add blog

docs/network.md

@@ -94,6 +94,16 @@ Add a row here every time you point a new hostname at this cluster (see
 [`docs/11-ingress.md`](11-ingress.md)). The DNS record itself lives in
 Cloudflare, not in this repo — this table is just the log of what's real.
 
+## Planned hostname migrations (not yet verified live)
+
+- `https://blog.ahmza.com` → the `blog` Service in `blog-ahmza-com`, through
+  the existing ingress-nginx address `https://10.10.60.12`. Defined in
+  [`apps/blog-ahmza-com/ingress.yaml`](../apps/blog-ahmza-com/ingress.yaml).
+  Uses `letsencrypt-prod`; verify certificate issuance and update internal
+  DNS/external Caddy routing before cutover. No new MetalLB address is allocated.
+  Move this entry into the live hostname table only after verification. See
+  [`docs/13-blog-gitops.md`](13-blog-gitops.md) for the migration checklist.
+
 ## Free in the pool
 
 Addresses from the range above that aren't spoken for yet. Update this