RDoc-4123 Document Windows/WSL LAN access

quill/dashboard/ip-configuration.mdx

@@ -22,7 +22,7 @@ import ContentFrame from '@site/src/components/ContentFrame';
   Follow the steps in [Change the IP](#change-the-ip) to generate and run the command on the Docker host.
 
 * For details about Quill's DNS records, DNS propagation, and moving to another host,
-  see [Networking & DNS](../networking-and-dns.mdx).
+  see [DNS & IP Configuration](../networking/dns-and-ip-configuration.mdx).
 
 ---
 
@@ -169,12 +169,12 @@ the generated command also updates `a.<domain>`. It updates these five DNS recor
 When the update succeeds, the command prints a confirmation that the records were registered.
 
 For details about these hostnames, DNS propagation, assigning IPv6 or multiple addresses,
-and handling a timeout, see [Networking & DNS](../networking-and-dns.mdx).
+and handling a timeout, see [DNS & IP Configuration](../networking/dns-and-ip-configuration.mdx).
 
 <Admonition type="note" title="">
 
 * Repointing the DNS records does not move your Quill's data.
-* If you are moving your Quill instance to another host, see [Moving to another host](../networking-and-dns.mdx#moving-to-another-host).
+* If you are moving your Quill instance to another host, see [Moving to another host](../networking/dns-and-ip-configuration.mdx#moving-to-another-host).
 
 </Admonition>
 
@@ -199,7 +199,7 @@ Seeing the new address confirms that it has reached the DNS resolver used by the
 Other callers may continue receiving the previous address until their cached DNS records expire.
 
 For details about DNS propagation and how to verify the update from outside the Quill container,  
-see [DNS propagation and TTL](../networking-and-dns.mdx#dns-propagation-and-ttl)
-and [Verify the change](../networking-and-dns.mdx#verify-the-change).
+see [DNS propagation and TTL](../networking/dns-and-ip-configuration.mdx#dns-propagation-and-ttl)
+and [Verify the change](../networking/dns-and-ip-configuration.mdx#verify-the-change).
 
 </Panel>

quill/developer-access/content/_ravendb-client-access-csharp.mdx

@@ -398,7 +398,7 @@ store.Conventions.DisableTopologyUpdates = true;
 ```
 <br/>
 
-For more information, see [The `a` hostname](../../networking-and-dns.mdx#the-a-hostname).
+For more information, see [The `a` hostname](../../networking/dns-and-ip-configuration.mdx#the-a-hostname).
 
 </Panel>
 
@@ -423,7 +423,7 @@ If the Quill deployment is unavailable, the RavenDB Client API cannot switch to
 
 If the Quill host moves to another IP address, update all Quill DNS records so that `db.<domain>`, `a.<domain>`,  
 and the other Quill hostnames resolve to the new address.
-See [Moving your Quill to a new IP](../../networking-and-dns.mdx#moving-your-quill-to-a-new-ip).
+See [Moving your Quill to a new IP](../../networking/dns-and-ip-configuration.mdx#moving-your-quill-to-a-new-ip).
 
 </Panel>
 

quill/developer-access/content/_ravendb-client-access-java.mdx

@@ -429,7 +429,7 @@ store.getConventions().setDisableTopologyUpdates(true);
 ```
 <br/>
 
-For more information, see [The `a` hostname](../../networking-and-dns.mdx#the-a-hostname).
+For more information, see [The `a` hostname](../../networking/dns-and-ip-configuration.mdx#the-a-hostname).
 
 </Panel>
 
@@ -454,7 +454,7 @@ If the Quill deployment is unavailable, the RavenDB Client API cannot switch to
 
 If the Quill host moves to another IP address, update all Quill DNS records so that `db.<domain>`, `a.<domain>`,  
 and the other Quill hostnames resolve to the new address.
-See [Moving your Quill to a new IP](../../networking-and-dns.mdx#moving-your-quill-to-a-new-ip).
+See [Moving your Quill to a new IP](../../networking/dns-and-ip-configuration.mdx#moving-your-quill-to-a-new-ip).
 
 </Panel>
 

quill/developer-access/content/_ravendb-client-access-nodejs.mdx

@@ -403,7 +403,7 @@ store.conventions.disableTopologyUpdates = true;
 ```
 <br/>
 
-For more information, see [The `a` hostname](../../networking-and-dns.mdx#the-a-hostname).
+For more information, see [The `a` hostname](../../networking/dns-and-ip-configuration.mdx#the-a-hostname).
 
 </Panel>
 
@@ -428,7 +428,7 @@ If the Quill deployment is unavailable, the RavenDB Client API cannot switch to
 
 If the Quill host moves to another IP address, update all Quill DNS records so that `db.<domain>`, `a.<domain>`,  
 and the other Quill hostnames resolve to the new address.
-See [Moving your Quill to a new IP](../../networking-and-dns.mdx#moving-your-quill-to-a-new-ip).
+See [Moving your Quill to a new IP](../../networking/dns-and-ip-configuration.mdx#moving-your-quill-to-a-new-ip).
 
 </Panel>
 

quill/developer-access/content/_ravendb-client-access-php.mdx

@@ -417,7 +417,7 @@ $store->getConventions()->setDisableTopologyUpdates(true);
 ```
 <br/>
 
-For more information, see [The `a` hostname](../../networking-and-dns.mdx#the-a-hostname).
+For more information, see [The `a` hostname](../../networking/dns-and-ip-configuration.mdx#the-a-hostname).
 
 </Panel>
 
@@ -442,7 +442,7 @@ If the Quill deployment is unavailable, the RavenDB Client API cannot switch to
 
 If the Quill host moves to another IP address, update all Quill DNS records so that `db.<domain>`, `a.<domain>`,  
 and the other Quill hostnames resolve to the new address.
-See [Moving your Quill to a new IP](../../networking-and-dns.mdx#moving-your-quill-to-a-new-ip).
+See [Moving your Quill to a new IP](../../networking/dns-and-ip-configuration.mdx#moving-your-quill-to-a-new-ip).
 
 </Panel>
 

quill/developer-access/content/_ravendb-client-access-python.mdx

@@ -387,7 +387,7 @@ store.conventions.disable_topology_updates = True
 ```
 <br/>
 
-For more information, see [The `a` hostname](../../networking-and-dns.mdx#the-a-hostname).
+For more information, see [The `a` hostname](../../networking/dns-and-ip-configuration.mdx#the-a-hostname).
 
 </Panel>
 
@@ -412,7 +412,7 @@ If the Quill deployment is unavailable, the RavenDB Client API cannot switch to
 
 If the Quill host moves to another IP address, update all Quill DNS records so that `db.<domain>`, `a.<domain>`,  
 and the other Quill hostnames resolve to the new address.
-See [Moving your Quill to a new IP](../../networking-and-dns.mdx#moving-your-quill-to-a-new-ip).
+See [Moving your Quill to a new IP](../../networking/dns-and-ip-configuration.mdx#moving-your-quill-to-a-new-ip).
 
 </Panel>
 

quill/getting-started/signing-up.mdx

@@ -24,7 +24,7 @@ for Quill to an AI agent answering your users through your first channel: a web
 
    <Admonition type="info" title="">
 
-   * A [Quill domain](../networking-and-dns.mdx#quill-dns-records) is a web address that your Quill deployment can be reached at.
+   * A [Quill domain](../networking/dns-and-ip-configuration.mdx#quill-dns-records) is a web address that your Quill deployment can be reached at.
    * A [license key](#saving-your-setup-details) activates Quill.
    * An [API key](../security-and-architecture/operator-authentication.mdx#the-dashboard-api-key) signs you into the deployment's
      management dashboard.
@@ -199,7 +199,7 @@ All the details that are displayed here are also sent to the email address you p
    adding an agent.
 
 5. **If your server IP changes**  
-   The command that [re-registers the domain](../networking-and-dns.mdx#moving-your-quill-to-a-new-ip) with a new address.  
+   The command that [re-registers the domain](../networking/dns-and-ip-configuration.mdx#moving-your-quill-to-a-new-ip) with a new address.  
    Run it on the machine that hosts Quill.
 
 6. **Done**  

quill/getting-started/starting-quill.mdx

@@ -46,6 +46,8 @@ Before starting Quill, make sure you have:
 
 * **Docker**, on the machine that will run Quill, at the public IP address you gave at sign-up.
    * Docker Desktop on Windows and macOS, or Docker Engine on Linux.
+   * On Windows, Docker Desktop runs Quill in WSL 2 by default, where other devices on your network may be unable to reach Quill.
+     Learn more in [LAN Access on Windows](../networking/lan-access-on-windows.mdx).
 * **Port 443 available** on Quill's machine.
    * The dashboard, the API, and the chat channels of your deployment are all
      [served on this one port](../security-and-architecture/network-architecture.mdx#how-a-connection-is-routed).
@@ -128,6 +130,8 @@ Quill reports its progress in the terminal you ran the Docker command in, one li
 elapsed since the container started.  
 The first run is longer, since Quill also fetches the certificate and configuration for your domain.
 
+For example, on a Linux host running Docker Engine directly:
+
 ```
   Logs:      /var/lib/quill/logs/{ravendb,web,proxy,certwatch}.log
 2026-08-26 10:23:42  Sharpening the quill... (5s)
@@ -144,6 +148,9 @@ The first run is longer, since Quill also fetches the certificate and configurat
 * **Dashboard**: this is where you sign in to manage Quill.
 * **Database**: reaches the RavenDB server inside the container, allowing you to
   [read the mirrored data directly](../security-and-architecture/network-architecture.mdx#direct-database-access).
+* **Note**: appears only when Quill runs in WSL 2, e.g., on Docker Desktop for Windows.  
+  It warns that other devices on your network may be unable to reach Quill, and links to
+  [LAN Access on Windows](../networking/lan-access-on-windows.mdx).
 
 </ContentFrame>
 

quill/home.mdx

@@ -94,10 +94,10 @@ import CardWithIcon from "@site/src/components/Common/CardWithIcon";
         url="/quill/dashboard/my-apps"
     />
     <CardWithIcon
-        title="Networking & DNS"
+        title="DNS & IP Configuration"
         icon="server-topology"
         description="The DNS records created for your Quill, what they point at, and how to repoint them when your IP changes."
-        url="/quill/networking-and-dns"
+        url="/quill/networking/dns-and-ip-configuration"
     />
     <CardWithIcon
         title="Updating Quill"

quill/networking/_category_.json

@@ -0,0 +1,4 @@
+{
+    "position": 6,
+    "label": "Networking"
+}

quill/networking-and-dns.mdx → quill/networking/dns-and-ip-configuration.mdx

@@ -1,13 +1,12 @@
 ---
-title: "Networking & DNS"
-sidebar_label: "Networking & DNS"
+title: "DNS & IP Configuration"
+sidebar_label: "DNS & IP Configuration"
 description: "The DNS records created for your Quill instance, what they point at, and how to repoint them when your server's IP address changes."
-sidebar_position: 6
+sidebar_position: 1
 ---
 
 import Admonition from '@theme/Admonition';
 import Panel from '@site/src/components/Panel';
-import ContentFrame from '@site/src/components/ContentFrame';
 
 <Admonition type="note" title="">
 
@@ -20,6 +19,9 @@ import ContentFrame from '@site/src/components/ContentFrame';
 * This article explains the DNS names associated with a Quill instance, what DNS controls,  
   and how to update and verify the published records after the host's IP address changes.
 
+* If Quill runs on Docker Desktop or WSL on Windows, other devices on your network may be unable to reach it.  
+  [LAN Access on Windows](lan-access-on-windows.mdx) explains how to allow them.
+
 * In this article:
   * [Quill DNS records](#quill-dns-records)
     * [The published hostnames](#the-published-hostnames)  
@@ -69,9 +71,9 @@ The first four hostnames expose Quill's customer-facing service surfaces.
 Quill does not publish corresponding `-tcp` records.  
 Direct RavenDB access through `db.<domain>` or a topology-discovered `a.<domain>` address uses HTTPS on port `443`;  
 the native RavenDB TCP listener is not exposed by default.
-Learn more in [Direct database access](security-and-architecture/network-architecture.mdx#direct-database-access).
+Learn more in [Direct database access](../security-and-architecture/network-architecture.mdx#direct-database-access).
 
-For details about how connections to these hostnames are routed and protected, see [The Quill hostnames](security-and-architecture/network-architecture.mdx#the-quill-hostnames).
+For details about how connections to these hostnames are routed and protected, see [The Quill hostnames](../security-and-architecture/network-architecture.mdx#the-quill-hostnames).
 
 The behavior of the RavenDB node hostname is described in [The `a` hostname](#the-a-hostname).
 
@@ -104,7 +106,7 @@ As a result, communication between Quill and RavenDB remains on loopback without
 * DNS updates include `a.<domain>` together with the other four records.
 
 For more information about direct RavenDB connections and your Quill's network limitations,  
-see [Direct database access](security-and-architecture/network-architecture.mdx#direct-database-access).
+see [Direct database access](../security-and-architecture/network-architecture.mdx#direct-database-access).
 
 </Panel>
 
@@ -146,9 +148,9 @@ The host's firewall, cloud security rules, and any intervening NAT configuration
 DNS and TLS are separate as well. DNS points a hostname to an address, while the wildcard certificate for your Quill proves the identity of that hostname. Changing the address behind a hostname does not change the hostname itself.
 
 For the complete routing and TLS model, see
-[How a connection is routed](security-and-architecture/network-architecture.mdx#how-a-connection-is-routed) and
-[The TLS front and the wildcard certificate](security-and-architecture/network-architecture.mdx#the-tls-front-and-the-wildcard-certificate).  
-For dashboard and API authentication, see [Operator Authentication](security-and-architecture/operator-authentication.mdx).
+[How a connection is routed](../security-and-architecture/network-architecture.mdx#how-a-connection-is-routed) and
+[The TLS front and the wildcard certificate](../security-and-architecture/network-architecture.mdx#the-tls-front-and-the-wildcard-certificate).  
+For dashboard and API authentication, see [Operator Authentication](../security-and-architecture/operator-authentication.mdx).
 
 </Panel>  
 
@@ -205,8 +207,8 @@ The Quill domain and the URLs used by operators, chat users, and applications re
 Repointing the DNS records therefore does not require a new domain, new URLs, a new wildcard certificate,  
 or a different Dashboard API key.
 
-For details about the wildcard certificate, see [The TLS front and the wildcard certificate](security-and-architecture/network-architecture.mdx#the-tls-front-and-the-wildcard-certificate).  
-For information about preserving or replacing the Dashboard API key, see [Operator Authentication](security-and-architecture/operator-authentication.mdx).
+For details about the wildcard certificate, see [The TLS front and the wildcard certificate](../security-and-architecture/network-architecture.mdx#the-tls-front-and-the-wildcard-certificate).  
+For information about preserving or replacing the Dashboard API key, see [Operator Authentication](../security-and-architecture/operator-authentication.mdx).
 
 <Admonition type="warning" title="">
 
@@ -401,7 +403,7 @@ If your deployment uses the other surfaces, verify them through their normal acc
   * open an existing embed link through `public.<domain>`;
   * connect to `db.<domain>` with a recognized client certificate.
 
-For the requirements of a direct RavenDB connection, see [Direct database access](security-and-architecture/network-architecture.mdx#direct-database-access).  
+For the requirements of a direct RavenDB connection, see [Direct database access](../security-and-architecture/network-architecture.mdx#direct-database-access).  
 If any verification step fails, continue with [Diagnose failures](#diagnose-failures).
 
 </Panel>
@@ -416,11 +418,12 @@ Use the point at which verification fails to identify the affected layer:
 | A hostname does not resolve | The hostname or base domain is incorrect, the record was not provisioned, or a resolver cached an earlier "not found" response | Compare the hostname with the `PublicServerUrl` in the activated setup package. If the hostname was recently provisioned, wait up to 15 minutes for the cached response to expire, then resolve it again |
 | A hostname still resolves to the old address | The answer is cached or the update has not completed | Allow for the TTL, then resolve all five hostnames again |
 | The hostname resolves correctly, but the connection times out | External TCP port `443` is blocked or does not reach container port `443` | Check the firewall, cloud security rules, NAT or load-balancer forwarding, and Docker port mapping |
+| Other devices cannot connect, although the hostname resolves to the LAN address of the Windows machine running Quill | WSL's default networking mode or a firewall may be preventing LAN access to Quill | Check port publishing, firewalls, and WSL networking, as described in [LAN Access on Windows](lan-access-on-windows.mdx) |
 | The hostname resolves correctly, but the connection is refused | The container is stopped or nothing is accepting the forwarded connection | Check the container state and Docker port mapping |
 | HTTPS reports a certificate error | The certificate is expired, invalid, or does not cover the requested hostname | Inspect the certificate and certificate-renewal logs |
 | `/healthz` returns an unsuccessful response | The Quill web application or RavenDB is not ready | Check bootstrap status and the Quill logs |
-| `/healthz` succeeds, but the dashboard or API returns `401` | The DNS change succeeded, but the expected Dashboard API key was not preserved | Check `QUILL_API_KEY` and see [Operator Authentication](security-and-architecture/operator-authentication.mdx) |
-| Dashboard health succeeds, but `db.<domain>` connections fail | DNS and the web surface are working; investigate the client certificate and RavenDB connection separately | See [Direct database access](security-and-architecture/network-architecture.mdx#direct-database-access) |
+| `/healthz` succeeds, but the dashboard or API returns `401` | The DNS change succeeded, but the expected Dashboard API key was not preserved | Check `QUILL_API_KEY` and see [Operator Authentication](../security-and-architecture/operator-authentication.mdx) |
+| Dashboard health succeeds, but `db.<domain>` connections fail | DNS and the web surface are working; investigate the client certificate and RavenDB connection separately | See [Direct database access](../security-and-architecture/network-architecture.mdx#direct-database-access) |
 
 ---
 
@@ -525,10 +528,10 @@ docker exec <container-name> tail -n 100 \
 ```
 <br/>
 
-For general guidance on reading and following log files, see [Read a log file](logging.mdx#read-a-log-file).  
-For certificate behavior and renewal, see [The TLS front and the wildcard certificate](security-and-architecture/network-architecture.mdx#the-tls-front-and-the-wildcard-certificate).  
-For dashboard and API authorization failures, see [Operator Authentication](security-and-architecture/operator-authentication.mdx).  
-For client-certificate requirements, see [Direct database access](security-and-architecture/network-architecture.mdx#direct-database-access).  
+For general guidance on reading and following log files, see [Read a log file](../logging.mdx#read-a-log-file).  
+For certificate behavior and renewal, see [The TLS front and the wildcard certificate](../security-and-architecture/network-architecture.mdx#the-tls-front-and-the-wildcard-certificate).  
+For dashboard and API authorization failures, see [Operator Authentication](../security-and-architecture/operator-authentication.mdx).  
+For client-certificate requirements, see [Direct database access](../security-and-architecture/network-architecture.mdx#direct-database-access).  
 
 </Panel>