# Gotchas & traps

Hard-won lessons, in plain English. (Full registry: `docs/LESSONS-LEARNED.md`.)

## Edge / DNS

- **If "everything is down," check pi4 first.** The edge lives there; a dead pi4 = all sites down.
- **Dual-A pins** — LAN pins now point at both `.2` and `.4`. Don't run old scripts that push single-IP pins.
- **`.7` hosts-file override** still pins to `.2` only — a known failover gap.

## Docker / services

- **`unless-stopped` won't restart a manually-stopped container** — a `docker stop` stays stopped until someone starts it (this bit books/calibre).
- **Bind-mount permissions** — containers running as a non-root uid (like authentik = 1000) fail if the mount is `root:root`. Chown the mount to the right uid.
- **qBit "invalid filter" returns EVERYTHING** — always validate filter values before a bulk action (this once purged a whole torrent client).
- **robocopy `/MIR` keeps stale files** — a "clean copy" that doesn't delete first can leave old files that break Node (stale `node_modules`).

## Windows quirks

- **PowerShell string-piping mangles base64** — push big files via a temp file + `Start-Process -RedirectStandardInput`.
- **Git Bash `flushdns` is MSYS-mangled** — use real PowerShell to flush DNS cache.
- **schannel curl** on Windows sometimes fails `SEC_E_INTERNAL_ERROR` — use `--ssl-no-revoke` or verify from a Linux host.

## Email

- **DMARC isn't published yet** for either domain (records drafted, pending Namecheap paste).

## Rules that never change

- Never put passwords/tokens in portal HTML or the wiki.
- The vault is the source of truth; the wiki mirrors it — never the reverse.