If my main Docker host died tomorrow, how fast could I rebuild it? For a long time the honest answer was “slowly, and from memory.” The fix is to treat the box’s configuration as code: every docker-compose.yml, Dockerfile, and config file committed to a private git repo, so reimaging is a git clone and a handful of docker compose up commands.

The trap is that a live Docker tree is a minefield of secrets — .env files, TLS private keys, API tokens hardcoded into compose files — and pushing any of them to GitHub, even a private repo, is a bell you can’t fully un-ring. This post is the repeatable procedure I landed on: what to commit, what to never commit, and the automated checks that keep the second category out.

Two things happened on the same day that looked like problems and weren’t — at least not the problems they appeared to be. My NAS was reporting almost all its RAM in use, which sounds like a leak or an imminent crash. And a TV show I’d grabbed through LunaSea on my phone had downloaded fine but then “wouldn’t import” into the library, which sounds like a broken automation pipeline.

Both are among the most common false alarms in a self-hosted media stack. Neither was what it looked like. Here’s what was actually going on, and the real fixes.

A while back I taught my house to announce the mail truck: Frigate spots a vehicle out front, a small service crops the snapshot and runs zero-shot CLIP against a list of text prompts, and if it decides “USPS truck” or “garbage truck,” Home Assistant says so out loud through Piper. That post ended on an optimistic note — a garbage truck scoring p_trash 0.995, and a line about how a labeled dataset for future tuning would “build itself from real events.”

This is the reckoning with that optimism.

Because the classifier worked, and then it would not shut up. 143 garbage-truck announcements in seven weeks, on a street where the garbage truck comes exactly once a week. The house had become the boy who cried wolf, and my family had — correctly — started ignoring it. This post is about actually fixing that: what 200 real detections showed, why the obvious fix is a trap, and the one idea worth stealing even if you never touch CLIP.