Status: Active | Owner: @roof | Updated: 2026-06-11
User – Troubleshooting
This page covers problems an end user (a peer) might hit. If you run a cell yourself and are looking for deeper system-level troubleshooting, see Admin – Monitor and Troubleshoot.
I can't reach the cell at all
Check 1 — Is the cell running?
Ask your admin to run make status from the cell server. The cell must be powered on and the containers must all show as running.
Check 2 — Are you using the right address?
Your admin should have given you an address such as https://myhome.pic.ngo. Make sure you are using exactly that address, including https://.
Check 3 — Is your internet working?
Try opening another site (for example, https://example.com). If that also fails, the problem is your own connection, not the cell.
Expected result: After your admin confirms the cell is running and you have a working internet connection, you should be able to reach the cell's login page.
The VPN won't connect
Check 1 — Do you have a configuration?
You need a WireGuard configuration file (.conf) or QR code from your admin. If you don't have one, ask your admin to add you as a peer.
Check 2 — Is the WireGuard app installed?
Follow the steps in User – Connect to the VPN to install and import the configuration.
Check 3 — Does the tunnel show "Active"?
Toggle the tunnel on in the WireGuard app. After a few seconds it should show "Active" with a recent "Last handshake" time. If the handshake time never updates, the cell's WireGuard port (default 51820/udp) may be blocked by your network or your admin's network.
Action: Tell your admin that the WireGuard handshake is not completing and ask them to check the cell's firewall settings.
Expected result: The WireGuard app shows "Active" and a handshake time within the last few minutes.
I get a certificate warning in my browser
A certificate warning means your browser does not trust the TLS certificate the cell is presenting.
If your admin uses lan mode (no public domain):
Your admin's cell uses an internal CA (certificate authority). You need to import the cell's CA certificate into your browser or operating system trust store. Ask your admin for the CA certificate file — they can download it from the Vault page in the admin dashboard.
If your admin uses pic.ngo, cloudflare, or duckdns mode:
The certificate should be automatically trusted. If you see a warning, the certificate may still be provisioning (wait a few minutes) or the cell's clock may be wrong. Ask your admin to check.
Expected result: After importing the CA certificate (or after the cert provisions), the browser shows a padlock with no warning.
I forgot my password
Your password is the one your admin set for your peer account when they added you to the cell.
Contact your admin. They can reset your password from the Peers page in the admin dashboard.
If you are the admin and forgot your own password, run this on the cell server:
# Run on: the cell server host, from /opt/pic
make show-admin-password
A service page won't load
For example, the email webmail page gives an error, or the calendar URL shows a blank page.
Check 1 — Is the service installed?
Ask your admin whether the service is installed and running. They can check from the Services page in the admin dashboard.
Check 2 — Are you connected to the VPN?
Some services are only reachable through the VPN. Try connecting to the VPN first.
Check 3 — Do you have an account on that service?
For email, calendar, and files, your admin must provision an account for you. Ask your admin to do this from the service's Accounts tab.
Expected result: After connecting to the VPN and confirming your account exists, the service page should load.
When to escalate to your admin
Contact your admin if:
- You cannot connect and you have verified your own internet is working.
- The WireGuard handshake is not completing.
- You see certificate errors and you don't know which domain mode the cell uses.
- A service exists but you have no account on it.
- You see error messages with HTTP status codes (500, 502, 503).
Provide your admin with: the exact URL you are trying to reach, the error message you see, and the name of your peer account.
Deeper: see Admin – Monitor and Troubleshoot
Personal Internet Cell
New here?
Users
User – Connect to the VPN User – Use Your Services User – Troubleshooting
Admins
Admin – Overview Admin – Install and First Run Admin – Configure Domains and TLS Admin – Manage Services Admin – Configure Connectivity Admin – Manage Peers Admin – Back Up and Restore Admin – Logging and Audit Admin – Monitor and Troubleshoot
Developers
Dev – Overview Dev – Architecture Dev – Build a Store Service Dev – Service Manifest Reference Dev – API Reference Dev – Testing Dev – Install Internals
Decisions (ADRs)
ADR – 001 Store Images Are Signed and Verified by Cells ADR – 002 Named Connection Instances for Connectivity ADR – 003 All Optional Functionality Ships as Store Services
Meta
Meta – Glossary Meta – Template Runbook Meta – Template ADR
Archive
Archive – User Guide Archive – ADR 004 The Wiki Is the Single Documentation Source