diff --git a/.gitignore b/.gitignore
index 8337f3c..9be9e3f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -36,3 +36,5 @@ syncthing/config/
 portainer/data/
 filebrowser/database/
 filebrowser/config/
+.env.dev
+.dev/
diff --git a/README.md b/README.md
index f58884c..81f5f1f 100644
--- a/README.md
+++ b/README.md
@@ -151,6 +151,17 @@ ssh john@<tailscale-ip>
 
 See [docs/tailscale.md](docs/tailscale.md) for security recommendations and managing device access.
 
+## Diagnosing issues
+
+If something breaks after a deploy, collect logs from all running services:
+
+```bash
+./scripts/collect-logs.sh           # all services
+./scripts/collect-logs.sh jellyfin  # one service
+```
+
+The script outputs container status, recent errors, and the last 75 lines per service — useful context for debugging or sharing with Claude.
+
 ## Updating
 
 After pulling changes, run the update script to provision any new directories, pull fresh images, and restart only changed containers:
@@ -187,7 +198,8 @@ home-network/
 ├── scripts/
 │   ├── setup.sh                # initial setup
 │   ├── update.sh               # pull changes and redeploy
-│   └── post-setup.sh           # grab API keys after first run
+│   ├── post-setup.sh           # grab API keys after first run
+│   └── collect-logs.sh         # collect logs for debugging
 ├── pihole/
 │   └── etc-dnsmasq.d/
 │       └── 02-local-dns.conf   # wildcard DNS for *.woggles.work
diff --git a/scripts/collect-logs.sh b/scripts/collect-logs.sh
new file mode 100755
index 0000000..99cc07d
--- /dev/null
+++ b/scripts/collect-logs.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# collect-logs.sh — capture diagnostic info from the running stack
+#
+# Paste the output into Claude to diagnose deployment issues.
+#
+# Usage:
+#   ./scripts/collect-logs.sh           # all services
+#   ./scripts/collect-logs.sh jellyfin  # one service
+
+set -uo pipefail
+
+LINES=75
+FILTER="${1:-}"
+
+section() { printf "\n\n### %s\n\n" "$1"; }
+
+section "Stack status"
+docker compose ps
+
+section "Recent errors (all services)"
+docker compose logs --tail=300 --no-color 2>&1 \
+  | grep -iE '\b(err(or)?|warn(ing)?|fatal|panic|exception|failed)\b' \
+  | tail -60 \
+  || echo "(none found)"
+
+section "Service logs"
+services=(traefik homepage jellyfin portainer filebrowser syncthing wallabag pihole)
+for svc in "${services[@]}"; do
+  [[ -n "$FILTER" && "$FILTER" != "$svc" ]] && continue
+  printf "\n#### %s (last %d lines)\n\n" "$svc" "$LINES"
+  docker compose logs --tail="$LINES" --no-color "$svc" 2>&1 || true
+done
diff --git a/traefik/letsencrypt/acme.dev.json b/traefik/letsencrypt/acme.dev.json
new file mode 100644
index 0000000..e69de29