diff --git a/300 areas/360 Dev-Ops Network Computers/Backup System — Borg, Kopia & Restic.md b/300 areas/360 Dev-Ops Network Computers/Backup System — Borg, Kopia & Restic.md
index c2aaa75..c98d358 100644
--- a/300 areas/360 Dev-Ops Network Computers/Backup System — Borg, Kopia & Restic.md	
+++ b/300 areas/360 Dev-Ops Network Computers/Backup System — Borg, Kopia & Restic.md	
@@ -138,6 +138,24 @@ borg extract /mnt/ubuntu_storage_3TB/backup/borg/.13::<archive>
 
 **Restore:** see **[[Restore Runbook]]** (per-machine local + S3 steps; Deep Archive restore = hours).
 
+## Garage (local S3) — .13
+
+| Item | Detail |
+|---|---|
+| **Role** | Local S3-compatible object store (`family-home-lab` compose); used by portal/media apps |
+| **Version** | **v2.1.0** (upgraded from v1.0.1, 2026-09-05 — v1 wouldn't work with garage-webui; data auto-migrated on start, backup taken first) |
+| **S3 API** | `[::]:3900` (region `garage`) |
+| **S3 Web** | `[::]:3902` (vhost `.web.lab.audasmedia.com.au`, `index.html`) — ⚠️ **requires per-bucket auth; NOT anonymous static hosting** |
+| **Admin API** | `[::]:3903` (v2 endpoints `/v2/...`); token in `garage.toml`/`.env` |
+| **Web UI** | `garage-webui` container → port **3909**, published as `https://garage-ui.lab.audasmedia.com.au` (basic-auth `sam`) |
+| **Config** | `/home/sam/Docker/Containers/family-home-lab/garage/garage.toml` |
+| **Backup** | Bucket data = app data, included in `.13`/`.35` container backups per app; data+meta snapshot at `/mnt/data/family-home-lab/garage-backup-20260905-111241/` |
+
+### ⚠️ Garage S3-web gotcha (learned 2026-09-09)
+Garage's **S3 Web** (`:3902`) is **not** a drop-in anonymous static host. It rejects anonymous access (`403 Forbidden: Garage does not support anonymous access yet`) and needs **per-bucket web access + a read key**. For serving site images:
+- **Use the S3 API** (boto3/aws CLI with a read-scoped key) for uploads, and
+- **Serve images via the app / Caddy** (e.g. reverse-proxy to Garage with the read key, or a Caddy `file_server` dir) — do NOT expose `:3902` for anonymous browsing.
+
 ## Recent Changes
 
 - **2026-05-28**: Discovered My Passport (`/dev/vda1`, 1.8T) had all real data but was mounted at `/mnt/my_passport` instead of `/mnt/hd`. Remounted to `/mnt/hd`. Immich photos (40K) and all Docker service data recovered.