docs

docs/SITE-SIDE.md

@@ -68,9 +68,13 @@ manually issued). Export the issuing CA chain as PEM →
 
 ## 6. Duo Admin Panel
 
-Applications → Protect an Application → **OpenVPN** (RADIUS). Copy the
-integration key, secret key, and API hostname into `.env`. Recommended
-policy: enrolled users only; new-user policy deny.
+Applications → Protect an Application → search **RADIUS** → Protect.
+(Not the "OpenVPN" catalog entry — that one is for Duo's server-side
+plugin, not the Auth Proxy `radius_server_auto` flow we use.) Copy the
+integration key, secret key, and API hostname into `.env` /
+`group_vars/vpnhub.yml`. Set username normalization to **Simple** so
+`user`, `DOMAIN\user`, and `user@domain` all map to one Duo user.
+Recommended policy: new-user policy deny (enrolled users only).
 
 ## 7. Public DNS