diff --git a/.gitea/workflows/deploy-dev.yml b/.gitea/workflows/deploy-dev.yml
index 5ba42b6..b7ccf31 100644
--- a/.gitea/workflows/deploy-dev.yml
+++ b/.gitea/workflows/deploy-dev.yml
@@ -1,3 +1,10 @@
+# CI Workflow — see scripts/ci/README.md for DRY patterns
+# Shared patterns:
+#   checkout → setup → cache → install → test → build → deploy
+#   Cache keys: python-{md5sum} / node-{md5sum} (dev prefixes with python-dev/node-dev)
+#   Timeout: 600s for pip installs
+#   Image names: nas-dashboard:sha (main) / nas-dashboard-dev:sha (dev)
+
 name: Deploy Dashboard (Dev)
 on:
   push:
@@ -57,25 +64,25 @@ jobs:
               rm -rf venv
               python3 -m venv venv
               . venv/bin/activate
-              timeout 300 pip install --cache-dir=$PIP_CACHE_DIR --retries 3 --timeout 30 -r requirements.txt || \
-                timeout 300 pip install --cache-dir=$PIP_CACHE_DIR --index-url https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn -r requirements.txt || \
+              timeout 600 pip install --cache-dir=$PIP_CACHE_DIR --retries 3 --timeout 30 -r requirements.txt || \
+                timeout 600 pip install --cache-dir=$PIP_CACHE_DIR --index-url https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn -r requirements.txt || \
                 pip install -r requirements.txt
-              timeout 300 pip install --cache-dir=$PIP_CACHE_DIR --retries 3 --timeout 30 -r requirements-dev.txt || \
-                timeout 300 pip install --cache-dir=$PIP_CACHE_DIR --index-url https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn -r requirements-dev.txt || \
+              timeout 600 pip install --cache-dir=$PIP_CACHE_DIR --retries 3 --timeout 30 -r requirements-dev.txt || \
+                timeout 600 pip install --cache-dir=$PIP_CACHE_DIR --index-url https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn -r requirements-dev.txt || \
                 pip install -r requirements-dev.txt
-              timeout 300 pip install --cache-dir=$PIP_CACHE_DIR pytest-timeout || pip install pytest-timeout
+              timeout 600 pip install --cache-dir=$PIP_CACHE_DIR pytest-timeout || pip install pytest-timeout
             fi
           else
             echo "Installing fresh dependencies..."
             python3 -m venv venv
             . venv/bin/activate
-            timeout 300 pip install --cache-dir=$PIP_CACHE_DIR --retries 3 --timeout 30 -r requirements.txt || \
-              timeout 300 pip install --cache-dir=$PIP_CACHE_DIR --index-url https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn -r requirements.txt || \
+            timeout 600 pip install --cache-dir=$PIP_CACHE_DIR --retries 3 --timeout 30 -r requirements.txt || \
+              timeout 600 pip install --cache-dir=$PIP_CACHE_DIR --index-url https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn -r requirements.txt || \
               pip install -r requirements.txt
-            timeout 300 pip install --cache-dir=$PIP_CACHE_DIR --retries 3 --timeout 30 -r requirements-dev.txt || \
-              timeout 300 pip install --cache-dir=$PIP_CACHE_DIR --index-url https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn -r requirements-dev.txt || \
+            timeout 600 pip install --cache-dir=$PIP_CACHE_DIR --retries 3 --timeout 30 -r requirements-dev.txt || \
+              timeout 600 pip install --cache-dir=$PIP_CACHE_DIR --index-url https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn -r requirements-dev.txt || \
               pip install -r requirements-dev.txt
-            timeout 300 pip install --cache-dir=$PIP_CACHE_DIR pytest-timeout || pip install pytest-timeout
+            timeout 600 pip install --cache-dir=$PIP_CACHE_DIR pytest-timeout || pip install pytest-timeout
             echo "Saving venv to cache $CACHE_KEY..."
             cp -a venv $CACHE_DIR/ || echo "Warning: cache save failed"
           fi
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index ee92f6e..72e21fd 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -1,3 +1,10 @@
+# CI Workflow — see scripts/ci/README.md for DRY patterns
+# Shared patterns:
+#   checkout → setup → cache → install → test → build → deploy
+#   Cache keys: python-{md5sum} / node-{md5sum} (dev prefixes with python-dev/node-dev)
+#   Timeout: 600s for pip installs
+#   Image names: nas-dashboard:sha (main) / nas-dashboard-dev:sha (dev)
+
 name: Deploy Dashboard (Main)
 on:
   push:
diff --git a/docs/architecture.md b/docs/architecture.md
index 6ec2642..4eb1d09 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -98,3 +98,46 @@ Press `⌘K` (Mac) or `Ctrl+K` to fuzzy-search all sidebar items. New in July 20
 - ACLs override Unix perms — use `sudo chmod 777` + `synoacltool -enforce-inherit`
 - Docker at `/volume1/@appstore/ContainerManager/usr/bin/docker`
 - Tailscale userspace mode — cannot bind to Tailscale IP directly in Docker
+
+## Docker Networks
+
+### NAS Dashboard Networks
+
+| Network | Type | Used By | Purpose |
+|---|---|---|---|
+| `internal` | compose-defined | docker-socket-proxy, dashboard | Internal communication between dashboard containers |
+| `nas-dashboard_internal` | external (pre-created) | docker-socket-proxy, dashboard, dashboard-dev | Shared internal network for dashboard services |
+| `gitea_gitea` | external | dashboard, dashboard-dev | Connect dashboard to Gitea container |
+
+Note: `internal` network is redundant — both services are also on `nas-dashboard_internal`. Consider removing `internal` and consolidating to `nas-dashboard_internal` only.
+
+### Full NAS Network Inventory (all services)
+
+| Network | Service |
+|---|---|
+| `gitea_gitea` | Gitea |
+| `nas-dashboard_internal` | NAS Dashboard |
+| `internal` | NAS Dashboard (compose-defined) |
+| `authelia_auth` | Authelia |
+| `immich_immich` | Immich |
+| `jellyfin_default` | Jellyfin |
+| `audiobookshelf_default` | Audiobookshelf |
+| `calibre-web_default` | Calibre-Web |
+| `navidrome_default` | Navidrome |
+| `vaultwarden_default` | Vaultwarden |
+| `stirling-pdf_default` | Stirling PDF |
+| `n8n_default` | n8n |
+| `paperless_paperless` | Paperless |
+| `t-youtube_default` | t-youtube |
+| `watchtower_default` | Watchtower |
+| `dnsmasq_default` | DNS proxy |
+| `openclaw_default` | OpenClaw |
+| `openconnector_default` | OpenConnector |
+| `registry-mirror_default` | Registry mirror |
+| `speedtest_default` | Speedtest |
+| `metube_default` | MeTube |
+| `pixman_default` | Pixman |
+| `tmp_default` | Temporary services |
+| `bridge` | Docker default |
+| `host` | Docker host mode |
+| `none` | No networking |
diff --git a/scripts/ci/README.md b/scripts/ci/README.md
new file mode 100644
index 0000000..39d6538
--- /dev/null
+++ b/scripts/ci/README.md
@@ -0,0 +1,23 @@
+# CI Workflow Patterns (DRY Reference)
+#
+# All dashboard workflows follow this structure. Keep patterns consistent:
+#
+# --- Python Backend Tests ---
+#   Checkout → Setup Python → Cache Python → Install deps → Run tests
+#
+# --- Frontend Tests ---
+#   Checkout → Setup Node → Cache Node → Install deps → Run tests
+#
+# --- Build Image ---
+#   Checkout → Build & push to registry → Stream to NAS
+#
+# --- Deploy ---
+#   Checkout → Sync compose → Deploy → Health check → Smoke tests
+#
+# Cache key prefixes:
+#   deploy.yml (main):     python, node
+#   deploy-dev.yml (dev):  python-dev, node-dev
+#
+# Image names:
+#   deploy.yml (main):     nas-dashboard:${GITEA_SHA}
+#   deploy-dev.yml (dev):  nas-dashboard-dev:${GITEA_SHA}
diff --git a/scripts/ci/checkout.sh b/scripts/ci/checkout.sh
new file mode 100755
index 0000000..3738cdc
--- /dev/null
+++ b/scripts/ci/checkout.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+set -e
+if [ ! -d .git ]; then
+  git clone --depth=1 --branch "${GITHUB_REF_NAME:-main}" "http://100.78.131.124:3300/${GITHUB_REPOSITORY}.git" .
+fi