           },
-          {
-            title: 'Use Cases',
-            isOpen: false,
-            links: [
-              {
-                title: 'Access Home Devices',
-                href: '/manage/networks/use-cases/access-home-devices',
-              },
-              {
-                title: 'Cloud to On-Premise',
-                href: '/manage/networks/use-cases/cloud-to-on-premise',
-              },
-              {
-                title: 'Site-to-VPN',
-                href: '/manage/networks/use-cases/site-to-vpn',
-              },
-              {
-                title: 'Site-to-Site',
-                href: '/manage/networks/use-cases/site-to-site',
-              },
-              {
-                title: 'Reach Services on the Routing Peer',
-                href: '/manage/networks/use-cases/reach-services-on-the-routing-peer',
-              },
-              {
-                title: 'Active Directory & Windows File Shares',
-                href: '/manage/networks/use-cases/active-directory',
-              },
-            ],
-          },
         ],
       },
       {
@@ -241,18 +212,8 @@ export const docsNavigation = [
         links: [
           { title: 'Overview', href: '/manage/network-routes' },
           {
-            title: 'Use Cases',
-            isOpen: false,
-            links: [
-              {
-                title: 'Site-to-Site',
-                href: '/manage/network-routes/use-cases/site-to-site',
-              },
-              {
-                title: 'Exit Nodes',
-                href: '/manage/network-routes/use-cases/exit-nodes',
-              },
-            ],
+            title: 'Site-to-Site (legacy)',
+            href: '/manage/network-routes/use-cases/site-to-site',
           },
           {
             title: 'Access Control',
@@ -298,16 +259,6 @@ export const docsNavigation = [
             title: 'Troubleshooting',
             href: '/manage/reverse-proxy/troubleshooting',
           },
-          {
-            title: 'Use Cases',
-            isOpen: false,
-            links: [
-              {
-                title: 'No Public Inbound',
-                href: '/manage/reverse-proxy/use-cases/private-no-inbound',
-              },
-            ],
-          },
         ],
       },
       {
@@ -489,42 +440,6 @@ export const docsNavigation = [
               },
             ],
           },
-          {
-            title: 'Kubernetes',
-            isOpen: true,
-            links: [
-              {
-                title: 'Getting Started',
-                href: '/manage/integrations/kubernetes',
-              },
-              {
-                title: 'Routing Peer',
-                href: '/manage/integrations/kubernetes/routing-peer',
-              },
-              {
-                title: 'Client Sidecar',
-                href: '/manage/integrations/kubernetes/client-sidecar',
-              },
-              {
-                title: 'API Server Proxy',
-                href: '/manage/integrations/kubernetes/api-server-proxy',
-              },
-              {
-                title: 'Gateway API',
-                href: '/manage/integrations/kubernetes/gateway-api',
-              },
-              {
-                title: 'Use Cases',
-                isOpen: false,
-                links: [
-                  {
-                    title: 'Route to a Kubernetes Service',
-                    href: '/manage/integrations/kubernetes/use-cases/route-to-a-kubernetes-service',
-                  },
-                ],
-              },
-            ],
-          },
         ],
       },
 
@@ -600,10 +515,16 @@ export const docsNavigation = [
         title: 'Integrations',
         href: '/agent-network/integrations',
         links: [
-          { title: 'Claude Code', href: '/agent-network/integrations/claude-code' },
+          {
+            title: 'Claude Code',
+            href: '/agent-network/integrations/claude-code',
+          },
           { title: 'Codex', href: '/agent-network/integrations/codex' },
           { title: 'LiteLLM', href: '/agent-network/integrations/litellm' },
-          { title: 'Google Vertex AI', href: '/agent-network/integrations/vertex-ai' },
+          {
+            title: 'Google Vertex AI',
+            href: '/agent-network/integrations/vertex-ai',
+          },
           { title: 'AWS Bedrock', href: '/agent-network/integrations/bedrock' },
         ],
       },
@@ -822,7 +743,10 @@ export const docsNavigation = [
         isOpen: false,
         links: [
           { title: 'Overview', href: '/selfhosted/troubleshooting' },
-          { title: 'Installation', href: '/selfhosted/troubleshooting/installation' },
+          {
+            title: 'Installation',
+            href: '/selfhosted/troubleshooting/installation',
+          },
           {
             title: 'Embedded IdP',
             href: '/selfhosted/troubleshooting/identity-provider',
@@ -905,16 +829,35 @@ export const docsNavigation = [
       {
         title: 'Remote Access',
         isOpen: false,
-        links: [{ title: 'Overview', href: '/use-cases/site-to-site' }],
-      },
-      {
-        title: 'Homelab',
-        isOpen: false,
         links: [
-          { title: 'Overview', href: '/use-cases/homelab' },
+          { title: 'Overview', href: '/use-cases/remote-access' },
           {
-            title: 'NetBird on MikroTik Router',
-            href: '/use-cases/homelab/client-on-mikrotik-router',
+            title: 'Access Home Devices',
+            href: '/use-cases/remote-access/access-home-devices',
+          },
+          {
+            title: 'Active Directory & Windows File Shares',
+            href: '/use-cases/remote-access/active-directory',
+          },
+          {
+            title: 'Cloud to On-Premise',
+            href: '/use-cases/remote-access/cloud-to-on-premise',
+          },
+          {
+            title: 'Exit Nodes',
+            href: '/use-cases/remote-access/exit-nodes',
+          },
+          {
+            title: 'Reach Services on the Routing Peer',
+            href: '/use-cases/remote-access/reach-services-on-the-routing-peer',
+          },
+          {
+            title: 'Site-to-Site',
+            href: '/use-cases/remote-access/site-to-site',
+          },
+          {
+            title: 'Site-to-VPN',
+            href: '/use-cases/remote-access/site-to-vpn',
           },
         ],
       },
@@ -924,23 +867,50 @@ export const docsNavigation = [
         links: [
           { title: 'Overview', href: '/use-cases/cloud' },
           {
-            title: 'NetBird on AWS ECS',
+            title: 'AWS ECS',
             href: '/use-cases/cloud/aws-ecs-terraform',
           },
           {
-            title: 'NetBird on Serverless (FaaS)',
+            title: 'Serverless (FaaS)',
             href: '/use-cases/cloud/netbird-on-faas',
           },
-          {
-            title: 'Routing Peers and Kubernetes',
-            href: '/use-cases/cloud/routing-peers-and-kubernetes',
-          },
           {
             title: 'Distributed Multi-Cloud AI',
             href: '/use-cases/cloud/distributed-multi-cloud-ai',
           },
         ],
       },
+      {
+        title: 'Kubernetes',
+        isOpen: false,
+        links: [
+          { title: 'Getting Started', href: '/use-cases/kubernetes' },
+          {
+            title: 'Routing Peer',
+            href: '/use-cases/kubernetes/routing-peer',
+          },
+          {
+            title: 'Client Sidecar',
+            href: '/use-cases/kubernetes/client-sidecar',
+          },
+          {
+            title: 'API Server Proxy',
+            href: '/use-cases/kubernetes/api-server-proxy',
+          },
+          {
+            title: 'Gateway API',
+            href: '/use-cases/kubernetes/gateway-api',
+          },
+          {
+            title: 'Route to a Kubernetes Service',
+            href: '/use-cases/kubernetes/route-to-a-kubernetes-service',
+          },
+          {
+            title: 'Deploy Routing Peers to a Cluster',
+            href: '/use-cases/kubernetes/routing-peers-and-kubernetes',
+          },
+        ],
+      },
       {
         title: 'Security',
         isOpen: false,
@@ -950,8 +920,13 @@ export const docsNavigation = [
             title: 'Implement Zero Trust',
             href: '/use-cases/security/implement-zero-trust',
           },
+          {
+            title: 'Private Proxy Without Inbound Ports',
+            href: '/use-cases/security/private-no-inbound',
+          },
         ],
       },
+      { title: 'Homelab', href: '/use-cases/homelab' },
     ],
   },
   {
@@ -968,9 +943,15 @@ export const docsNavigation = [
             links: [
               { title: 'Overview', href: '/help/troubleshooting-client' },
               { title: 'Linux', href: '/help/troubleshooting-client/linux' },
-              { title: 'Windows', href: '/help/troubleshooting-client/windows' },
+              {
+                title: 'Windows',
+                href: '/help/troubleshooting-client/windows',
+              },
               { title: 'macOS', href: '/help/troubleshooting-client/macos' },
-              { title: 'Android', href: '/help/troubleshooting-client/android' },
+              {
+                title: 'Android',
+                href: '/help/troubleshooting-client/android',
+              },
               { title: 'iOS', href: '/help/troubleshooting-client/ios' },
             ],
           },

src/pages/get-started/install/android-tv.mdx

@@ -81,6 +81,6 @@ the SSO flow, the QR code dialog in the NetBird app will automatically dismiss i
 
 ## What's next?
 - Manage your device's [access](/manage/access-control/manage-network-access) to the network
-- Use your device for [remote access access to your home network](/manage/networks/use-cases/access-home-devices)
-- Use your device as an [exit node](/manage/network-routes/use-cases/exit-nodes#make-the-peer-an-exit-node-routing-peer)
+- Use your device for [remote access to your home network](/use-cases/remote-access/access-home-devices)
+- Use your device as an [exit node](/use-cases/remote-access/exit-nodes#make-the-peer-an-exit-node-routing-peer)
 

src/pages/get-started/install/index.mdx

@@ -21,6 +21,7 @@ The NetBird client (agent) allows a peer to join a pre-existing NetBird deployme
 * [Install on pfSense](/get-started/install/pfsense)
 * [Install on OPNSense](/get-started/install/opnsense)
 * [Install on OpenWrt](/get-started/install/openwrt)
+* [Install on MikroTik](/get-started/install/mikrotik)
 * [Install on Raspberry Pi](/get-started/install/raspberrypi)
 * [Install on Proxmox VE](/get-started/install/proxmox-ve)
 

src/pages/get-started/install/tvos.mdx

@@ -54,5 +54,5 @@ the SSO flow, after a few seconds the authentication dialog in the NetBird app w
 
 ## What's next?
 - Manage your device's [access](/manage/access-control/manage-network-access) to the network
-- Use your device for [remote access access to your home network](/manage/networks/use-cases/access-home-devices)
-- Use your device as an [exit node](/manage/network-routes/use-cases/exit-nodes#make-the-peer-an-exit-node-routing-peer)
+- Use your device for [remote access to your home network](/use-cases/remote-access/access-home-devices)
+- Use your device as an [exit node](/use-cases/remote-access/exit-nodes#make-the-peer-an-exit-node-routing-peer)

src/pages/introduction.mdx

@@ -61,7 +61,7 @@ It literally takes less than 5 minutes to deploy a secure point-to-point VPN wit
         'Learn how to provide secure access to LANs, VPS instances, and corporate private networks.',
     },
     {
-      href: '/manage/network-routes/use-cases/exit-nodes',
+      href: '/use-cases/remote-access/exit-nodes',
       name: 'Configure Default Routes',
       description: 'Set up default routes for internet traffic and configure exit nodes for your network.',
     },

src/pages/manage/dns/internal-dns-servers.mdx

@@ -21,7 +21,7 @@ This means the routing peer must be able to resolve the domain. If it can't —
 This covers ordinary name-to-IP lookups (**A/AAAA** records) for the resource's own domain. Two cases still need a nameserver configured on the client:
 
 - **Routing Peer DNS Resolution is disabled.** It's on by default, but can be turned off per account. With it off, the client resolves the name itself instead of asking the routing peer — so point the client at your internal DNS with a nameserver (or its network adapter's DNS).
-- **Active Directory.** A domain-joined client always needs a nameserver (`corp.example.com` → the DC), no matter how this setting is configured — see [Active Directory & Windows File Shares](/manage/networks/use-cases/active-directory).
+- **Active Directory.** A domain-joined client always needs a nameserver (`corp.example.com` → the DC), no matter how this setting is configured — see [Active Directory & Windows File Shares](/use-cases/remote-access/active-directory).
 </Note>
 
 To fix this, add the **routing peer's group** to the internal Nameserver's distribution groups — along with any client groups that resolve these names directly (Active Directory clients always do):
@@ -161,7 +161,7 @@ Before deleting a primary nameserver, create a new primary first, or peers will
 Active Directory (AD) environments have specific DNS requirements because Domain Controllers (DCs) run their own DNS services and rely on DNS for core AD functionality like domain joins, authentication, and service discovery.
 
 <Note>
-Setting up remote access to AD file shares, DFS, and domain login end to end? See the [Active Directory & Windows File Shares](/manage/networks/use-cases/active-directory) guide — it ties together the routing, DNS, and Kerberos pieces into a single setup. The sections below are the DNS reference behind it.
+Setting up remote access to AD file shares, DFS, and domain login end to end? See the [Active Directory & Windows File Shares](/use-cases/remote-access/active-directory) guide — it ties together the routing, DNS, and Kerberos pieces into a single setup. The sections below are the DNS reference behind it.
 </Note>
 
 ### Reaching a Domain Controller through a routing peer

src/pages/manage/dns/troubleshooting.mdx

@@ -470,7 +470,7 @@ A domain resource only resolves `A`/`AAAA` records. Active Directory also depend
 
 **Solutions**:
 
-- Add a **DNS nameserver** with match domain `corp.example.com` pointing at the DC's IP, distributed to your remote-users group — see [Active Directory & Windows File Shares → Give clients corp DNS](/manage/networks/use-cases/active-directory#step-5-give-clients-corp-dns).
+- Add a **DNS nameserver** with match domain `corp.example.com` pointing at the DC's IP, distributed to your remote-users group — see [Active Directory & Windows File Shares → Give clients corp DNS](/use-cases/remote-access/active-directory#step-5-give-clients-corp-dns).
 - Confirm the DC itself is reachable through the routing peer on the AD ports — see [Reaching a Domain Controller through a routing peer](/manage/dns/internal-dns-servers#reaching-a-domain-controller-through-a-routing-peer).
 
 ---

src/pages/manage/network-routes/index.mdx

@@ -4,7 +4,7 @@ import { Tiles } from '@/components/Tiles'
 # Routes
 
 <Warning>
-Routes are deprecated. Every use case except [exit nodes](/manage/network-routes/use-cases/exit-nodes) has moved to [Networks](/manage/networks). Use Networks for all new configurations. For a side-by-side comparison of the two models, see [How Routing Peers Work](/manage/networks/how-routing-peers-work).
+Routes are deprecated. Every use case except [exit nodes](/use-cases/remote-access/exit-nodes) has moved to [Networks](/manage/networks). Use Networks for all new configurations. For a side-by-side comparison of the two models, see [How Routing Peers Work](/manage/networks/how-routing-peers-work).
 </Warning>
 
 Routes let you route traffic from NetBird peers to private networks without installing the NetBird client on every device. A routing peer forwards packets between your NetBird mesh network and your internal networks (LANs, VPCs, data centers).
@@ -314,15 +314,15 @@ To prevent permission overflow, use dedicated Routing Peers for Routes and never
 </Note>
 
 <Tiles
-    title="Use Cases"
+    title="Guides"
     items={[
         {
             href: '/manage/network-routes/use-cases/site-to-site',
-            name: 'Site-to-Site',
+            name: 'Site-to-Site (legacy)',
             description: 'Connect two networks through routing peers at each end',
         },
         {
-            href: '/manage/network-routes/use-cases/exit-nodes',
+            href: '/use-cases/remote-access/exit-nodes',
             name: 'Exit Nodes',
             description: 'Route all internet traffic through a specific peer',
         },

src/pages/manage/network-routes/use-cases/site-to-site.mdx

@@ -5,7 +5,7 @@ import { Note, Warning } from '@/components/mdx'
 Site-to-Site connects two networks through routing peers at each end. Neither end-device needs NetBird installed — the routing peers forward traffic across the NetBird tunnel.
 
 <Warning>
-Routes are deprecated. For new site-to-site setups, use [Networks Site-to-Site](/manage/networks/use-cases/site-to-site) instead — it has per-Resource access control and is the actively developed system.
+Routes are deprecated. For new site-to-site setups, use [Networks Site-to-Site](/use-cases/remote-access/site-to-site) instead — it has per-Resource access control and is the actively developed system.
 
 Routes remains the only option when you need site-to-site without any Policy gating traffic — the legacy "wide open" mode with empty Access Control Groups. Networks requires at least one Policy per Resource and has no equivalent.
 </Warning>
@@ -22,7 +22,7 @@ Site A device ──► Routing Peer ──► NetBird Tunnel ──► Routing
 </div>
 
 <Note>
-For the reverse — clientless devices at a site initiating connections to NetBird peers — see [Site-to-VPN](/manage/networks/use-cases/site-to-vpn).
+For the reverse — clientless devices at a site initiating connections to NetBird peers — see [Site-to-VPN](/use-cases/remote-access/site-to-vpn).
 </Note>
 
 ## Prerequisites

src/pages/manage/networks/how-routing-peers-work.mdx

@@ -32,7 +32,7 @@ NetBird offers two ways to configure routing peers. Both are actively maintained
 **[Routes](/manage/network-routes) (legacy, deprecated)**
 - Distribution Groups and ACL Groups are configured separately.
 - ACL Groups are optional, which means a route without them grants unrestricted access to the destination CIDR for every peer in the Distribution Group.
-- Only needed today for [exit node](/manage/network-routes/use-cases/exit-nodes) setups. Use Networks for everything else, including [site-to-site](/manage/networks/use-cases/site-to-site).
+- Only needed today for [exit node](/use-cases/remote-access/exit-nodes) setups. Use Networks for everything else, including [site-to-site](/use-cases/remote-access/site-to-site).
 
 ## Mental model: how traffic flows
 
@@ -157,7 +157,7 @@ Every peer has two addresses — its **NetBird IP** (its `100.x` overlay address
   - a **peer-to-peer policy** (the input-chain accept), and
   - on userspace peers (Windows, macOS, Linux netstack), [`NB_ENABLE_LOCAL_FORWARDING`](#local-forwarding).
 
-For the full setup — the file-server scenario, the commands, the Active Directory tie-in, and a fallback for when you can't set the flag — see [Reach Services on the Routing Peer](/manage/networks/use-cases/reach-services-on-the-routing-peer).
+For the full setup — the file-server scenario, the commands, the Active Directory tie-in, and a fallback for when you can't set the flag — see [Reach Services on the Routing Peer](/use-cases/remote-access/reach-services-on-the-routing-peer).
 
 ### Directionality is forced for routed traffic
 
@@ -258,7 +258,7 @@ When a peer is `Connected` but a resource behind it is still unreachable, [Troub
             description: 'When to enable or disable source IP rewriting on a route',
         },
         {
-            href: '/manage/network-routes/use-cases/exit-nodes',
+            href: '/use-cases/remote-access/exit-nodes',
             name: 'Exit Nodes',
             description: 'Route all internet-bound traffic through a controlled location',
         },

src/pages/manage/networks/index.mdx

@@ -113,7 +113,7 @@ For the full kernel-level traffic walkthrough, host requirements (IP forwarding,
 </Note>
 
 <Note>
-"To the peer" has a further subtlety: a peer-to-peer policy reaches the routing peer at its **NetBird IP** (its `100.x` overlay address). To reach it at its **LAN IP** — e.g. clients resolve its name to that address — you also need a resource that covers that IP (the route), and on userspace peers `NB_ENABLE_LOCAL_FORWARDING`. See [Reaching the routing peer itself](/manage/networks/how-routing-peers-work#reaching-the-routing-peer-itself) and the [Reach Services on the Routing Peer](/manage/networks/use-cases/reach-services-on-the-routing-peer) use case.
+"To the peer" has a further subtlety: a peer-to-peer policy reaches the routing peer at its **NetBird IP** (its `100.x` overlay address). To reach it at its **LAN IP** — e.g. clients resolve its name to that address — you also need a resource that covers that IP (the route), and on userspace peers `NB_ENABLE_LOCAL_FORWARDING`. See [Reaching the routing peer itself](/manage/networks/how-routing-peers-work#reaching-the-routing-peer-itself) and the [Reach Services on the Routing Peer](/use-cases/remote-access/reach-services-on-the-routing-peer) use case.
 </Note>
 
 ## Walkthrough: access two internal apps
@@ -173,9 +173,9 @@ Before you depend on a Network in production, work through these:
 
 ## Networks or Network Routes?
 
-Networks is the default for **every** remote-access scenario: VPN-to-Site, [Site-to-Site](/manage/networks/use-cases/site-to-site) (two clientless networks reaching each other through a routing peer at each end), and [Site-to-VPN](/manage/networks/use-cases/site-to-vpn) (a clientless device initiating connections to your overlay network).
+Networks is the default for **every** remote-access scenario: VPN-to-Site, [Site-to-Site](/use-cases/remote-access/site-to-site) (two clientless networks reaching each other through a routing peer at each end), and [Site-to-VPN](/use-cases/remote-access/site-to-vpn) (a clientless device initiating connections to your overlay network).
 
-The only case that still requires [Routes](/manage/network-routes) is **[exit nodes](/manage/network-routes/use-cases/exit-nodes)**, which send a group's internet-bound traffic out through a chosen peer. For everything else, use Networks: it enforces access by default, while a Route without ACL Groups grants unrestricted access.
+The only case that still requires [Routes](/manage/network-routes) is **[exit nodes](/use-cases/remote-access/exit-nodes)**, which send a group's internet-bound traffic out through a chosen peer. For everything else, use Networks: it enforces access by default, while a Route without ACL Groups grants unrestricted access.
 
 ## Recap
 
@@ -195,30 +195,35 @@ Networks keep resources private to your overlay network. If you instead need to
     description="Apply what you've learned to a real setup"
     items={[
         {
-            href: '/manage/networks/use-cases/access-home-devices',
+            href: '/use-cases/remote-access/access-home-devices',
             name: 'Access Home Devices',
             description: 'Reach a home NAS, media server, or IoT devices from anywhere.',
         },
         {
-            href: '/manage/networks/use-cases/cloud-to-on-premise',
+            href: '/use-cases/remote-access/cloud-to-on-premise',
             name: 'Cloud to On-Premise',
             description: 'Connect cloud workloads to databases and services on-prem.',
         },
         {
-            href: '/manage/networks/use-cases/site-to-site',
+            href: '/use-cases/remote-access/site-to-site',
             name: 'Site-to-Site',
             description: 'Connect two networks so clientless devices on each can talk.',
         },
         {
-            href: '/manage/networks/use-cases/site-to-vpn',
+            href: '/use-cases/remote-access/site-to-vpn',
             name: 'Site-to-VPN',
             description: 'Let clientless devices initiate connections to your overlay network.',
         },
         {
-            href: '/manage/networks/use-cases/reach-services-on-the-routing-peer',
+            href: '/use-cases/remote-access/reach-services-on-the-routing-peer',
             name: 'Reach Services on the Routing Peer',
             description: 'Reach a file server or SMB/DFS share when the file server itself runs the NetBird client.',
         },
+        {
+            href: '/use-cases/remote-access/active-directory',
+            name: 'Active Directory & Windows File Shares',
+            description: 'Reach domain controllers and SMB shares from remote peers.',
+        },
     ]}
 />
 

src/pages/manage/peers/bootstrap-via-config-file.mdx

@@ -79,7 +79,7 @@ docker run -d --name netbird --cap-add=NET_ADMIN \
 
 ### Kubernetes
 
-Bake the config into a `ConfigMap`, source the setup key from a `Secret`, and mount both into the pod. Pair this with the liveness, readiness, and startup probes from [Deploy routing peers to a Kubernetes cluster](/use-cases/cloud/routing-peers-and-kubernetes) for a complete deployment.
+Bake the config into a `ConfigMap`, source the setup key from a `Secret`, and mount both into the pod. Pair this with the liveness, readiness, and startup probes from [Deploy routing peers to a Kubernetes cluster](/use-cases/kubernetes/routing-peers-and-kubernetes) for a complete deployment.
 
 ```yaml
 apiVersion: v1
@@ -150,7 +150,7 @@ For workloads where peers come and go — containers, autoscaling groups, sh
 netbird status --check startup && echo "registered" || echo "not registered yet"
 ```
 
-The Kubernetes example in [Deploy routing peers to a Kubernetes cluster](/use-cases/cloud/routing-peers-and-kubernetes#step-4-deploy-the-netbird-agent) wires all three checks into liveness, readiness, and startup probes — a good template for any container-based deployment.
+The Kubernetes example in [Deploy routing peers to a Kubernetes cluster](/use-cases/kubernetes/routing-peers-and-kubernetes#step-4-deploy-the-netbird-agent) wires all three checks into liveness, readiness, and startup probes — a good template for any container-based deployment.
 
 ### Parseable output
 

src/pages/manage/reverse-proxy/bring-your-own-proxy.mdx

@@ -83,7 +83,7 @@ Before you start, make sure you have:
 - A **domain you control** that you can point at the server. You will configure two `A` records: `proxy-domain` and `*.proxy-domain`.
 
 <Warning>
-    **Port 443 must be reachable from the public internet** for the default `tls-alpn-01` challenge. Let's Encrypt validates over port 443 with a special ALPN protocol. If your environment can't expose port 443 to Let's Encrypt's validation servers, switch to `http-01` (see [TLS configuration](#tls-configuration) below — that mode requires port 80 instead) or supply your own certificates. To run with **no public inbound ports at all**, issue certificates over DNS-01 and serve them statically — see [Private Proxy Without Public Inbound Ports](/manage/reverse-proxy/use-cases/private-no-inbound).
+    **Port 443 must be reachable from the public internet** for the default `tls-alpn-01` challenge. Let's Encrypt validates over port 443 with a special ALPN protocol. If your environment can't expose port 443 to Let's Encrypt's validation servers, switch to `http-01` (see [TLS configuration](#tls-configuration) below — that mode requires port 80 instead) or supply your own certificates. To run with **no public inbound ports at all**, issue certificates over DNS-01 and serve them statically — see [Private Proxy Without Public Inbound Ports](/use-cases/security/private-no-inbound).
 </Warning>
 
 ## Setup walkthrough
@@ -253,7 +253,7 @@ The most common adjustments:
 | Use Let's Encrypt with port 80 instead of port 443 | `NB_PROXY_ACME_CHALLENGE_TYPE=http-01` |
 | Provide your own certificate and key | unset `NB_PROXY_ACME_CERTIFICATES`, mount cert + key into `NB_PROXY_CERTIFICATE_DIRECTORY` (defaults: `tls.crt`, `tls.key`) |
 | Use a wildcard certificate for `*.proxy.company.com` | `NB_PROXY_WILDCARD_CERT_DIR=/certs/wildcard` |
-| Run with no public inbound ports (issue certs over DNS-01) | see [Private Proxy Without Public Inbound Ports](/manage/reverse-proxy/use-cases/private-no-inbound) |
+| Run with no public inbound ports (issue certs over DNS-01) | see [Private Proxy Without Public Inbound Ports](/use-cases/security/private-no-inbound) |
 
 ### Sharing certificates across replicas
 

src/pages/manage/reverse-proxy/index.mdx

@@ -201,7 +201,7 @@ If any of these requirements cannot be met in your environment, switch to the `h
 
 Static certificates support hot-reload through file watching. When the certificate or key file changes on disk, the proxy picks up the new files automatically without requiring a restart.
 
-Static mode is also how you run a proxy with **no public inbound ports**: issue the certificate out of band over the DNS-01 challenge and serve it here, so certificate issuance never needs port 80 or 443 exposed. See [Private Proxy Without Public Inbound Ports](/manage/reverse-proxy/use-cases/private-no-inbound).
+Static mode is also how you run a proxy with **no public inbound ports**: issue the certificate out of band over the DNS-01 challenge and serve it here, so certificate issuance never needs port 80 or 443 exposed. See [Private Proxy Without Public Inbound Ports](/use-cases/security/private-no-inbound).
 
 **Wildcard certificate mode** - Point the proxy at a directory containing wildcard certificate and key pairs. The proxy loads all certificates from the directory, matches them against incoming SNI hostnames, and serves the appropriate wildcard certificate automatically. This is useful when you have a wildcard certificate (e.g., `*.proxy.example.com`) that should cover all services under that domain. Configure with:
 

src/pages/manage/settings/ipv6.mdx

@@ -50,7 +50,7 @@ Access control policies apply to both IPv4 and IPv6 traffic. When a peer has an
 
 ### Exit Nodes
 
-When an exit node route (`0.0.0.0/0`) is configured and the peer supports IPv6, management automatically creates a matching `::/0` route. See [Exit Nodes](/manage/network-routes/use-cases/exit-nodes#ipv6-support) for details.
+When an exit node route (`0.0.0.0/0`) is configured and the peer supports IPv6, management automatically creates a matching `::/0` route. See [Exit Nodes](/use-cases/remote-access/exit-nodes#ipv6-support) for details.
 
 ### Network Routes
 

src/pages/use-cases/cloud/distributed-multi-cloud-ai.mdx

@@ -107,7 +107,7 @@ ingres:
     enabled: true
 ```
 
-To learn more please checkout the official docs on our [K8s Operator](/manage/integrations/kubernetes#using-helm).
+To learn more please checkout the official docs on our [K8s Operator](/use-cases/kubernetes#using-helm).
 
 ### Install ArgoCD
 
@@ -143,7 +143,7 @@ Next we will enable sidecars. **Why Sidecars?** The application controller needs
 
 To enable sidecar functionality in your deployments, you first need to generate a setup key, either via the UI (enable the **Ephemeral Peers** options) or by following [**this guide**](https://docs.netbird.io/manage/peers/register-machines-using-setup-keys) for more details on setup keys. We will inject side-cars to ArgoCD application controller so it can communicate with remote MicroK8s clusters.
 
-Note: We recommend checking out the section of our [Kubernetes Operator docs on using sidecars](/manage/integrations/kubernetes#accessing-remote-services-using-sidecars) for more context and detail.
+Note: We recommend checking out the section of our [Kubernetes Operator docs on using sidecars](/use-cases/kubernetes#accessing-remote-services-using-sidecars) for more context and detail.
 
 Next, you'll create a secret in Kubernetes and add a new resource called `NBSetupKey`. The `NBSetupKey` name can then be referenced in your deployments or daemon sets to specify which setup key should be used when injecting a sidecar into your application pods. Below is an example of a secret and an `NBSetupKey` resource:
 
@@ -689,8 +689,8 @@ curl https://mega-mesh.net/v1/completions \
 
 ### NetBird Resources
 
-- **Kubernetes Operator Deployment**: [/manage/integrations/kubernetes#deployment](/manage/integrations/kubernetes#deployment)
-- **Service Mesh Sidecars**: [/manage/integrations/kubernetes#accessing-remote-services-using-sidecars](/manage/integrations/kubernetes#accessing-remote-services-using-sidecars)
+- **Kubernetes Operator Deployment**: [/use-cases/kubernetes#deployment](/use-cases/kubernetes#deployment)
+- **Service Mesh Sidecars**: [/use-cases/kubernetes#accessing-remote-services-using-sidecars](/use-cases/kubernetes#accessing-remote-services-using-sidecars)
 
 ### ArgoCD Resources
 

src/pages/use-cases/cloud/index.mdx

@@ -8,63 +8,64 @@ Deploy NetBird across cloud environments to securely connect workloads, enable h
 
 - **Hybrid Cloud**: Connect cloud workloads to on-premise databases and services
 - **Multi-Cloud**: Bridge AWS, GCP, and Azure environments without exposing traffic to the internet
-- **Kubernetes**: Enable secure communication between clusters and external resources
 - **Serverless**: Run NetBird on FaaS platforms for ephemeral, secure connectivity
 - **Container Orchestration**: Deploy NetBird as a daemon set on ECS, EKS, or other container platforms
 
 ## Getting Started
 
-For connecting cloud VPCs to on-premise networks, see the [Site-to-Site Connectivity Guide](/use-cases/site-to-site).
+For connecting cloud VPCs to on-premise networks, see the [Remote Access overview](/use-cases/remote-access). For running NetBird inside Kubernetes, see the [Kubernetes guides](/use-cases/kubernetes).
 
 <Tiles
-    title="Guides"
-    items={[
-        {
-            href: '/use-cases/cloud/aws-ecs-terraform',
-            name: 'NetBird on AWS ECS',
-            description: 'Deploy NetBird as an ECS daemon set using Terraform',
-        },
-        {
-            href: '/use-cases/cloud/netbird-on-faas',
-            name: 'NetBird on Serverless (FaaS)',
-            description: 'Run NetBird on serverless platforms for ephemeral connectivity',
-        },
-        {
-            href: '/use-cases/cloud/routing-peers-and-kubernetes',
-            name: 'Routing Peers and Kubernetes',
-            description: 'Use routing peers to connect Kubernetes workloads to external networks',
-        },
-        {
-            href: '/use-cases/cloud/distributed-multi-cloud-ai',
-            name: 'Distributed Multi-Cloud AI',
-            description: 'Build distributed AI infrastructure across multiple clouds with ArgoCD and MicroK8s',
-        },
-        {
-            href: '/manage/networks/use-cases/cloud-to-on-premise',
-            name: 'Cloud to On-Premise Access',
-            description: 'Connect cloud workloads to on-premise databases and services',
-        },
-        {
-            href: '/manage/networks/use-cases/site-to-site',
-            name: 'Multi-Cloud Site-to-Site',
-            description: 'Bridge cloud VPCs across providers using Site-to-Site routing',
-        },
-    ]}
+  title="Guides"
+  items={[
+    {
+      href: '/use-cases/cloud/aws-ecs-terraform',
+      name: 'NetBird on AWS ECS',
+      description: 'Deploy NetBird as an ECS daemon set using Terraform',
+    },
+    {
+      href: '/use-cases/cloud/netbird-on-faas',
+      name: 'NetBird on Serverless (FaaS)',
+      description:
+        'Run NetBird on serverless platforms for ephemeral connectivity',
+    },
+    {
+      href: '/use-cases/cloud/distributed-multi-cloud-ai',
+      name: 'Distributed Multi-Cloud AI',
+      description:
+        'Build distributed AI infrastructure across multiple clouds with ArgoCD and MicroK8s',
+    },
+    {
+      href: '/use-cases/remote-access/cloud-to-on-premise',
+      name: 'Cloud to On-Premise Access',
+      description:
+        'Connect cloud workloads to on-premise databases and services',
+    },
+    {
+      href: '/use-cases/remote-access/site-to-site',
+      name: 'Multi-Cloud Site-to-Site',
+      description:
+        'Bridge cloud VPCs across providers using Site-to-Site routing',
+    },
+  ]}
 />
 
 ## Cloud Provider Considerations
 
 ### AWS
+
 - Use VPC endpoints where possible for AWS services
 - Security groups must allow traffic from NetBird routing peers
 - Consider Auto Scaling groups with static ENIs for high availability
 
 ### GCP
+
 - Enable IP forwarding on routing peer instances
 - Firewall rules must allow traffic from routing peer internal IPs
 - Use instance groups for redundancy
 
 ### Azure
+
 - Enable IP forwarding on routing peer NICs
 - Network security groups must allow routing peer traffic
 - Consider Virtual Machine Scale Sets for HA

src/pages/use-cases/homelab/index.mdx

@@ -14,23 +14,23 @@ NetBird helps homelabbers securely access their home infrastructure from anywher
 
 ## Getting Started
 
-For connecting entire home networks (accessing devices that don't have NetBird installed), see the [Site-to-Site Connectivity Guide](/use-cases/site-to-site).
+For connecting entire home networks (accessing devices that don't have NetBird installed), see the [Remote Access overview](/use-cases/remote-access).
 
 <Tiles
     title="Guides"
     items={[
         {
-            href: '/use-cases/homelab/client-on-mikrotik-router',
+            href: '/get-started/install/mikrotik',
             name: 'NetBird on MikroTik Router',
             description: 'Run NetBird directly on your MikroTik router for whole-network connectivity',
         },
         {
-            href: '/manage/networks/use-cases/access-home-devices',
+            href: '/use-cases/remote-access/access-home-devices',
             name: 'Access Home Devices',
             description: 'Set up VPN-to-Site access to reach home network devices from anywhere',
         },
         {
-            href: '/manage/networks/use-cases/site-to-site',
+            href: '/use-cases/remote-access/site-to-site',
             name: 'Connect Home Networks',
             description: 'Link multiple home networks together using Site-to-Site routing',
         },
@@ -48,5 +48,5 @@ For most homelabbers, we recommend:
 | Scenario | Recommended Feature |
 |----------|---------------------|
 | Access home devices from laptop/phone | [Networks](/manage/networks) |
-| Connect two home networks | [Networks](/manage/networks/use-cases/site-to-site) |
-| Run NetBird on router | [MikroTik Guide](/use-cases/homelab/client-on-mikrotik-router) |
+| Connect two home networks | [Networks](/use-cases/remote-access/site-to-site) |
+| Run NetBird on router | [MikroTik Guide](/get-started/install/mikrotik) |

src/pages/use-cases/index.mdx

@@ -1,31 +1,56 @@
-import { Tiles } from '@/components/Tiles'
+export const description =
+  'Find the NetBird guide for your scenario: remote access, site-to-site, cloud and Kubernetes deployments, security, and homelab setups.'
 
 # Use Cases
 
-Explore practical examples and guides for deploying NetBird across different environments and scenarios.
+You know what you want to achieve; this page finds the guide that gets you there. Scan for your scenario and jump straight in. If you are new to NetBird, start with the [quickstart](/get-started) first.
 
-<Tiles
-    title=""
-    items={[
-        {
-            href: '/use-cases/homelab',
-            name: 'Homelab',
-            description: 'Connect home networks, access NAS devices, and link family homes together',
-        },
-        {
-            href: '/use-cases/cloud',
-            name: 'Cloud',
-            description: 'Deploy NetBird on AWS, Kubernetes, serverless platforms, and multi-cloud environments',
-        },
-        {
-            href: '/use-cases/security',
-            name: 'Security',
-            description: 'Implement zero trust networking and secure access patterns',
-        },
-        {
-            href: '/use-cases/site-to-site',
-            name: 'Site-to-Site Connectivity',
-            description: 'Connect entire networks together for VPN-to-Site, Site-to-VPN, and Site-to-Site scenarios',
-        },
-    ]}
-/>
+## I want to...
+
+### Connect to remote networks and devices
+
+| I want to...                                            | Guide                                                                                             |
+| ------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
+| Understand which remote access scenario I need          | [Remote Access overview](/use-cases/remote-access)                                                |
+| Connect two networks (offices, homes, or clouds)        | [Site-to-Site with Networks](/use-cases/remote-access/site-to-site)                               |
+| Let clientless devices reach my NetBird peers           | [Site-to-VPN](/use-cases/remote-access/site-to-vpn)                                               |
+| Connect cloud workloads to on-premise services          | [Cloud to On-Premise](/use-cases/remote-access/cloud-to-on-premise)                               |
+| Reach my NAS and home devices from anywhere             | [Access Home Devices](/use-cases/remote-access/access-home-devices)                               |
+| Access services running on the routing peer itself      | [Reach Services on the Routing Peer](/use-cases/remote-access/reach-services-on-the-routing-peer) |
+| Route all my internet traffic through one peer          | [Exit Nodes](/use-cases/remote-access/exit-nodes)                                                 |
+| Reach Active Directory and Windows file shares remotely | [Active Directory & Windows File Shares](/use-cases/remote-access/active-directory)               |
+
+### Deploy NetBird in the cloud
+
+| I want to...                                   | Guide                                                                     |
+| ---------------------------------------------- | ------------------------------------------------------------------------- |
+| Deploy NetBird on AWS ECS with Terraform       | [NetBird on AWS ECS](/use-cases/cloud/aws-ecs-terraform)                  |
+| Run NetBird on serverless platforms            | [NetBird on Serverless (FaaS)](/use-cases/cloud/netbird-on-faas)          |
+| Build AI infrastructure across multiple clouds | [Distributed Multi-Cloud AI](/use-cases/cloud/distributed-multi-cloud-ai) |
+
+### Run NetBird in Kubernetes
+
+| I want to...                                     | Guide                                                                                   |
+| ------------------------------------------------ | --------------------------------------------------------------------------------------- |
+| Get started with the NetBird Kubernetes operator | [Getting Started](/use-cases/kubernetes)                                                |
+| Let my peers reach services in a cluster         | [Routing Peer](/use-cases/kubernetes/routing-peer)                                      |
+| Give a pod its own peer identity                 | [Client Sidecar](/use-cases/kubernetes/client-sidecar)                                  |
+| Operate a remote cluster with `kubectl`          | [API Server Proxy](/use-cases/kubernetes/api-server-proxy)                              |
+| Expose services through Gateway API CRDs         | [Gateway API](/use-cases/kubernetes/gateway-api)                                        |
+| Expose a single Kubernetes service end to end    | [Route to a Kubernetes Service](/use-cases/kubernetes/route-to-a-kubernetes-service)    |
+| Deploy routing peers to a cluster                | [Deploy Routing Peers to a Cluster](/use-cases/kubernetes/routing-peers-and-kubernetes) |
+
+### Secure my network
+
+| I want to...                                            | Guide                                                                         |
+| ------------------------------------------------------- | ----------------------------------------------------------------------------- |
+| Implement Zero Trust networking step by step            | [Implement Zero Trust](/use-cases/security/implement-zero-trust)              |
+| Publish internal services without opening inbound ports | [Private Proxy Without Inbound Ports](/use-cases/security/private-no-inbound) |
+
+### Run NetBird at home
+
+Homelabbers get a dedicated starting point covering NAS access, home automation, media servers, and connecting family networks: see the [Homelab guide](/use-cases/homelab). To run NetBird directly on your router, see the [MikroTik](/get-started/install/mikrotik), [OpenWrt](/get-started/install/openwrt), [pfSense](/get-started/install/pfsense), and [OPNsense](/get-started/install/opnsense) install guides.
+
+## Looking for feature documentation?
+
+These guides show how to accomplish a scenario end to end. For how each feature works and its configuration options, see [Manage NetBird](/manage/networks) — for example [Networks](/manage/networks), [Access Control](/manage/access-control), and the [Reverse Proxy](/manage/reverse-proxy).

src/pages/use-cases/kubernetes/index.mdx

@@ -53,14 +53,14 @@ The operator supports several ways to connect a cluster, and they answer **diffe
 
 | Pattern | Exposes | Identity | Reach it via | Best for |
 |---|---|---|---|---|
-| [NetworkRouter](/manage/integrations/kubernetes/routing-peer) | a `ClusterIP` Service | a shared routing peer | a DNS name in the NetworkRouter's zone (`service.namespace.<zone>`) | stable internal services (databases, APIs) that many peers reach |
-| [Client Sidecar](/manage/integrations/kubernetes/client-sidecar) | the pod itself | the pod becomes its own peer | the pod's overlay IP | workloads that need their own identity or per-pod access rules (ephemeral CI jobs, per-pod audit) |
-| [API Server Proxy](/manage/integrations/kubernetes/api-server-proxy) | the Kubernetes API | your NetBird user | `netbird kubernetes` + `kubectl` | operating remote clusters with `kubectl` |
-| [Gateway API](/manage/integrations/kubernetes/gateway-api) <Badge status="experimental" text="Beta" /> | Services via Gateway CRDs | a gateway routing peer | route hostname / overlay | teams standardizing on Gateway API CRDs |
+| [NetworkRouter](/use-cases/kubernetes/routing-peer) | a `ClusterIP` Service | a shared routing peer | a DNS name in the NetworkRouter's zone (`service.namespace.<zone>`) | stable internal services (databases, APIs) that many peers reach |
+| [Client Sidecar](/use-cases/kubernetes/client-sidecar) | the pod itself | the pod becomes its own peer | the pod's overlay IP | workloads that need their own identity or per-pod access rules (ephemeral CI jobs, per-pod audit) |
+| [API Server Proxy](/use-cases/kubernetes/api-server-proxy) | the Kubernetes API | your NetBird user | `netbird kubernetes` + `kubectl` | operating remote clusters with `kubectl` |
+| [Gateway API](/use-cases/kubernetes/gateway-api) <Badge status="experimental" text="Beta" /> | Services via Gateway CRDs | a gateway routing peer | route hostname / overlay | teams standardizing on Gateway API CRDs |
 
 ### Rules of thumb
 
-- **Default to a routing peer** for "let my peers reach a service in this cluster." One routing peer fronts many services and is the cheapest to operate — see the [Route to a Kubernetes service](/manage/integrations/kubernetes/use-cases/route-to-a-kubernetes-service) how-to, including how to run it highly available.
+- **Default to a routing peer** for "let my peers reach a service in this cluster." One routing peer fronts many services and is the cheapest to operate — see the [Route to a Kubernetes service](/use-cases/kubernetes/route-to-a-kubernetes-service) how-to, including how to run it highly available.
 - **Reach for a client sidecar** only when per-pod identity matters. The pod becomes a first-class peer: it can be reached directly *and* originate connections out onto the NetBird network as itself. That's why a sidecar — not a routing peer — is the answer when a workload needs to *initiate* traffic onto the overlay. The cost is one peer per pod, so it's more to manage than a shared gateway.
 - **A routing peer exposes in-cluster services to your peers; it does not give other pods in the cluster a path out onto the overlay.** If an in-cluster workload needs to reach the NetBird network, give that pod a sidecar.
 - **The API Server Proxy is orthogonal** — it's about *operating* the cluster, not reaching the apps inside it. Combine it with any of the others.

src/pages/use-cases/kubernetes/route-to-a-kubernetes-service.mdx

@@ -15,7 +15,7 @@ A NetBird client (for example, your laptop) reaches a private Kubernetes `Cluste
 ## Prerequisites
 
 - A Kubernetes cluster (multiple nodes recommended, so routing peers can spread across them).
-- The NetBird operator installed — see [Getting Started](/manage/integrations/kubernetes).
+- The NetBird operator installed — see [Getting Started](/use-cases/kubernetes).
 - A NetBird account and a [Personal Access Token](/manage/public-api#creating-a-service-user).
 - A NetBird client (the device that will reach the service) enrolled in your account.
 
@@ -90,7 +90,7 @@ kubectl apply -f networkrouter.yaml
 The operator registers all replicas in a single routing-peer group at one metric, so each client connects through its lowest-latency peer and fails over automatically if that peer becomes unreachable (the equal-metric behavior in [How Routing Peers Work — High availability](/manage/networks/how-routing-peers-work#high-availability)). When `replicas > 1`, it also creates a **PodDisruptionBudget** with `maxUnavailable: 1`, so node drains and rolling updates never take down more than one routing peer at a time.
 
 <Note>
-The operator already defaults to **3** replicas — set the field explicitly to be intentional, or raise it for more redundancy. See the [Routing Peer](/manage/integrations/kubernetes/routing-peer) page for the full `NetworkRouter` reference.
+The operator already defaults to **3** replicas — set the field explicitly to be intentional, or raise it for more redundancy. See the [Routing Peer](/use-cases/kubernetes/routing-peer) page for the full `NetworkRouter` reference.
 </Note>
 
 On a multi-node cluster, the operator spreads these replicas across nodes by default, so you already have node-level high availability: a node failure takes out only one routing peer and clients fail over to the rest.
@@ -176,7 +176,7 @@ kubectl -n netbird delete pod <routing-peer-pod>
 
 ## Next Steps
 
-- [Routing Peer](/manage/integrations/kubernetes/routing-peer) — the `NetworkRouter` / `NetworkResource` reference.
+- [Routing Peer](/use-cases/kubernetes/routing-peer) — the `NetworkRouter` / `NetworkResource` reference.
 - [How Routing Peers Work](/manage/networks/how-routing-peers-work) — failover, metrics, and access control.
 
 ## Appendix: Friendly DNS names

src/pages/use-cases/remote-access/access-home-devices.mdx

@@ -167,5 +167,5 @@ You can now access your home devices from anywhere.
 
 ## Next Steps
 
-- **Need Site-to-Site?** If you want to connect two home networks together, see [Site-to-Site](/manage/networks/use-cases/site-to-site)
+- **Need Site-to-Site?** If you want to connect two home networks together, see [Site-to-Site](/use-cases/remote-access/site-to-site)
 - **Advanced configuration:** See [Masquerade](/manage/networks/masquerade) for masquerade options and persistent return-route configuration

src/pages/use-cases/remote-access/active-directory.mdx

@@ -36,7 +36,7 @@ You rarely install the NetBird client on every server. Pick one of two shapes:
 - **A dedicated routing peer at the site.** A separate machine runs the NetBird client and routes to the DC and file servers across the LAN. Natural when shares are spread across several servers.
 - **The file server is the routing peer.** The NetBird client runs on the file server itself; the DC stays clientless behind it. Saves a machine, but on a Windows server it costs file-transfer performance (see the note below).
 
-Use a dedicated routing peer, and make it a **Linux machine**: a small VM next to the servers is enough. The rest of this guide assumes that. If the file server itself runs the client, only Step 2 changes (reach it via [Reach Services on the Routing Peer](/manage/networks/use-cases/reach-services-on-the-routing-peer) instead), while Steps 3–5 (routing the DC, its ports, and DNS) apply either way.
+Use a dedicated routing peer, and make it a **Linux machine**: a small VM next to the servers is enough. The rest of this guide assumes that. If the file server itself runs the client, only Step 2 changes (reach it via [Reach Services on the Routing Peer](/use-cases/remote-access/reach-services-on-the-routing-peer) instead), while Steps 3–5 (routing the DC, its ports, and DNS) apply either way.
 
 <Note>
 **Why Linux: performance.** A Linux routing peer forwards traffic in the kernel at almost no cost; Windows and macOS peers process every packet in userspace, which caps file-transfer throughput well below LAN speed and loads the machine (see [How Routing Peers Work](/manage/networks/how-routing-peers-work)). Running the client directly on a Windows file server adds an extra internal delivery step on top. If remote users report documents opening much slower over NetBird than in the office, this choice is the first thing to check.
@@ -47,7 +47,7 @@ Use a dedicated routing peer, and make it a **Linux machine**: a small VM next t
 - **If a separate machine is the routing peer**, each file server is an ordinary host behind it. You will need:
   - a Network resource — a `/32`, or a domain resource set to its FQDN (e.g. `fileserver1.corp.example.com`)
   - an access control policy from your remote-users group to it on **TCP 445** (or whatever the service requires)
-- **If the file server is the routing peer**, clients address it at its own LAN IP (the *self-access* case) — follow [Reach Services on the Routing Peer](/manage/networks/use-cases/reach-services-on-the-routing-peer).
+- **If the file server is the routing peer**, clients address it at its own LAN IP (the *self-access* case) — follow [Reach Services on the Routing Peer](/use-cases/remote-access/reach-services-on-the-routing-peer).
 
 If your DFS folders are spread across several file servers, route each one. Find the targets from a machine with the DFS Management tools (RSAT) installed:
 
@@ -162,6 +162,6 @@ The whole setup is these pieces — create each one and domain login, shares, an
 
 ## Related
 
-- [Reach Services on the Routing Peer](/manage/networks/use-cases/reach-services-on-the-routing-peer) — the self-access setup, for when the file server *is* the routing peer.
+- [Reach Services on the Routing Peer](/use-cases/remote-access/reach-services-on-the-routing-peer) — the self-access setup, for when the file server *is* the routing peer.
 - [How Routing Peers Work](/manage/networks/how-routing-peers-work) — forwarding, the two policy chains, and masquerade.
 - [Internal DNS Servers](/manage/dns/internal-dns-servers) — nameservers, Routing Peer DNS Resolution, and domain controllers.

src/pages/use-cases/remote-access/cloud-to-on-premise.mdx

@@ -136,7 +136,7 @@ volumes:
 
 **For Kubernetes:**
 
-Use the [NetBird Kubernetes Operator](/manage/integrations/kubernetes) for production deployments.
+Use the [NetBird Kubernetes Operator](/use-cases/kubernetes) for production deployments.
 
 ## Step 7: Verify Cloud Workload Group Assignment
 
@@ -216,5 +216,5 @@ Your cloud application can now securely access the on-premise database.
 
 ## Next Steps
 
-- **Need Multi-Cloud Site-to-Site?** If you need to connect cloud VPCs across providers, see [Site-to-Site](/manage/networks/use-cases/site-to-site)
+- **Need Multi-Cloud Site-to-Site?** If you need to connect cloud VPCs across providers, see [Site-to-Site](/use-cases/remote-access/site-to-site)
 - **Advanced configuration:** See [Masquerade](/manage/networks/masquerade) for masquerade options and persistent return-route configuration

src/pages/use-cases/remote-access/index.mdx

@@ -1,9 +1,9 @@
 import { Note } from '@/components/mdx'
 import { Tiles } from '@/components/Tiles'
 
-# Site-to-Site Connectivity
+# Remote Access
 
-Site-to-site connectivity allows you to connect entire networks together, enabling devices to communicate across locations without installing the NetBird client on every device.
+Remote access connects devices and entire networks across locations, without installing the NetBird client on every device.
 
 <Note>
 For the mental model — see [How Routing Peers Work — Networks vs Routes](/manage/networks/how-routing-peers-work#networks-vs-network-routes).
@@ -43,7 +43,7 @@ Office Server ──────► Routing Peer ──────► NetBird T
 - On-premise servers initiating backups to cloud peers
 - Legacy systems that must initiate outbound connections
 
-**Implementation:** See the [Site-to-VPN guide](/manage/networks/use-cases/site-to-vpn) for the full setup with [Networks](/manage/networks).
+**Implementation:** See the [Site-to-VPN guide](/use-cases/remote-access/site-to-vpn) for the full setup with [Networks](/manage/networks).
 
 ### Site-to-Site
 
@@ -59,7 +59,7 @@ Home NAS ──► Routing Peer ──► NetBird Tunnel ──► Routing Peer
 - Link home networks of family members
 - Bridge on-premise data centers with cloud VPCs
 
-**Implementation:** Use [Networks](/manage/networks/use-cases/site-to-site)
+**Implementation:** Use [Networks](/use-cases/remote-access/site-to-site)
 
 ### Exit Nodes
 
@@ -75,19 +75,20 @@ Your Laptop ──────► NetBird Tunnel ──────► Exit Node
 - Route traffic through a trusted network for compliance
 - Mask your location for privacy
 
-**Implementation:** Requires [Routes](/manage/network-routes/use-cases/exit-nodes)
+**Implementation:** See the [Exit Nodes guide](/use-cases/remote-access/exit-nodes) (uses [Routes](/manage/network-routes))
 
 ## Which Scenario Do I Need?
 
 | I want to... | Scenario | Feature to Use |
 |-------------|----------|----------------|
-| Access home devices from my laptop | VPN-to-Site | [Networks](/manage/networks/use-cases/access-home-devices) |
+| Access home devices from my laptop | VPN-to-Site | [Networks](/use-cases/remote-access/access-home-devices) |
 | Access office resources while traveling | VPN-to-Site | [Networks](/manage/networks) |
-| Let an office server connect to my laptop | Site-to-VPN | [Networks](/manage/networks/use-cases/site-to-vpn) |
-| Connect two home networks together | Site-to-Site | [Networks](/manage/networks/use-cases/site-to-site) |
-| Link branch offices | Site-to-Site | [Networks](/manage/networks/use-cases/site-to-site) |
-| Bridge cloud VPC with on-premise network | Site-to-Site | [Networks](/manage/networks/use-cases/site-to-site) |
-| Route all internet traffic through a specific peer | Exit Node | [Routes](/manage/network-routes/use-cases/exit-nodes) only |
+| Reach Active Directory and Windows file shares remotely | VPN-to-Site | [Networks](/use-cases/remote-access/active-directory) |
+| Let an office server connect to my laptop | Site-to-VPN | [Networks](/use-cases/remote-access/site-to-vpn) |
+| Connect two home networks together | Site-to-Site | [Networks](/use-cases/remote-access/site-to-site) |
+| Link branch offices | Site-to-Site | [Networks](/use-cases/remote-access/site-to-site) |
+| Bridge cloud VPC with on-premise network | Site-to-Site | [Networks](/use-cases/remote-access/cloud-to-on-premise) |
+| Route all internet traffic through a specific peer | Exit Node | [Routes](/use-cases/remote-access/exit-nodes) only |
 
 ## How It Works
 
@@ -102,15 +103,25 @@ All scenarios use a routing peer—a device running NetBird that forwards traffi
     title="VPN-to-Site Guides (Networks)"
     items={[
         {
-            href: '/manage/networks/use-cases/access-home-devices',
+            href: '/use-cases/remote-access/access-home-devices',
             name: 'Access Home Devices',
             description: 'Access your NAS, home automation, and media servers from anywhere',
         },
         {
-            href: '/manage/networks/use-cases/cloud-to-on-premise',
+            href: '/use-cases/remote-access/cloud-to-on-premise',
             name: 'Cloud to On-Premise',
             description: 'Connect cloud workloads to on-premise databases and services',
         },
+        {
+            href: '/use-cases/remote-access/active-directory',
+            name: 'Active Directory & Windows File Shares',
+            description: 'Reach domain controllers and SMB shares from remote peers',
+        },
+        {
+            href: '/use-cases/remote-access/reach-services-on-the-routing-peer',
+            name: 'Reach Services on the Routing Peer',
+            description: 'Access services running on the routing peer itself',
+        },
     ]}
 />
 
@@ -118,7 +129,7 @@ All scenarios use a routing peer—a device running NetBird that forwards traffi
     title="Site-to-Site Guides (Networks)"
     items={[
         {
-            href: '/manage/networks/use-cases/site-to-site',
+            href: '/use-cases/remote-access/site-to-site',
             name: 'Site-to-Site',
             description: 'Connect two networks (home, office, or cloud) through routing peers at each end',
         },
@@ -140,11 +151,11 @@ All scenarios use a routing peer—a device running NetBird that forwards traffi
 
 ## Networks vs Routes
 
-NetBird offers two ways to route traffic to private networks: [Networks](/manage/networks) (newer, recommended) and [Routes](/manage/network-routes) (original, now deprecated). Existing Routes configurations keep working, but every use case except [exit nodes](/manage/network-routes/use-cases/exit-nodes) has moved to Networks — use Networks for new setups.
+NetBird offers two ways to route traffic to private networks: [Networks](/manage/networks) (newer, recommended) and [Routes](/manage/network-routes) (original, now deprecated). Existing Routes configurations keep working, but every use case except [exit nodes](/use-cases/remote-access/exit-nodes) has moved to Networks — use Networks for new setups.
 
 **Use Networks** for all routing scenarios — VPN-to-Site, Site-to-VPN, and Site-to-Site — with a guided setup and per-resource access policies.
 
-**Use Routes** only for exit nodes, or to preserve source IPs by disabling masquerade.
+**Use Routes** only for exit nodes, or to preserve source IPs by disabling masquerade. The legacy [Site-to-Site with Routes](/manage/network-routes/use-cases/site-to-site) recipe remains available for existing setups.
 
 ### Scenario Support
 
@@ -169,4 +180,4 @@ NetBird offers two ways to route traffic to private networks: [Networks](/manage
 
 ### Future Direction
 
-The goal is to migrate all routing functionality into Networks for a unified experience. **Routes are now deprecated** — every use case except [exit nodes](/manage/network-routes/use-cases/exit-nodes) has moved to Networks, and existing Routes configurations continue to work. Use Networks for all new configurations.
+The goal is to migrate all routing functionality into Networks for a unified experience. **Routes are now deprecated** — every use case except [exit nodes](/use-cases/remote-access/exit-nodes) has moved to Networks, and existing Routes configurations continue to work. Use Networks for all new configurations.

src/pages/use-cases/remote-access/reach-services-on-the-routing-peer.mdx

@@ -16,7 +16,7 @@ Remote user ──tunnel──► File server = routing peer  (its own SMB/DFS s
 ```
 
 <Note>
-**Performance.** On a Linux service host this shape serves at full speed — a Linux file server or NAS can happily be its own routing peer. On Windows and macOS the client's data path runs in userspace, which limits file-transfer throughput; for busy shares on a Windows server, a dedicated Linux routing peer in front is the faster shape (see [Step 1 of the Active Directory guide](/manage/networks/use-cases/active-directory#step-1-decide-where-the-net-bird-client-runs)).
+**Performance.** On a Linux service host this shape serves at full speed — a Linux file server or NAS can happily be its own routing peer. On Windows and macOS the client's data path runs in userspace, which limits file-transfer throughput; for busy shares on a Windows server, a dedicated Linux routing peer in front is the faster shape (see [Step 1 of the Active Directory guide](/use-cases/remote-access/active-directory#step-1-decide-where-the-net-bird-client-runs)).
 </Note>
 
 ## The setup
@@ -37,7 +37,7 @@ Steps 1 and 3 exist only because clients reach the file server at its **LAN IP**
 
 With these in place, a mapped drive to the share works unchanged — reached at its LAN IP over the tunnel.
 
-**Domain-joined clients (AD/DFS)** need one more thing — a NetBird **DNS nameserver** for your AD domain. Add one with the match domain `corp.example.com` pointing at the DC's IP address (e.g. `10.0.0.10`), so clients resolve corp DNS and can log in. The DC must also be reachable over NetBird. See **[Active Directory & Windows File Shares](/manage/networks/use-cases/active-directory)** for the full setup.
+**Domain-joined clients (AD/DFS)** need one more thing — a NetBird **DNS nameserver** for your AD domain. Add one with the match domain `corp.example.com` pointing at the DC's IP address (e.g. `10.0.0.10`), so clients resolve corp DNS and can log in. The DC must also be reachable over NetBird. See **[Active Directory & Windows File Shares](/use-cases/remote-access/active-directory)** for the full setup.
 
 ## Verify
 

src/pages/use-cases/remote-access/site-to-site.mdx

@@ -18,7 +18,7 @@ Site A device ──► Routing Peer ──► NetBird Tunnel ──► Routing
 <Note>
 Networks is the recommended way to build site-to-site. It has per-Resource access control, is Zero Trust by default, and is the actively developed system.
 
-For the reverse — clientless devices at a site initiating connections to NetBird peers — see [Site-to-VPN](/manage/networks/use-cases/site-to-vpn).
+For the reverse — clientless devices at a site initiating connections to NetBird peers — see [Site-to-VPN](/use-cases/remote-access/site-to-vpn).
 </Note>
 
 ## Prerequisites
@@ -184,6 +184,6 @@ When the routing peer is a cloud instance, the VPC needs to allow it to forward
 ## Next steps
 
 - [Masquerade](/manage/networks/masquerade) — how source NAT works on routing peers
-- [Site-to-VPN](/manage/networks/use-cases/site-to-vpn) — clientless devices initiating connections to NetBird peers
-- [Access Home Devices](/manage/networks/use-cases/access-home-devices) — reach a single site from your NetBird peers
+- [Site-to-VPN](/use-cases/remote-access/site-to-vpn) — clientless devices initiating connections to NetBird peers
+- [Access Home Devices](/use-cases/remote-access/access-home-devices) — reach a single site from your NetBird peers
 - [Routes Site-to-Site](/manage/network-routes/use-cases/site-to-site) — legacy approach for scenarios that require source-IP preservation or Routes-specific behavior

src/pages/use-cases/security/index.mdx

@@ -30,6 +30,11 @@ NetBird is built on zero trust principles:
             name: 'Implement Zero Trust',
             description: 'Step-by-step guide to implementing zero trust networking with NetBird',
         },
+        {
+            href: '/use-cases/security/private-no-inbound',
+            name: 'Private Proxy Without Inbound Ports',
+            description: 'Publish internal services through a reverse proxy with no public inbound ports',
+        },
         {
             href: '/manage/access-control/posture-checks',
             name: 'Posture Checks',