diff --git a/.gitea/workflows/netcheck.yml b/.gitea/workflows/netcheck.yml
new file mode 100644
index 0000000..3130b11
--- /dev/null
+++ b/.gitea/workflows/netcheck.yml
@@ -0,0 +1,21 @@
+# Diagnostic only: what can a job container reach? Run by hand (Run workflow). Changes nothing.
+name: netcheck
+on:
+  workflow_dispatch:
+jobs:
+  net:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Network facts from inside the job container
+        run: |
+          set +e
+          echo "--- identity"; hostname; cat /etc/resolv.conf
+          echo "--- addr/route/mtu"; (ip addr || cat /proc/net/dev) 2>&1 | head -30; ip route 2>&1 | head
+          echo "--- dns gitea"; getent hosts gitea.vps1.afterthedemo.com
+          echo "--- server url: ${{ github.server_url }}"
+          echo "--- curl gitea healthz"; curl -sS -m 20 -o /dev/null -w "http=%{http_code} connect=%{time_connect}s total=%{time_total}s ip=%{remote_ip}\n" https://gitea.vps1.afterthedemo.com/api/healthz
+          echo "--- curl gitea repo page"; curl -sS -m 30 -o /dev/null -w "http=%{http_code} size=%{size_download} total=%{time_total}s\n" https://gitea.vps1.afterthedemo.com/Ty_Tech/old-books
+          echo "--- git ls-remote (token)"; time git -c http.extraheader="AUTHORIZATION: basic $(printf 'x-access-token:%s' '${{ github.token }}' | base64 -w0)" ls-remote https://gitea.vps1.afterthedemo.com/Ty_Tech/old-books 2>&1 | head -5
+          echo "--- curl voice model-info"; curl -sS -m 20 -w "\nhttp=%{http_code} total=%{time_total}s\n" http://192.168.1.202:8090/api/model-info
+          echo "--- ping mtu probes to gitea"; for s in 1200 1400 1472; do curl -sS -m 15 -o /dev/null -w "post $s bytes: http=%{http_code}\n" -X POST --data-binary @<(head -c $s /dev/zero) https://gitea.vps1.afterthedemo.com/api/healthz; done