diff --git a/docs-developers/architecture/release-pipeline.md b/docs-developers/architecture/release-pipeline.md
index 94e5051e..bf796f92 100644
--- a/docs-developers/architecture/release-pipeline.md
+++ b/docs-developers/architecture/release-pipeline.md
@@ -107,7 +107,9 @@ The multi-stage `Dockerfile`:
   with `ARG WEB_IMAGE=ghcr.io/kodestar/audiosilo-web:latest`;
 - uses `alpine:3.24` for the final stage, with **ffmpeg installed from apk**.
   Unlike the native binaries, the Docker image does bundle ffmpeg. The stage also
-  has a `PUID` and `PGID` entrypoint and presets `AUDIOSILO_WEB_DIR=/app/web`.
+  has a `PUID` and `PGID` entrypoint, which gives that user its folders and checks
+  them (see [Folder permissions](../server/configuration.md#under-docker)),
+  and presets `AUDIOSILO_WEB_DIR=/app/web`.
 
 Because the image pins one specific web build, the server and its bundled player
 always ship as a **known-compatible pair**. Native apps talking to any server
diff --git a/docs-developers/contributing/documentation.md b/docs-developers/contributing/documentation.md
index d689718a..bdc8377a 100644
--- a/docs-developers/contributing/documentation.md
+++ b/docs-developers/contributing/documentation.md
@@ -120,6 +120,7 @@ mappings:
 | `pkg/query`, `pkg/query/querytest`, `pkg/release` in audiosilo-meta, or the artifact schema | [meta/overview.md](../meta/overview.md#public-go-packages) + [meta/data-model.md](../meta/data-model.md#the-compiled-artifact-and-schema-versioning) + the [cross-repo contract](../architecture/cross-repo-contract.md#13-community-metadata-a-three-repo-seam) (mirror-mode servers read the artifact directly) |
 | Meta schemas, `metaserve` API, or intake tooling (`route.yml`, the intake denylist included) | [meta developer pages](../meta/overview.md) (data model, API, contributing) - and the [cross-repo contract](../architecture/cross-repo-contract.md) when the server's `/meta` envelope is affected, and `/users/community/contributing-from-your-server` when the limits that hold a Bridge's submission change |
 | meta.audiosilo.app site UI | `/users/community/meta-site` + the `meta/` screenshots (+ [meta/overview.md](../meta/overview.md) when it is a site-architecture change) |
+| The Docker entrypoint (`docker-entrypoint.sh`: `PUID`/`PGID`, the chown and the folder checks) or the folder permission wording (`internal/fsaccess`, a backup's `permission_denied`) | [configuration.md](../server/configuration.md#folder-permissions) + `/users/troubleshooting#permission-denied` (it quotes the log lines verbatim) + the install pages (`/users/getting-started/quickstart-docker`, `install-synology`, `install-unraid`) |
 | Build / release / distribution | [release-pipeline.md](../architecture/release-pipeline.md) + [releasing.md](./releasing.md) (+ `/users/getting-started/install-unraid` when the native archives or the LinuxServer.io image's template, paths or defaults change) |
 | A capability flag | [server/api/index.md](../server/api/index.md) + the feature's user page |
 | The shared design tokens (`audiosilo-server/admin-ui/src/styles/globals.css`: colours, font stacks, shadows, motion) | Section 2 (shared tokens) of this site's `src/css/custom.css`, copied across verbatim (the dark block stays inside its `@media screen` wrapper), then a look at the built site in light and dark |
diff --git a/docs-developers/frontend/chromecast.md b/docs-developers/frontend/chromecast.md
index 21b33024..bf8dd6ee 100644
--- a/docs-developers/frontend/chromecast.md
+++ b/docs-developers/frontend/chromecast.md
@@ -141,6 +141,7 @@ The pure rules are `cast-media.ts`:
   | `codec` | The book needs the transcoder and the server has none. |
   | `no-connection` | The book's server isn't signed in. |
   | `episode` | A podcast episode, which never casts. |
+  | `proxy` | The address in use is the origin of the connection's [proxy headers](state-and-data.md#proxy-headers) (`behindProxy`). The receiver fetches by itself and can't send them, so the proxy would turn it away. |
 
 - **`castNeedsTranscode`** is true for the server's `direct_playable: false`, or for a
   codec the Default Media Receiver doesn't play (`CAST_UNPLAYABLE_CODECS`: ALAC, the
diff --git a/docs-developers/frontend/connect-and-addresses.md b/docs-developers/frontend/connect-and-addresses.md
index 461f61b0..77cb1702 100644
--- a/docs-developers/frontend/connect-and-addresses.md
+++ b/docs-developers/frontend/connect-and-addresses.md
@@ -32,6 +32,22 @@ counted by `StepDots` (`CONNECT_STEPS`): Start, Sign in and Ready.
   [`lan_url`](../server/configuration.md#home-address-lan_url)).
 - The server's error.
 
+#### Proxy headers on the connect screen
+
+Off the served player, a **Proxy headers** toggle opens a `ProxyHeadersEditor`
+for the address as the listener typed it (`typedUrl`, never the field after the
+flow rewrites it to a plain-http fallback). The set is held in memory as the
+session's `pendingProxyHeaders`, and only for an https origin. The flow's bare
+clients are `connectClient(base)` (`src/api/connect-client.ts`) and
+`probeServerId`, through `connectProxyHeaders(url)`: the pending set for that
+origin, else a signed-in connection's set for it (a second person on the same
+server). A reconnect's sign-in (`ownId`) takes only the pending set or that
+connection's own set, never another connection's. The scanner hands a code back
+to a new `ConnectStart`, which takes up the pending set, so a QR code pairs with
+the headers when its address is the field's. The flow's layout drops the pending
+set when the flow is left, and a sign-in stores it with the connection (see
+[Proxy headers](state-and-data.md#proxy-headers)).
+
 #### Pairing links, QR codes and invite links
 
 Native offers **Scan a QR code** (`/connect/scan`, `expo-camera`). Web offers **I have a
diff --git a/docs-developers/frontend/state-and-data.md b/docs-developers/frontend/state-and-data.md
index 2f4ad1cc..24995ed6 100644
--- a/docs-developers/frontend/state-and-data.md
+++ b/docs-developers/frontend/state-and-data.md
@@ -39,6 +39,10 @@ endpoints themselves.
     server keeps the stored app when a request has no header.
 
   See [Client identification](../server/api/index.md#client-identification-x-audiosilo-client).
+- **Proxy headers.** A connection's [proxy headers](#proxy-headers) are the
+  constructor's sixth argument. `request()` and every hand-built request send
+  them, `authHeaders()` hands them to the media layers with the token, and
+  `proxyHeadersFor(url)` gives them alone for a URL that carries `?token=`.
 - **Path-addressed everything.** Content calls are
   `GET /libraries/{id}/{item,chapters,cover,stream}?path=…` and the like. The path
   rides as a query parameter, never a URL segment, because encoded slashes are a
@@ -1546,6 +1550,51 @@ Tokens are stripped before the metadata is persisted.
 `serverId` on a connection persisted before that field existed. It runs after
 [the launch reset](#the-launch-reset), so it never reads wrongly-keyed records.
 
+#### Proxy headers
+
+A connection to a server behind a sign-in proxy (Cloudflare Access, Authentik,
+Authelia) can carry custom headers, `Connection.proxyHeaders` (`{ origin,
+headers }`). The rules are in `src/lib/proxy-headers.ts` and the storage in
+`src/lib/proxy-headers-store.ts`. They are credentials, kept like the token:
+
+- **Storage.** They live in memory and in secure-store under
+  `audiosilo.proxy-headers.<id>` (see [Storage layers](#storage-layers)). `persist`
+  strips them and keeps only the non-secret `hasProxyHeaders` marker, and
+  `hydrate` reads them beside the token for a marked connection only. They never
+  reach AsyncStorage, the query cache, a URL or a log line.
+- **Lifetime.** They go wherever the token goes: sign-out, a retired identity,
+  the auth reset, a connection `hydrate` drops. The identity migration copies them
+  in its token step (`copyProxyHeaders`). `removeConnection` deletes the token
+  first, so a failed delete stops the removal with the headers still kept. A new
+  connection to a server another connection here reaches with headers takes a
+  copy of that set under its own id.
+- **One https origin.** A set names the origin (scheme, host and port) it was
+  entered for. `proxyHeaderRecord` is the one rule: a request to that origin
+  carries the set, and any other URL gets none: a plain-http URL, another port,
+  or the home address unless the set was entered for it (an https home address
+  is one of the Account card's choices). A set for an http origin is refused at entry and dropped
+  at load (`cleanProxyHeaders`). Reserved names (`Authorization`, `Cookie`,
+  `Host`, `Range`, `Content-Type`, `Content-Length`, `Connection`,
+  `Transfer-Encoding`, `X-AudioSilo-Client`) and values with control characters
+  are refused the same way.
+- **Web.** Only a request same-origin with the page carries them. The server's
+  CORS lists a fixed set of request headers, so a custom one cross-origin would
+  fail its preflight. `<img>` and `<audio>` can't carry them and rely on the
+  proxy's browser sign-in.
+- **Redirects** are the platform HTTP stack's to follow. On Android (checked
+  2026-11-14 on a Pixel 6a, a GET 302 from https to another https host) every
+  stack (okhttp fetch and downloads, expo-image, Media3) sends the custom headers
+  on to the new origin and drops `Authorization`; iOS is unchecked. The origin rule
+  covers only the first request (follow-up fe#295). The UI says "sent with requests
+  to &lt;origin&gt;" and never claims more (`src/i18n/locales.test.ts` refuses
+  "nowhere else", "go only" and "https only" in every locale).
+- **Not carried:** Chromecast (`castBlockReason` `proxy`), the watch apps (the
+  pair message is unchanged) and calendar apps (the `releases.ics` link).
+
+The connect flow and the Account card that edit them are in
+[Connect and home/away addresses](connect-and-addresses.md#proxy-headers-on-the-connect-screen)
+and [You and settings](you-and-settings.md#account-srccomponentsaccount).
+
 #### Signing in: `setSession`
 
 `setSession({ serverId, user, ... })` refuses an empty `server_id`. Then it adds
@@ -2197,7 +2246,7 @@ There are two deliberate tiers. Know which one you are writing to.
 | Layer | Module | Backing | Used for |
 |---|---|---|---|
 | Plain | `src/lib/storage.ts` (`getItem`/`setItem`/`removeItem`, JSON-serialized) | AsyncStorage on native; localStorage on web, through AsyncStorage's web shim | connection metadata, settings, language pref, downloads registry, progress mirror and queue, the listening outbox, open span and sync state, device id |
-| Secret | `src/lib/secure-store.ts` (`getSecure`/`setSecure`/`deleteSecure`) | **expo-secure-store** (iOS Keychain, Android Keystore) on native. On iOS it uses the `audiosilo.tokens.afu` keychain service, readable after first unlock (see [Native integrations](native-integrations.md#tokens-on-a-locked-phone-srclibsecure-storets)). localStorage on web, where SecureStore doesn't exist. | **session tokens** (`audiosilo.token.<connectionId>`), plus profile PIN hashes (`audiosilo.profilePin.<profileId>`) and the device's copy of an upcoming calendar link (`audiosilo.upcoming-calendar.<connectionId>`) |
+| Secret | `src/lib/secure-store.ts` (`getSecure`/`setSecure`/`deleteSecure`) | **expo-secure-store** (iOS Keychain, Android Keystore) on native. On iOS it uses the `audiosilo.tokens.afu` keychain service, readable after first unlock (see [Native integrations](native-integrations.md#tokens-on-a-locked-phone-srclibsecure-storets)). localStorage on web, where SecureStore doesn't exist. | **session tokens** (`audiosilo.token.<connectionId>`), plus profile PIN hashes (`audiosilo.profilePin.<profileId>`), the device's copy of an upcoming calendar link (`audiosilo.upcoming-calendar.<connectionId>`) and a connection's [proxy headers](#proxy-headers) (`audiosilo.proxy-headers.<connectionId>`) |
 
 The split exists because these values are secrets. Hardware-backed storage on
 native is worth the extra API for them, while everything else is non-sensitive
diff --git a/docs-developers/frontend/you-and-settings.md b/docs-developers/frontend/you-and-settings.md
index b3b39d35..1129429d 100644
--- a/docs-developers/frontend/you-and-settings.md
+++ b/docs-developers/frontend/you-and-settings.md
@@ -273,6 +273,7 @@ Each block is gated on its capability, so an older server shows less, quietly:
 | Password: set or change in a dialog that lifts above the keyboard | `PasswordCard`, `PasswordDialog`, `usePasswordEditor` | hidden for a demo account |
 | Pair another device: `api.pair()`, the QR, a countdown from arrival (`PAIRING_TTL_MS`, the server's 10-minute `pairingTTL`), Copy link on web, Share on native, Make a new code once expired | `PairDeviceCard`, `usePairing` | hidden for a kid's account (`isKidAccount`) |
 | The watch (Apple Watch on iOS, Wear OS watch on Android, worded by `watchWording`): Install on watch (Android), Set up / Send again, signed in as, the listening it has to send, last sync, and a link to its books in Downloads (`openDownloads`; the books themselves are `WatchSection`, [Apple Watch](apple-watch.md#the-watch-in-downloads), [Wear OS](wear-os.md#the-phone-in-downloads)) | `WatchCard`, `src/watch/` | iOS or Android with a paired watch (`watchLink.supported`, `watchCardVisible`); hidden for a kid's or demo account |
+| Proxy headers: the connection's set, names only (values never shown again; an edited row keeps a stored value as "Kept as it is" unless one is typed), Send to among the connection's https origins (`proxyOriginChoices`), Save and Remove headers, the https-only caption when there is none, and what can't carry them (see [Proxy headers](state-and-data.md#proxy-headers)) | `ProxyHeadersCard` | not gated on flags, as it matters most when the proxy refuses everything; for a demo account only when it has a set |
 | Signed-in devices: sessions only, this device first (`signedInSessions`), with app, platform, last seen and a glyph (see [Signed-in devices](#signed-in-devices)) | `DevicesSection` | `my_devices` |
 | Listening sync: how many listens wait to reach this server, when this device last synced, and the "Couldn't sync" list (see [Listening sync](#listening-sync)) | `ListeningSyncCard`, `useListeningSync` (`src/playback/use-listening-sync.ts`) | `listening_sync`, or anything still waiting or listed (a server rolled back keeps showing what it left) |
 | Personal API keys: list, create in a dialog, reveal once, revoke with a confirm | `ApiKeysSection`, `useApiKeysManager`, `ApiKeyCreatedModal` | `api_keys` (a notice when it's `false`); hidden for a demo or kid's account |
diff --git a/docs-developers/server/backups-and-notifications.md b/docs-developers/server/backups-and-notifications.md
index 5bd839bd..3eb820bd 100644
--- a/docs-developers/server/backups-and-notifications.md
+++ b/docs-developers/server/backups-and-notifications.md
@@ -142,6 +142,11 @@ push out the copy of the database as the older server left it.
 - whether a backup is being made;
 - `last`: the newest attempt since the server started, with a short `error`
   (`disk_full`, `permission_denied` or `failed`). The cause is in the log.
+  A backup checks its folder with a probe file of its own before `VACUUM INTO`
+  (`fsaccess.CheckWrite`), since SQLite words a refused folder as "unable to
+  open database file". A refusal at any step (the check, the chmod, the rename)
+  is `permission_denied`, and `Result.Detail` (not on the wire) holds the
+  [`fsaccess`](configuration.md#the-servers-own-checks) sentence with the fix.
 - `latest`: the newest backup in the folder that isn't a before-restore or
   before-upgrade copy, whenever it was made;
 - `next`: `null` when the schedule is off.
@@ -324,7 +329,7 @@ subscribed to its kind. A nil `*Service` does nothing, so callers don't check.
 | `new_device` | every pairing exchange (`POST /auth/exchange`), and a password sign-in (`POST /auth/login`) unless an earlier session of the same person already carried its `device_id` (`auth.IssueSession`). A sign-in without a `device_id` always counts. Never for demo accounts. | `user`, `device` (the name the client sent, one plain line of at most 100 characters), `app` (from `X-AudioSilo-Client`, may be empty) |
 | `invite_redeemed` | a pairing exchange whose token came from an invite code | `user` (whose invite), `device` |
 | `update_available` | `updates.Checker.OnAvailable` after a check that finds a newer release. Announced **once per version** (`dedup_key` is the version). | `version`, `name`, `url` (the release page) |
-| `backup_failed` | `backup.Service.OnFailure` (scheduled or manual) | `trigger`, `error` (`disk_full`, `permission_denied`, `failed`) |
+| `backup_failed` | `backup.Service.OnFailure` (scheduled or manual) | `trigger`, `error` (`disk_full`, `permission_denied`, `failed`), and for `permission_denied` a `detail` sentence (the folder, the server's user, its owner and the fix) that the notification's text uses |
 | `bridge_job_finished` | `bridge.Service.OnTransition` (wired by `API.SetBridge`): a [Bridge](../bridge/index.md) job moved **into** `done` | `job_id`, `job_kind`, `state`, `library`, `library_id`, `path`, `title`, plus per-kind fields. See [Bridge event data](#bridge-event-data). |
 | `bridge_job_failed` | the same hook, for a job that moved **into** `failed` or into a notable `needs_attention`. See [Bridge event data](#bridge-event-data). | as `bridge_job_finished`, plus `code` and `detail` |
 | `book_released` | the [upcoming releases](api/reference.md#upcoming-releases) job (`upcoming.Runner`, wired to `API.announceReleases`). See [`book_released`](#book_released). | `count`, `titles` (the first five, each `Title (Series #position)`, or `Title (Series)` without a position) |
diff --git a/docs-developers/server/configuration.md b/docs-developers/server/configuration.md
index a8358308..f18cea4f 100644
--- a/docs-developers/server/configuration.md
+++ b/docs-developers/server/configuration.md
@@ -886,7 +886,7 @@ by the settings table in `internal/config/settings.go` (`fields`: each entry's
 | `AUDIOSILO_SESSION_DAYS` | `activity.session_days` | integer, 30-3650 |
 | `AUDIOSILO_BACKUP_SCHEDULE` | `backups.schedule` | `""`, `daily:HH:MM` or `weekly:DAY:HH:MM` |
 | `AUDIOSILO_BACKUP_KEEP` | `backups.keep` | integer, 1-365 |
-| `AUDIOSILO_BACKUP_DIR` | `backups.dir` | absolute path |
+| `AUDIOSILO_BACKUP_DIR` | `backups.dir` | absolute path; the Docker entrypoint also gives the folder to `PUID`/`PGID` (see [Under Docker](#under-docker)) |
 | `AUDIOSILO_MODULES_PODCASTS_ENABLED` | `modules.podcasts.enabled` | `strconv.ParseBool` (`true`/`1`/…); locks the console toggle when set |
 | `AUDIOSILO_MODULES_CONTRIBUTIONS_ENABLED` | `modules.contributions.enabled` | `strconv.ParseBool` (`true`/`1`/…); each module's toggle is `AUDIOSILO_MODULES_<ID>_ENABLED` |
 | `AUDIOSILO_PODCAST_DISCOVERY_ENABLED` | `podcasts.discovery.enabled` | `strconv.ParseBool` (`false`/`0`/… turns it off); read at start |
@@ -1252,3 +1252,52 @@ tools.
 | `<data>/restore.json` | A restore waiting for the next start (removed when it is applied or refused) |
 | `<data>/restore-result.json` | How the last restore went |
 | `<data>/audiosilo.db.before-restore-<time>` | Only when a restore couldn't copy the database it replaced: that database's files, renamed aside |
+
+## Folder permissions
+
+The server needs read and write access to its data and backups folders and read
+access to its libraries. It checks them itself on every install, and the Docker
+image's entrypoint checks them once more before the server starts.
+
+### The server's own checks
+
+The server words a refused folder in `internal/fsaccess`. Before
+`config.Load` and `store.Open`, the launcher writes a probe file in the data
+folder and opens `audiosilo.db`, `-wal` and `-shm` read-write. A refusal stops
+the start with `the data folder isn't usable: ...`, naming the path, the user
+`uid:gid`, the owner and the fix, rather than SQLite's "unable to open database
+file". The fix (`fsaccess.Hint`) is `PUID` and `PGID` set to the owner only in a
+container (`/.dockerenv` or `/run/.containerenv`); outside one it is running the
+server as the owner. It never advises running as root. It warns `backups will fail` at start when
+the backups folder exists and refuses it (`backup.Service.CheckFolder`). A
+refused backup is `permission_denied` (see
+[Backups](backups-and-notifications.md#status)), and a library root the server
+can't list is [unavailable](scanner.md#the-unavailable-root-guard).
+
+### Under Docker
+
+The image's `docker-entrypoint.sh` starts as root, gives the server's user its
+folders, checks them as that user, then drops to it with `su-exec PUID:PGID`
+(default `1000:1000`). The server runs as root only when `PUID` is `0`.
+`su-exec` sets only that group, so access a host user has through another group
+doesn't reach the server.
+
+- **Ownership.** It runs `chown -R` on the data folder (`--data`, `/data` by
+  default). When `AUDIOSILO_BACKUP_DIR` is an absolute path, it gives the user
+  that folder and only AudioSilo's own files in it (`audiosilo-*.db` and
+  `.audiosilo-*`, regular files, `chown -h`), since a backups share may hold other
+  apps' files. A path that is the container's root, however spelled, or that
+  holds a `..`, is skipped. The data folder's `chown -R` crosses into a share
+  mounted under it, so a backups share belongs at a path of its own, never
+  `/data/backups`.
+- **Checks.** As the server's user, it writes a `mktemp` file in the data and
+  backups folders and reads one entry of every other mounted folder (the
+  audiobooks, by the rule of the setup's mount hints). For a folder that fails
+  it prints the folder, the user, the folder's owner and the fix (`PUID` and
+  `PGID` set to the owner, or giving the user access), and carries on. Every
+  check and every step on the backups folder is bounded by `timeout 5`. A check
+  cut off says the folder didn't answer, with no owner advice.
+- **Under `--user`** (compose `user:`) it skips the chown, runs the same checks,
+  and its fix names `user:` instead of `PUID` and `PGID`.
+
+`scripts/test-entrypoint.sh` tests the entrypoint in Docker. CI doesn't run it.
diff --git a/docs-developers/server/scanner.md b/docs-developers/server/scanner.md
index 3520d498..acd0ade2 100644
--- a/docs-developers/server/scanner.md
+++ b/docs-developers/server/scanner.md
@@ -2039,8 +2039,12 @@ drops. The scanner **aborts without pruning** when any of these holds:
 1. the root doesn't answer the bounded root probe within 2 seconds. A hung
    hard mount would otherwise hold the one scan worker and every scan queued
    behind it;
-2. the library root is missing or not a readable directory (`os.Stat` before
-   discovery);
+2. the library root is missing or not a directory (`os.Stat` before
+   discovery), or the server's user may not list it (`fsaccess.CheckRead`). A
+   root another user owns, as on a NAS share, would otherwise read as an empty
+   library scanned OK. The error names the folder, the user the server runs as,
+   the folder's owner and the fix (see
+   [Folder permissions](configuration.md#the-servers-own-checks));
 3. discovery returns **zero** audio files while the index still has books. An
    existing but empty mount point looks exactly like this, and letting the
    prune step run would wipe every indexed book. The one exception: when the
diff --git a/docs-developers/server/web-ui.md b/docs-developers/server/web-ui.md
index 94fd5293..756a2609 100644
--- a/docs-developers/server/web-ui.md
+++ b/docs-developers/server/web-ui.md
@@ -1837,13 +1837,17 @@ outside `AppShell`. `Root` signs the admin in, then `SignedIn` renders the bare
 `<Outlet/>` on the setup path and the shell everywhere else.
 
 `useSetupRedirect` sends a signed-in admin there (with `replace`) while
-`GET /admin/setup` reports `finished: false`. It does so **once per browser
-session**, so **Finish later** (a link to Overview) or any link out stays where
-it goes.
-
-- The guard is the `sessionStorage` key `audiosilo.setup.redirected`. It is
-  also set when the admin opens the flow some other way. A module variable
-  stands in when storage is blocked.
+`GET /admin/setup` reports `finished: false`. The first page a browser session
+shows with the setup state loaded decides, once (`redirectDecision` in
+`setup-model.ts`). The Overview, where a plain visit to `/admin` lands, goes to
+the flow. Any other page stays: a bookmark, a reload, the flow itself, or a link
+the flow opens in a new tab (the ABS step's **Open the import**, the Reach
+step's HTTPS settings), which starts a session of its own. Either way the session
+is marked, so later pages in it are never redirected: **Finish later** (a link
+to Overview) and moving on from a deep link stay where they go.
+
+- The mark is the `sessionStorage` key `audiosilo.setup.redirected`. A module
+  variable stands in when storage is blocked.
 - `?step=<id>` deep-links one step. Without it, `resumeStep` opens the first
   step with no mark, or the last step when all have one.
 
diff --git a/docs-users/admin/backups.md b/docs-users/admin/backups.md
index 60d125f9..08b7a4d0 100644
--- a/docs-users/admin/backups.md
+++ b/docs-users/admin/backups.md
@@ -41,6 +41,28 @@ folder at another disk, or download a backup now and then and keep it
 elsewhere.
 :::
 
+### A backups folder on another disk
+
+Under Docker, mount the other disk at a path of its own, such as `/backups`,
+and set `AUDIOSILO_BACKUP_DIR` to that path:
+
+```yaml
+    volumes:
+      - ./data:/data
+      - /mnt/backup-disk/audiosilo:/backups
+    environment:
+      AUDIOSILO_BACKUP_DIR: /backups
+```
+
+- The server's user (`PUID` and `PGID`) needs read and write access to it, as
+  for the data folder. At start the container makes that user the owner of the
+  folder and of AudioSilo's own backups in it. A NAS share can refuse that, and
+  then the log names the folder and the fix (see
+  [Permission denied](../troubleshooting.md#permission-denied)).
+- Never mount a share inside the data folder, such as at `/data/backups`. At
+  start the container changes the owner of everything in the data folder, and
+  that would reach into the share.
+
 ## Making and downloading backups
 
 The **Backups** card lists every backup, newest first.
@@ -51,6 +73,8 @@ The **Backups** card lists every backup, newest first.
 
 If a backup fails, a notice gives the reason, such as a full disk or a folder
 the server can't write to. You can also get it as a [notification](notifications.md).
+For a folder the server can't write to, the notification names the folder, the
+user the server runs as and the fix.
 
 ## Before an upgrade
 
diff --git a/docs-users/features.md b/docs-users/features.md
index dc2a0cd8..8373e152 100644
--- a/docs-users/features.md
+++ b/docs-users/features.md
@@ -43,6 +43,7 @@ Everything else works with the server alone.
 - [Cast](listening/chromecast.md): play on a Chromecast, TV or Nest speaker.
 - [App settings](listening/settings.md): playback, downloads, appearance and language.
 - [Your account](listening/account.md): password, devices and listening sync.
+- [Connect through a sign-in proxy](getting-started/remote-access.md#behind-a-sign-in-proxy) such as Cloudflare Access, with headers the app sends.
 - [API keys](listening/api-keys.md): let a dashboard or script reach your server.
 
 ## Household and sharing
@@ -69,7 +70,7 @@ Everything else works with the server alone.
 
 ## Running the server
 
-- Install with [Docker](getting-started/quickstart-docker.md), on [Unraid](getting-started/install-unraid.md), or [without Docker](getting-started/install-binary.md).
+- Install with [Docker](getting-started/quickstart-docker.md), on [Unraid](getting-started/install-unraid.md), on a [Synology NAS](getting-started/install-synology.md), or [without Docker](getting-started/install-binary.md).
 - [Set up your server](getting-started/first-run.md): the first-run checklist.
 - [Reach your server from outside your home](getting-started/remote-access.md): a domain name and a trusted certificate.
 - [Back up your server](admin/backups.md): scheduled and manual backups, and restore.
diff --git a/docs-users/getting-started/first-run.md b/docs-users/getting-started/first-run.md
index 3e298f6b..92c48176 100644
--- a/docs-users/getting-started/first-run.md
+++ b/docs-users/getting-started/first-run.md
@@ -29,7 +29,7 @@ Save both now:
 - The **admin password** signs you in to the admin console at `/admin`.
 - The **auth code** signs a phone or browser in as the admin, from the connect page. See [Connect the app to your server](../listening/connecting.md).
 
-The server keeps only scrambled copies, so it can't show them again. Under Docker, `docker compose logs` shows the banner until the container is recreated.
+The server keeps only scrambled copies, so it can't show them again. Under Docker, `docker compose logs` shows the banner until the container is recreated. On a NAS, use the container app's log view (see [Where do I find the server's log?](../troubleshooting.md#where-do-i-find-the-servers-log)).
 
 :::warning[Missed the banner?]
 Before you've added people or listening, the simplest fix is to start over. Stop the server, delete the data folder, and start it again for a fresh banner. Later, see [I lost the first-run admin password](../troubleshooting.md#i-lost-the-first-run-admin-password).
@@ -51,12 +51,12 @@ The link stops working as soon as an admin account exists.
 
 ## Set up your server
 
-The first time you open the admin console, it opens **Set up your server**, with the steps listed down the side.
+The first time you open the admin console, it opens **Set up your server**, with the steps listed down the side. Until setup is finished, opening `/admin` starts the flow once in each browser session. A link or bookmark to another console page opens that page.
 
 ![Step 1 of Set up your server: the books folder](/img/screenshots/setup/folder.png)
 
 - Every step has **Skip**. A skipped step waits for you on the Overview (see [The Finish setting up card](#the-finish-setting-up-card)).
-- **Finish later** takes you to the console. The flow opens again in your next browser session.
+- **Finish later** takes you to the console. The flow opens again when you next open `/admin` in a new browser session.
 - Everything you choose is an ordinary setting. You can change it later in [Server > Settings](../admin/server.md#settings) and [Libraries](../admin/libraries.md).
 - A setting fixed by an `AUDIOSILO_*` environment variable shows a lock and can't be changed here.
 
@@ -112,7 +112,7 @@ See [Reach your server from outside your home](./remote-access.md).
 
 ![Step 5: the Audiobookshelf import](/img/screenshots/setup/abs.png)
 
-**Open the import** brings each person's listening progress across from Audiobookshelf (see [the import](../admin/import.md)). It opens in a new tab. Audiobookshelf's `metadata.json` files are read as they are, with nothing to set.
+**Open the import** brings each person's listening progress across from Audiobookshelf (see [the import](../admin/import.md)). It opens the import in a new tab, and the flow stays open in this one. Audiobookshelf's `metadata.json` files are read as they are, with nothing to set.
 
 ### Step 6: Backups and updates
 
@@ -158,6 +158,7 @@ The data folder (`--data`, or `/data` under Docker) holds:
 
 - `config.yaml`: the server's settings. The admin console writes it for you.
 - `audiosilo.db`: accounts, listening progress, bookmarks and the index of your books. Back this up.
+- `backups/`: the server's [backups](../admin/backups.md) of `audiosilo.db`, unless you set another backups folder.
 - `certs/` and `selfsigned-*.pem`: certificates.
 - `tools/`: ffmpeg and ffprobe, if the server downloaded them.
 - `cache/` and `meta-mirror/`: copies the server makes again when needed. No backup needed.
diff --git a/docs-users/getting-started/install-synology.md b/docs-users/getting-started/install-synology.md
new file mode 100644
index 00000000..5061a83f
--- /dev/null
+++ b/docs-users/getting-started/install-synology.md
@@ -0,0 +1,101 @@
+---
+title: Install on a Synology NAS
+description: "Run AudioSilo on a Synology NAS with Container Manager: create the data folder, set PUID and PGID to your DSM user, and find the first-run password."
+---
+
+On a Synology NAS, run AudioSilo as a **Container Manager** project. It's the same image as the [Docker install](./quickstart-docker.md), **`ghcr.io/kodestar/audiosilo-server`**. Most install problems on a NAS are folder permissions, so this page sets those up first.
+
+:::note
+These steps are written for Container Manager on DSM 7.2 and haven't been checked on a NAS yet, so a label can differ on yours. AudioSilo needs Docker 20.10.10 or newer. The older **Docker** package on DSM 7.1 may be too old (see [Troubleshooting](../troubleshooting.md#the-container-stops-at-start-up-with-pthread_create-failed)).
+:::
+
+## 1. Create the folders
+
+1. Install **Container Manager** from **Package Center**. It creates a shared folder called `docker`.
+2. In **File Station**, open `docker` and create a folder `audiosilo`, then a folder `data` inside it.
+
+The data folder is now `/volume1/docker/audiosilo/data`. It holds the database, settings and backups. Your audiobooks stay where they are, for example in a shared folder `/volume1/audiobooks`.
+
+## 2. Pick the user the server runs as
+
+The server runs as the user and group in `PUID` and `PGID`. Use your own DSM user's IDs:
+
+- The first user you create on DSM is usually **1026**, and its group (`users`) is **100**.
+- To check, sign in over SSH and run `id yourname`. It prints `uid=` and `gid=`.
+
+No SSH? Start with 1026 and 100. If a folder then refuses that user, the container's log names the folder's owner and the values to set (see [Permission denied](../troubleshooting.md#permission-denied)).
+
+## 3. Give that user access
+
+The user needs **read and write** access to the data folder and **read** access to your audiobooks.
+
+1. Open **Control Panel** > **Shared Folder**.
+2. Select `docker` and choose **Edit** > **Permissions**.
+3. Pick **Local users** and tick **Read/Write** for your user. Press **Save**.
+4. Do the same for your audiobooks shared folder, with **Read only** (or **Read/Write**).
+
+Tick your user, not only a group it belongs to. The container runs with your user's ID and one group, so access through the `administrators` group doesn't reach it.
+
+For a single folder inside a share, use **File Station**: right-click the folder, choose **Properties** > **Permission**, and add your user there.
+
+## 4. Create the project
+
+1. In **Container Manager**, open **Project** and press **Create**.
+2. Name it `audiosilo`. For **Path**, choose `docker/audiosilo`.
+3. For **Source**, choose **Create docker-compose.yml** and paste:
+
+   ```yaml
+   services:
+     audiosilo:
+       image: ghcr.io/kodestar/audiosilo-server:latest
+       restart: unless-stopped
+       ports:
+         - "8080:8080"
+       volumes:
+         - /volume1/docker/audiosilo/data:/data
+         - /volume1/audiobooks:/library:ro
+       environment:
+         PUID: "1026"    # your DSM user's uid
+         PGID: "100"     # its gid
+   ```
+
+4. Change `/volume1/audiobooks` to your books folder, and `1026` / `100` to your IDs.
+5. Press **Next** through the remaining pages, leaving the web portal off, then **Done**. The project starts.
+
+If another app already uses port 8080, change the left-hand number, for example `"8090:8080"`.
+
+## 5. Save your password
+
+On the very first start, the log shows the admin password and an auth code **once**. In **Container Manager**, open **Container**, select the AudioSilo container and choose **Details**, then the **Log** tab:
+
+```text
+========================================================
+ AudioSilo first-run setup - store these now, shown once
+========================================================
+  Admin username : admin
+  Admin password : <generated password>
+  Auth code      : <generated code>
+  Config file    : /data/config.yaml
+```
+
+Save both now. [Set up your server](./first-run.md) says what each is for.
+
+If the log starts with `audiosilo: WARNING: the server can't write to /data` or `can't read /library`, fix the folder it names first. See [Permission denied](../troubleshooting.md#permission-denied).
+
+## 6. Open it and add your books
+
+1. Browse to `http://your-nas:8080/admin` and sign in as `admin` with the printed password.
+2. **Set up your server** opens. For the books folder, type **`/library`** (the path inside the container, not `/volume1/...`) and press **Check folder**.
+3. Follow the remaining steps, or skip any of them.
+
+[Set up your server](./first-run.md#set-up-your-server) walks through every step. Then [get the apps](../listening/mobile-apps.md) and [connect a phone or browser](../listening/connecting.md).
+
+## Update
+
+In **Container Manager**, stop the `audiosilo` project, get the newest `ghcr.io/kodestar/audiosilo-server:latest` image, and start the project again. Over SSH, `cd /volume1/docker/audiosilo` and run `sudo docker compose pull && sudo docker compose up -d`. Your books are never changed. When an update changes the database, the server first saves a [backup](../admin/backups.md#before-an-upgrade) of it.
+
+## Good to know
+
+- **Backups** go to `backups` inside the data folder, so they need nothing more. To keep them on another volume, see [Backups](../admin/backups.md#a-backups-folder-on-another-disk).
+- **No File Station access to fix it?** Over SSH, `sudo chown -R 1026:100 /volume1/docker/audiosilo/data` gives the data folder to user 1026. Use your own IDs and path. Give your user read access to the books in **Shared Folder** (step 3).
+- **HTTPS and access from outside** work as on any Docker host. See [Reach your server from outside your home](./remote-access.md).
diff --git a/docs-users/getting-started/quickstart-docker.md b/docs-users/getting-started/quickstart-docker.md
index 37c4de02..5855b6fc 100644
--- a/docs-users/getting-started/quickstart-docker.md
+++ b/docs-users/getting-started/quickstart-docker.md
@@ -5,8 +5,8 @@ description: "Run the AudioSilo server with Docker Compose, get your first-run p
 
 Docker is the recommended way to run AudioSilo on a NAS, home server or VPS. One container holds the server, the web player and ffmpeg. The image is **`ghcr.io/kodestar/audiosilo-server`**.
 
-:::tip[On Unraid?]
-Install from Community Applications instead. See [Install on Unraid](./install-unraid.md).
+:::tip[On Unraid or a Synology NAS?]
+On Unraid, install from Community Applications instead. See [Install on Unraid](./install-unraid.md). On a Synology NAS, see [Install on a Synology NAS](./install-synology.md).
 :::
 
 ## What you need
@@ -29,8 +29,8 @@ services:
       - ./data:/data                  # database, config, certificates
       - /srv/audiobooks:/library:ro   # your books, mounted read-only
     environment:
-      PUID: "1000"                    # owner of /data (Unraid: 99)
-      PGID: "1000"                    # group of /data (Unraid: 100)
+      PUID: "1000"                    # owner of ./data (Unraid: 99, Synology: usually 1026)
+      PGID: "1000"                    # group of ./data (Unraid: 100, Synology: usually 100)
       # AUDIOSILO_PUBLIC_URL: "https://books.example.com"  # used in QR/invite links
       # AUDIOSILO_TLS_MODE: "off"     # only behind a TLS-terminating reverse proxy
       AUDIOSILO_WEB_DIR: /app/web
@@ -38,18 +38,21 @@ services:
 
 Change `/srv/audiobooks` to your books folder. The two mounts:
 
-- **`/data`** holds the server's database, `config.yaml` and certificates. Keep it, and back it up.
+- **`/data`** holds the server's database, `config.yaml`, certificates and [backups](../admin/backups.md). Keep it, and back it up.
 - **`/library`** is your books, mounted read-only (`:ro`). The server never writes to your books.
 
-Set `PUID` and `PGID` to the user and group that should own the data folder. On Linux that's the output of `id -u` and `id -g`.
+Set `PUID` and `PGID` to the user and group that should own the data folder. On Linux that's the output of `id -u` and `id -g`. The server runs as that user, so it also needs read access to your books folder. If it can't use a folder, the log says which one and how to fix it (see [Permission denied](../troubleshooting.md#permission-denied)).
 
 A setting you give as an `AUDIOSILO_*` variable wins over the admin console, which then shows it as locked. Leave a setting out if you'd rather change it in [Server > Settings](../admin/server.md#settings).
 
 ## 2. Start it and save your password
 
+Create the data folder yourself before the first start. Otherwise Docker creates it as root, and the container then has to change its owner, which a NAS share can refuse. Then start the server:
+
 ```bash
+mkdir -p data           # create the data folder first
 docker compose up -d
-docker compose logs
+docker compose logs     # the admin password and auth code, shown once
 ```
 
 On the very first start, the log shows the admin password and an auth code **once**:
@@ -84,7 +87,7 @@ The first time you sign in to the admin console, it opens **Set up your server**
 2. Press **Check folder**.
 3. Follow the remaining steps, or skip any of them.
 
-The server scans your books in the background. [Set up your server](./first-run.md#set-up-your-server) walks through every step. Then [connect a phone or browser](../listening/connecting.md).
+The server scans your books in the background. [Set up your server](./first-run.md#set-up-your-server) walks through every step. Then [get the apps](../listening/mobile-apps.md) and [connect a phone or browser](../listening/connecting.md).
 
 ## Update
 
@@ -96,6 +99,19 @@ This updates the server and the web player together. Your books are never change
 
 ## Good to know
 
+- **Prefer `docker run`?** The same container in one command:
+
+  ```bash
+  mkdir -p data           # create the data folder first
+  docker run -d --name audiosilo --restart unless-stopped -p 8080:8080 \
+    -e PUID=1000 -e PGID=1000 \
+    -v "$PWD/data:/data" \
+    -v /srv/audiobooks:/library:ro \
+    ghcr.io/kodestar/audiosilo-server:latest
+
+  docker logs audiosilo   # the admin password and auth code, shown once
+  ```
+
 - **Books on a network share (SMB/NFS):** mount the share on the Docker host, then mount that path into the container. If the share goes away, the server keeps your books and progress; they come back when the share does.
 - **HTTPS with a reverse proxy from the start:** follow the [Caddy](https://audiosilo.app/blog/audiosilo-with-caddy/), [SWAG](https://audiosilo.app/blog/audiosilo-with-swag/) or [Traefik](https://audiosilo.app/blog/audiosilo-with-traefik/) guide. Each has a Compose file with both AudioSilo and the proxy.
 
diff --git a/docs-users/getting-started/remote-access.md b/docs-users/getting-started/remote-access.md
index 1ae8e751..aa3af6ec 100644
--- a/docs-users/getting-started/remote-access.md
+++ b/docs-users/getting-started/remote-access.md
@@ -67,6 +67,26 @@ Trusted proxies matter. Without them, the server sees every visitor as the proxy
 Only turn HTTPS off behind a proxy that handles HTTPS. Plain HTTP open to the internet sends passwords and audio unencrypted.
 :::
 
+### Behind a sign-in proxy
+
+A sign-in proxy (Cloudflare Access, Authentik, Authelia and the like) turns away requests without its sign-in. In a browser you sign in to the proxy, so the web player works as it is. The iOS and Android apps can't show that sign-in page. Instead they send the headers the proxy accepts, such as a Cloudflare Access service token, with their requests to the server's `https://` address.
+
+To connect an app through the proxy:
+
+1. On the app's connect screen, enter the server's `https://` address.
+2. Tap **Proxy headers**. Enter each header's name, such as `CF-Access-Client-Id`, and its value. **Add a header** adds another row.
+3. Tap **Continue** and sign in as usual. To use a pairing QR code instead, tap **Scan a QR code** now. A QR code or link uses the headers when its address is the one you typed.
+
+The app stores the headers as securely as your sign-in. To change them, use the **Proxy headers** card on the [account page](../listening/account.md#proxy-headers).
+
+Good to know:
+
+- **An `https://` address.** Proxy headers need an `https://` address, and the app doesn't add them to a plain-HTTP request. Requests to the server's other addresses, such as its home address, get none either.
+- **Redirects:** when the proxy or the server redirects a request to another address, the Android app sends the headers on to that address (checked on Android; not yet on iOS). Only let the proxy redirect to addresses you'd trust with them.
+- **What can't send them:** Chromecast, the Apple Watch and Wear OS apps, and calendar apps. They reach the server by themselves, so they can't get past the proxy. In a browser, covers, audio and requests to another server don't carry them. Those rely on your sign-in to the proxy in that browser.
+- **Some names are the app's own**, such as `Authorization`, `Cookie`, `Host`, `Range` and `Content-Type`, and it refuses them. So a proxy that asks for basic auth (an `Authorization` header) can't sit in front of AudioSilo.
+- **Another person on the same server** who signs in on this device uses the same headers.
+
 ## Tell the server its public address
 
 Set **Public address** (under Server > Settings > General) to the address people use from outside. In `config.yaml`:
diff --git a/docs-users/index.md b/docs-users/index.md
index 293303a0..f503bdf8 100644
--- a/docs-users/index.md
+++ b/docs-users/index.md
@@ -13,7 +13,8 @@ on your phone. There is no subscription, and your files are never changed.
 ## Get started
 
 1. Install the server with [Docker](getting-started/quickstart-docker.md), on
-   [Unraid](getting-started/install-unraid.md), or
+   [Unraid](getting-started/install-unraid.md), on a
+   [Synology NAS](getting-started/install-synology.md), or
    [without Docker](getting-started/install-binary.md).
 2. [Set up your server](getting-started/first-run.md): create your admin account
    and add your audiobook folder.
diff --git a/docs-users/listening/account.md b/docs-users/listening/account.md
index e3f0728c..70c0cb8d 100644
--- a/docs-users/listening/account.md
+++ b/docs-users/listening/account.md
@@ -5,7 +5,7 @@ description: "Set a password, pair another device, sign out a lost phone, check
 
 Each server you use has its own **account page**. There you set your password, pair another device, see your signed-in devices, and sign out.
 
-![A server's account page on a computer: Password, Pair another device, signed-in devices, Listening sync and API keys](/img/screenshots/web-player/account.png)
+![A server's account page on a computer: Password, Pair another device, Proxy headers, signed-in devices, Listening sync and API keys](/img/screenshots/web-player/account.png)
 
 ## Opening it
 
@@ -43,6 +43,18 @@ On a phone with a paired watch, a card signs the watch in to this server. On an
 
 If the server has home and away addresses, an **At home and away** card lists them. In the apps, the one in use is marked **In use**. See [At home and away](connecting.md#at-home-and-away).
 
+## Proxy headers
+
+For a server behind a sign-in proxy, the **Proxy headers** card holds the headers this device sends with its requests. See [Behind a sign-in proxy](../getting-started/remote-access.md#behind-a-sign-in-proxy) for what they are for.
+
+1. Tap **Add headers** (or **Change headers**).
+2. If the server has more than one `https://` address, pick the one that goes through the proxy under **Send to**.
+3. Enter each header's name and value, then tap **Save headers**.
+
+The card then lists each header's name and the address it's sent with requests to. It never shows a saved value again. When you change the headers, a saved value's field says **Kept as it is**, and the value stays unless you type a new one. **Remove headers** stops this device sending them.
+
+The card needs an `https://` address. If this device reaches the server only over plain HTTP, the card says so and offers no **Add headers**. A demo account shows the card only when it already has headers.
+
 ## Signed-in devices
 
 Every device signed in to your account on this server, with when it was last used. API keys aren't in this list.
diff --git a/docs-users/listening/chromecast.md b/docs-users/listening/chromecast.md
index fda1bd59..b1f1e4f7 100644
--- a/docs-users/listening/chromecast.md
+++ b/docs-users/listening/chromecast.md
@@ -37,6 +37,7 @@ Which addresses work:
 - **HTTPS with a trusted certificate** works, such as [Let's Encrypt](../getting-started/remote-access.md#a-real-certificate-with-autocert-lets-encrypt) or a [reverse proxy](../getting-started/remote-access.md#behind-a-reverse-proxy) with a real certificate.
 - **A self-signed `https://` address doesn't work.** A Cast device can't click through a certificate warning.
 - **`localhost` doesn't work.** Connect to the server by its network address instead.
+- **An address behind a sign-in proxy doesn't work.** A Cast device can't send the [proxy headers](../getting-started/remote-access.md#behind-a-sign-in-proxy), so the app won't cast through that address.
 
 A downloaded book still casts from your server, so the server must be reachable.
 
diff --git a/docs-users/listening/connecting.md b/docs-users/listening/connecting.md
index 35e971ed..891b8d0c 100644
--- a/docs-users/listening/connecting.md
+++ b/docs-users/listening/connecting.md
@@ -116,5 +116,6 @@ To listen away from home at all, the server must be reachable from the internet.
 
 - On a device in [kids mode](kids-mode.md#links-in-kids-mode), the app doesn't open links or QR codes. It asks for a grown-up.
 - A link to a book, opened while you're signed out, takes you through signing in and then to the book.
+- A server behind a sign-in proxy, such as Cloudflare Access, needs the app to send extra headers. Tap **Proxy headers** on the connect screen before you continue. See [Behind a sign-in proxy](../getting-started/remote-access.md#behind-a-sign-in-proxy).
 - Some servers offer a guest demo. The connect screen then shows **Try the demo**. There is also a [public demo](../demo.md).
 - A pairing code made on another device works once, for 10 minutes. A link from an invite works for as many devices as the invite has uses left.
diff --git a/docs-users/troubleshooting.md b/docs-users/troubleshooting.md
index cbc2a1c4..add46c0c 100644
--- a/docs-users/troubleshooting.md
+++ b/docs-users/troubleshooting.md
@@ -20,13 +20,38 @@ Work through these in order:
 
 Your Docker is older than **20.10.10** and blocks something the server needs. Update Docker (on a NAS, update its container app or system), then start the container again. `docker version` shows your version.
 
+### The container keeps restarting, or the log says the server can't write to a folder {/* #permission-denied */}
+
+The server runs as the user in `PUID` and `PGID`. It needs read and write access to its data and backups folders, and read access to your books. At start the container tries to make that user the owner of the data folder. A NAS share can refuse that, and the container's log then says so:
+
+```text
+audiosilo: WARNING: the server can't write to /data: it runs as user 1000:1000 and the folder belongs to 1026:100.
+audiosilo:   Changing its owner to 1000:1000 failed (a NAS share with ACLs or a read-only mount refuses it).
+audiosilo:   Fix: set PUID=1026 and PGID=100 (the folder's owner) on the container, or give user 1000:1000 read and write access to the folder on the host.
+error: the data folder isn't usable: the server can't write to /data: permission denied. The server runs as user 1000:1000 and the folder belongs to 1026:100. Set PUID=1026 and PGID=100 (the folder's owner) on the container, or give user 1000:1000 read and write access to the folder.
+```
+
+The last line is the server stopping, so the container restarts and stops again. Do what the **Fix** line says. Either:
+
+- Set `PUID` and `PGID` to the owner the log names (here `1026` and `100`), then recreate the container.
+- Give the user the log names access to the folder on the host. On a Synology NAS, see [Give that user access](./getting-started/install-synology.md#3-give-that-user-access).
+
+The same warning can name other folders:
+
+- **The backups folder you set in `AUDIOSILO_BACKUP_DIR`.** The server starts, but backups fail until you fix it. For this folder and for the default one, the server's log warns `backups will fail` at start, and once a backup fails, the Backups notice in the console says why.
+- **A books folder**, which needs read access only. The warning ends with `Until then, a library in that folder shows as offline.` The library shows **Folder unavailable** in the console. After the fix, press **Retry** on the library.
+
+A share that doesn't answer is a different problem. The log says `audiosilo: WARNING: /library didn't answer within 5 seconds: a network share that is slow, or whose server is gone.` Check that the share is mounted on the host.
+
+Run the container with `user:` instead of `PUID` and `PGID`? Then the **Fix** line says to run it as the folder's owner, for example `user: "1026:100"`.
+
 ### My browser warns about the certificate
 
 That's expected with the default self-signed certificate. At home, accept the warning; the connection is still encrypted. To get rid of it, use Let's Encrypt or a reverse proxy. See [Reach your server from outside your home](./getting-started/remote-access.md).
 
 ### Where do I find the server's log?
 
-In the admin console under [Server > Logs](./admin/server.md#logs). It holds the newest lines since the last restart. For older lines and the first-run banner, use `docker compose logs`, `journalctl -u audiosilo`, or the terminal you started the server from.
+In the admin console under [Server > Logs](./admin/server.md#logs). It holds the newest lines since the last restart. For older lines and the first-run banner, use `docker compose logs`, `journalctl -u audiosilo`, or the terminal you started the server from. On a NAS, use its container app's log view ([Unraid](./getting-started/install-unraid.md#2-save-your-password), [Synology](./getting-started/install-synology.md#5-save-your-password)).
 
 ### I lost the first-run admin password
 
@@ -148,6 +173,7 @@ See [Getting AudioSilo into the car](./listening/in-the-car.md#getting-audiosilo
 
 - **Wrong folder path.** Under Docker, the library's folder is the path inside the container (like `/library`), not on the host. Check it in [Libraries](./admin/libraries.md).
 - **A network share dropped.** The server keeps every book and everyone's progress, and marks the library **Folder unavailable**. Remount the share, then press **Retry** on the library.
+- **The server can't read the folder.** The library also shows **Folder unavailable**. See [Permission denied](#permission-denied).
 
 AudioSilo never deletes your files.
 
diff --git a/screenshots/manifest.mjs b/screenshots/manifest.mjs
index 80441894..1e11ff76 100644
--- a/screenshots/manifest.mjs
+++ b/screenshots/manifest.mjs
@@ -53,7 +53,7 @@ export const SHOTS = [
   {file: 'web-player/you-stats.png', capture: 'web', title: 'Web player - Your listening', hint: "You in the top bar (Stats; the sub-nav Stats, Year in listening, Journal and Household): the header with this week, the four stat tiles (week, streak, goal, daily average), the listening calendar, the clock and hours per week (the seeded year of listening)"},
   {file: 'web-player/year.png', capture: 'web', title: 'Web player - Year in listening', hint: 'You > Year in listening: the story card on stage (held: the pointer parked on it) beside the title, how it works, the thumbnails and Share this card'},
   {file: 'web-player/settings.png', capture: 'web', title: 'Web player - Settings', hint: 'Settings from the top bar gear: the grouped section nav (Listening, App, Servers) with Playback open beside it (the steppers, then the Smart speed and Voice boost switches)'},
-  {file: 'web-player/account.png', capture: 'web', title: 'Web player - Account', hint: "the admin's account page in a fresh browser signed in by password (Account on, from the profile menu): identity, the Password and Pair another device cards, the signed-in devices, Listening sync (everything on the server, not synced from this device yet), Personal API keys, Sign out (no At home and away card: the capture server is on loopback)"},
+  {file: 'web-player/account.png', capture: 'web', title: 'Web player - Account', hint: "the admin's account page in a fresh browser signed in by password (Account on, from the profile menu): identity, the Password and Pair another device cards, the Proxy headers card (its https-only caption: the capture server is plain http), the signed-in devices, Listening sync (everything on the server, not synced from this device yet), Personal API keys, Sign out (no At home and away card: the capture server is on loopback)"},
   {file: 'web-player/account-listening-sync.png', capture: 'web', title: 'Web player - Listening sync card', hint: "the same account page's Listening sync card, clipped, after a reload sent a listen of The Art of War whose length is two minutes off the server's: Last synced just now, Couldn't sync with the book's row (1:02:13 to 1:22:13 style span), This copy of the book is a different length from the server's, and Discard"},
   {file: 'web-player/book-place-offer.png', capture: 'web', title: 'Web player - Another device\'s place', hint: "the demo listener's Looking-Glass page after a second device of the account (Pixel 8) synced a place well behind it without seeing it: under the actions, On Pixel 8: <chapter, time> · Play from there (the offer is cleared again afterwards)"},
   {file: 'web-player/downloads.png', capture: 'web', title: 'Web player - Downloads', hint: 'the Downloads page with a book downloaded by hand (the web player starts at Never, so the playing book is not kept automatically): storage by server, Automatic downloads (Never, with its hint "Nothing downloads on its own. Download a book from its page.", then Download podcast episodes when you start them (off) and Keep the next books ready), the browser notice, Ready offline'},
diff --git a/sidebars-users.ts b/sidebars-users.ts
index eecfa79d..e01ad156 100644
--- a/sidebars-users.ts
+++ b/sidebars-users.ts
@@ -15,6 +15,7 @@ const sidebars: SidebarsConfig = {
       items: [
         'getting-started/quickstart-docker',
         'getting-started/install-unraid',
+        'getting-started/install-synology',
         'getting-started/install-binary',
         'getting-started/first-run',
         'getting-started/organizing-your-library',
diff --git a/static/img/screenshots/web-player/account.png b/static/img/screenshots/web-player/account.png
index 254fbd33..dd111cc9 100644
Binary files a/static/img/screenshots/web-player/account.png and b/static/img/screenshots/web-player/account.png differ