Finally turning on IPv6 at home
My provider has offered native IPv6 for years and I had it switched off on the router out of habit. Turning it on took an afternoon, most of it spent reading rather than typing.
Nearly everything simply worked. Phones and laptops picked up addresses, and the sites that support it started using it without anyone noticing.
The mistake
With address translation gone, every device has a globally routable address, so the firewall is the only thing between the network and the outside. My first ruleset allowed more inbound traffic than I intended. The fix was one default-deny line for forwarded inbound connections, plus explicit exceptions for the two services I actually publish.
The lesson is an old one: check from the outside, not from the couch.