Repository navigation
Install on a Synology NAS, folder permission fixes, and proxy headers for a sign-in proxy - #305
Merged
Merged
Conversation
…fixes A new user on a Synology NAS hit folder permissions twice (the data folder, then the books) and found nothing in the docs about either. Now: - Install on a Synology NAS: Container Manager, the data folder created first, PUID/PGID from the DSM user (usually 1026/100), the share permissions for that user (not only a group), the log, updates. - The Docker quickstart creates the data folder before the first start, says the server needs read access to the books, has a docker run variant with PUID/PGID, and links Get the apps. - Troubleshooting has a permission-denied entry quoting the container's log lines, the start error and the share timeout line verbatim. - Backups: a backups folder on another disk, owned by the server's user, never a share mounted at /data/backups. - Set up your server: backups/ in the data folder list, NAS log pointers, and only a plain /admin visit opens the flow (a link opens its page). - Developer docs: the entrypoint's chown and checks, the launcher's start check, a backup's permission_denied detail, the unlistable library root, and the setup redirect's first-page rule. Part of #277.
The player can now send custom headers (a Cloudflare Access service token, say) to a server behind a sign-in proxy. The User Guide says how to add them on the connect screen before continuing or scanning, how to change them on the account page's Proxy headers card, that they need an https address, and what can't carry them (Chromecast, the watch apps, calendar apps, and in a browser covers, audio and other servers). The wording stays at "sent with requests to" the address: where a redirect takes them is not verified. Developer docs: storage and lifetime beside the token, the one-origin rule, the connect flow's pending set, the Account card's row and the cast block reason proxy. Part of KodeStar/audiosilo-frontend#167.
The account page now shows a Proxy headers card on every connection that isn't a demo. The capture server is plain http, so the card shows its https-only caption. Captured against the frontend's custom headers branch. Part of KodeStar/audiosilo-frontend#167.
…teps An https home address can be a proxy header set's address, so the pages no longer say it never gets them. The container's warning names a backups folder only when AUDIOSILO_BACKUP_DIR is set; the default one is the server's own backups will fail warning. The Synology steps are not yet checked on a NAS, so the page says so and the update step no longer names menu items nobody has seen. Part of #277.
…ypoint The server's own checks (the data folder probe, the backups warning, a library root it can't list) run on every install, not only under Docker, and outside a container the fix they print is not PUID and PGID. The section now says that, and the scanner and backups pages link to the server half instead of repeating its wording. Part of docs#277.
The Storage layers table is where the secrets kept in secure-store are listed, and it lacked audiosilo.proxy-headers.<connectionId>. The proxy headers section now links there for the native and web split. Part of fe#167.
Drop AUDIOSILO_WEB_DIR from the Synology compose file (the image sets it), fold the scan-after-typing note into the connect step it repeated, keep the NAS log-view links in one troubleshooting entry, and make a few sentences read plainly. Part of docs#277.
A demo account with a saved set sees the whole card, Change headers included, not only Remove. The remote access bullet no longer opens with "HTTPS only", the phrase the app keeps out of its own wording because what a redirect does with the headers is unverified. Part of fe#167.
The entrypoint runs the server as root when PUID is 0, so it can't say the server never does. Wrong IDs on Synology only show in the log once a folder refuses the user, since the entrypoint's chown usually succeeds. A recursive chmod on a DSM shared folder is replaced by its Shared Folder permissions. The Backups notice appears once a backup fails, not at start. The docker run example gets the restart policy the Compose file has, and the reason to create the data folder first now says why it matters. Part of docs#277.
KodeStar
added a commit
to KodeStar/audiosilo-frontend
that referenced
this pull request
Nov 14, 2026
…#294) Closes #167. For servers behind a sign-in proxy (Authelia, Authentik, Cloudflare Access service tokens and similar), a connection can carry custom HTTP headers that the proxy checks. ## What it does - **Entry:** a Proxy headers section on the connect screen (type the address and headers before Continue or a QR scan; pairing keeps them when the address matches) and a Proxy headers card on the Account page (pick the address, add, change, remove; a saved value is never shown again, "Kept as it is"). Strings in all 6 locales. - **Storage:** secure-store per connection (`audiosilo.proxy-headers.<id>`, the same place and keychain setting as the token; on the web, where the token also lives in localStorage). AsyncStorage holds only a `hasProxyHeaders` marker. Deleted wherever the token is; the identity migration copies with a read-back check and deletes the old entry only at clean-up. - **Scope:** sent with requests to the https address (scheme+host+port) the set was entered for, which may be the home address; never on a plain-http request, and not added to requests for other addresses. A 3xx to another origin is followed by the platform: on Android every stack sends the headers on to the new origin (drops Authorization); iOS unchecked (follow-up #295). Reserved names (Authorization, Cookie, Host, Range, Content-Type, X-AudioSilo-Client, framing headers) and control characters are refused. - **Where:** every API request; expo-image, the native players and the reader's EPUB download via `authHeaders()`; downloads, car and widget covers via `proxyHeadersFor(url)`. On the web only same-origin fetches carry them (`<img>`/`<audio>` rely on the proxy's browser sign-in). Not carried: Chromecast (cast refused, reason `proxy`), the watch apps, calendar apps. No server change. - **Sharing on one server:** a new connection (another person, a link re-pair with no set of its own) keeps the set that carried its successful sign-in or exchange; a reconnect with a known identity keeps only its own or the typed set. ## Tests and review New unit tests for storage, origin scoping, https rule, migration, reconnect/re-pair, hydrate clean-up, editor and card, and a locale test that refuses "nowhere else" style claims. Full gate green (559 suites, 7730 tests). Reviewed at the security level (two full /code-review passes) plus two fix rounds. ## Verified live (web, served player over https) Headers on 31/31 API requests to the origin after relaunch, none on covers or the stream (as documented), none to another origin even with CSP stripped; masked after save and absent from HTML, inputs and console; reserved names and control characters refused; http-only connection shows the https caption and no Add; Remove and sign-out clear storage; sign-in, browse and playback unchanged without headers. ## Verified on Android (Pixel 6a, release build, behind a header-checking https proxy) API (264/264 requests), expo-image covers, Media3 playback and downloads all carried the header and worked; without it the proxy refused and the app showed an error; an http address shows the https caption. A GET 302 to a second https origin: okhttp fetch, expo-image, downloads and Media3 all followed it and sent the custom header there, dropping Authorization. **Still owed (iOS device):** URLSession, SDWebImage covers, downloads, AVURLAsset, CarPlay cold start, the widget, and the same redirect check. Android Auto, notification artwork and the reader's EPUB download were not exercised. Docs: KodeStar/audiosilo-docs#305. Pairs with KodeStar/audiosilo-server#381 (same batch, independent).
KodeStar
added a commit
to KodeStar/audiosilo-site
that referenced
this pull request
Nov 14, 2026
A `draft: true` feature post, `nas-and-sign-in-proxy`, for the work merged in KodeStar/audiosilo-frontend#294 (proxy headers), KodeStar/audiosilo-server#381 (setup deep links, Docker permission failures that name the folder, the user and the fix) and KodeStar/audiosilo-docs#305 (Install on a Synology NAS, permission troubleshooting). Drafts are excluded from the build, so this can merge now; the 2.7.0 release publishes it. - Claims checked against the code on main and the docs (one review at high). It quotes the log text and console labels verbatim from the docs, scopes proxy headers to the one https address they were entered for, and covers Android passing them on through a redirect. - Before publishing: the iOS device run for proxy headers (fe#294) and a real NAS run (server#381) are still owed. The Synology steps were written for DSM 7.2 and the post says they have not been checked on a NAS. - Gate: `yarn build && yarn run check` green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Docs for v2.7.0 row 15b item 2 and row 15's custom headers.
docker runexample, and links Get the apps. Backups live indata/backups; a backups folder elsewhere needs the same owner and is never a share mounted at/data/backups.#permission-denied: quotes the container's warning lines, the start error, the "didn't answer within 5 seconds" line and the library offline line verbatim from the server's verified output./adminopens setup; the setup step's links open their page (server#365).proxy.detailfield, scanner offline rule, setup redirect rule.web-player/account.pngrecaptured with the Proxy headers card.Build green (links and anchors checked). Reviewed with /simplify and /code-review.
Merge after KodeStar/audiosilo-server#381 and KodeStar/audiosilo-frontend#294; before KodeStar/audiosilo-site#69 (its links point here).