# Gotchas & traps
Hard-won lessons, in plain English. (Full registry: `docs/LESSONS-LEARNED.md`.)
## Edge / DNS
- If “everything is down,” check pi4 first. The edge lives there; a dead pi4 = all sites down. - Dual-A pins — LAN pins now point at both `.2` and `.4`. Don't run old scripts that push single-IP pins. - `.7` hosts-file override still pins to `.2` only — a known failover gap.
## Docker / services
- `unless-stopped` won't restart a manually-stopped container — a `docker stop` stays stopped until someone starts it (this bit books/calibre). - Bind-mount permissions — containers running as a non-root uid (like authentik = 1000) fail if the mount is `root:root`. Chown the mount to the right uid. - qBit “invalid filter” returns EVERYTHING — always validate filter values before a bulk action (this once purged a whole torrent client). - robocopy `/MIR` keeps stale files — a “clean copy” that doesn't delete first can leave old files that break Node (stale `node_modules`).
## Windows quirks
- PowerShell string-piping mangles base64 — push big files via a temp file + `Start-Process -RedirectStandardInput`. - Git Bash `flushdns` is MSYS-mangled — use real PowerShell to flush DNS cache. - schannel curl on Windows sometimes fails `SEC_E_INTERNAL_ERROR` — use `–ssl-no-revoke` or verify from a Linux host.
- DMARC isn't published yet for either domain (records drafted, pending Namecheap paste).
## Rules that never change
- Never put passwords/tokens in portal HTML or the wiki. - The vault is the source of truth; the wiki mirrors it — never the reverse.