Visitor sign in kiosk: multi-site, badge printing, WWCC expiry warnings, admin accounts with 2FA

README.md

@@ -319,6 +319,28 @@ To back up: `docker compose stop && tar czf visitor-backup-$(date +%F).tar.gz da
 The kiosk returns to the home screen after two minutes of inactivity so the next visitor never
 sees the last one's details.
 
+## Troubleshooting
+
+**`pull access denied for visitor-signin`** — something ran `docker compose pull`. The image is
+built here, not fetched from a registry. Use `docker compose up -d --build`. The compose file
+sets `pull_policy: build` so this should not come back.
+
+**`EACCES: permission denied, mkdir '/data/photos'`** — the bind-mounted `./data` on the host is
+owned by root, and the app runs as an unprivileged user. The container's entrypoint fixes this
+itself on start; if you are on an older build, do it by hand:
+
+```bash
+sudo chown -R 1000:1000 data secrets
+docker compose up -d --build
+```
+
+**Changes to the code do nothing** — Compose reuses the existing image. Always
+`docker compose up -d --build` after a `git pull`.
+
+**Browser still warns about the certificate** — the authority is installed but not trusted. On
+iOS that is a second, separate step under Settings → General → About → Certificate Trust
+Settings. On Android, use a hostname rather than a bare IP.
+
 ## Running without Docker
 
 ```bash