Common gotchas

A running list of “you’ll hit this once and forget why” notes. Add to it rather than re-debugging.

PowerDNS webserver password — no colons

PowerDNS’s webserver (auth API) silently breaks when the password contains a colon (:). The TCP listener still accepts the connection, but the admin UI / API auth fails with no useful error.

Why it matters: auto-generated passwords from password-vault-init draw from [33, 126) including : (ASCII 58). The pdns webserver field needs to avoid it.

Workaround: for the pdns_api_key and webserver fields in the vault-credential-setup TOML, either set a static = ... value (skipping the random generator) or post-process to strip colons. We’ve been lucky with re-rolls so far.