Merge pull request #447 from outis1one/claude/pensive-hopper-4c9e7i

Fix anki-sync-server container failing to start: data/ ownership

CLAUDE.md

@@ -623,6 +623,25 @@ in `services/authelia.sh`) — prompts for a new duration (`12h`, `7d`,
 Sessions persist through reboots regardless of duration (Redis stores
 session state in a volume).
 
+**`inactivity` must track `remember_me`, or a long remember_me is a lie.**
+`inactivity` is a separate session field — how long a session can sit idle
+before Authelia ends it — and it is NOT extended or bypassed by the
+"Remember me" checkbox; the two are independent. Confirmed live: a user
+set `remember_me: 1y` expecting "won't be asked to log in again for a
+year," but the install default left `inactivity` at a much shorter value
+(2h at the time), so ordinary daily gaps between visits (overnight, a
+workday) ended the session on inactivity grounds well before remember_me
+ever came into play — the 1y setting was doing nothing. Fixed at both ends
+so this can't recur silently: `install_authelia()`'s own template now sets
+`inactivity: 7d`, matching its `remember_me: 7d` default instead of a
+shorter one, and `_authelia_set_remember_me()` now writes the SAME new
+duration into both keys on every change, not just `remember_me` alone. If
+you ever hand-edit `session:` instead of using the menu option, keep
+`inactivity` and `remember_me` equal — a mismatch here is exactly the bug
+above, not a valid intentional configuration. `expiration` (the cap for a
+session that never checked "Remember me") is a legitimately different,
+shorter-by-design setting and is untouched by any of this.
+
 **The config key is `remember_me`, not `remember_me_duration`.** Authelia
 renamed it in 4.38; this repo pins `4.39.20`. A stale `remember_me_duration`
 key doesn't error, Authelia just silently ignores it — confirmed against
@@ -635,7 +654,7 @@ touch this by hand instead of the menu option, the current schema is:
 session:
   secret: 'your-existing-secret'
   expiration: 1h
-  inactivity: 5m
+  inactivity: 1y
   remember_me: 1y
   cookies:
     - domain: 'example.com'

README.md

@@ -186,7 +186,7 @@ a ready-to-copy Caddy config snippet to `~/docker/caddy-snippets/`.
 |-------|---------|
 | `base` | `net-tools`, `ncdu`, `git`, `curl`, `wget`, `htop`, `tree`, `zip`/`unzip`, `ca-certificates`, `gnupg`, `jq`, `rsync`; `glow` (terminal markdown reader, Charm apt repo); Docker CE + Compose plugin; `openssh-server` with GitHub/Launchpad SSH key import, optional password-auth lockdown, and SSH Host aliases; optional NetBird overlay network |
 | `homelab` | `caddy`, `crowdsec`, `authelia`, `homeassistant`, `asterisk` (own dedicated coturn for TURN/STUN — see `mattermost` below for the other coturn-owning service), `pstn-trunk`, `sms-inbound`, `security-dashboard`, `sunshine`, `vpn-data-mount` (mount existing SMB shares from a NetBird-connected home box — SSH trust bootstrap, then read-only discovery of shares already configured there; never writes to the home box's Samba config; repeatable, pick from any number of a home box's shares in one pass; optional per-share [gocryptfs decrypt layer](#client-side-encryption-for-vpn-data-mount) so the VPS only ever handles ciphertext) |
-| `utilities` | `actualbudget`, `ai-gpu`, `ai-stack`, `archivebox`, `beszel` (lightweight server + Docker monitoring — CPU/RAM/disk/network, auto-discovers running containers via the Docker socket; complements Gatus rather than replacing it — Gatus is a black-box HTTP check, Beszel is white-box host/process monitoring), `beszel-agent` (agent-only Beszel install for a remote/homelab box reporting to a hub elsewhere — connects outbound over HTTPS, no VPN/port-forwarding/FQDN needed on that box), `changedetection`, `ddclient`, `filebrowser`, `fmd`, `garage` (self-hosted S3-compatible object storage, single node — MinIO CE's actively-maintained replacement), `garage-webui` (browser-based bucket/object browser for an existing `garage` install — folders/files view, the same kind of thing Backblaze's own web console gives you), `gatus`, `gitea` (self-hosted Git server — raw local clones plus optional two-way GitHub mirror sync, standalone from the `ai-stack` bundle's own Gitea container), `homebox`, `iopaint`, `joplin`, `koha`, `magicmirror`, `mail-archiver`, `mattermost`, `mealie`, `meshcentral`, `n8n`, `nextcloud`, `ntfy`, `onlyoffice`, `paintplus`, `pihole` (standalone DNS ad/tracker blocking — not wired into any VPN's DNS push), `portainer`, `pressbooks` (self-hosted book platform — WordPress Multisite, drag-and-drop chapter editing, PDF export via PrinceXML/DocRaptor, Authelia-gated), `rustdesk`, `samba` (SMB/CIFS file sharing — shares, dedicated Samba users/passwords, LAN-scoped firewall by default; also offered as an optional nudge from `base`), `stirling-pdf`, `syncthing`, `traccar`, `unifi`, `uptimekuma`, `vaultwarden`, `watchyourlan`, `watchtower`, `wg-easy`, `wordpress` (multi-site, dedicated MariaDB per site — blogs, business sites, e-commerce via WooCommerce) |
+| `utilities` | `actualbudget`, `ai-gpu`, `ai-stack`, `anki-sync-server` (self-hosted sync backend for the Anki flashcard app — spaced-repetition scheduling stays in the Anki client, this just syncs collections across devices without AnkiWeb; supports multiple independent accounts per instance), `archivebox`, `beszel` (lightweight server + Docker monitoring — CPU/RAM/disk/network, auto-discovers running containers via the Docker socket; complements Gatus rather than replacing it — Gatus is a black-box HTTP check, Beszel is white-box host/process monitoring), `beszel-agent` (agent-only Beszel install for a remote/homelab box reporting to a hub elsewhere — connects outbound over HTTPS, no VPN/port-forwarding/FQDN needed on that box), `changedetection`, `ddclient`, `filebrowser`, `fmd`, `garage` (self-hosted S3-compatible object storage, single node — MinIO CE's actively-maintained replacement), `garage-webui` (browser-based bucket/object browser for an existing `garage` install — folders/files view, the same kind of thing Backblaze's own web console gives you), `gatus`, `gitea` (self-hosted Git server — raw local clones plus optional two-way GitHub mirror sync, standalone from the `ai-stack` bundle's own Gitea container), `homebox`, `iopaint`, `joplin`, `koha`, `magicmirror`, `mail-archiver`, `mattermost`, `mealie`, `meshcentral`, `n8n`, `nextcloud`, `ntfy`, `onlyoffice`, `paintplus`, `pihole` (standalone DNS ad/tracker blocking — not wired into any VPN's DNS push), `portainer`, `pressbooks` (self-hosted book platform — WordPress Multisite, drag-and-drop chapter editing, PDF export via PrinceXML/DocRaptor, Authelia-gated), `rustdesk`, `samba` (SMB/CIFS file sharing — shares, dedicated Samba users/passwords, LAN-scoped firewall by default; also offered as an optional nudge from `base`), `stirling-pdf`, `syncthing`, `traccar`, `unifi`, `uptimekuma`, `vaultwarden`, `watchyourlan`, `watchtower`, `wg-easy`, `wordpress` (multi-site, dedicated MariaDB per site — blogs, business sites, e-commerce via WooCommerce) |
 | `media` | `arm`, `audiobookshelf`, `calibre-web`, `emby`, `immich`, `jellyfin`, `lyrion` |
 | `cameras` | `frigate`, `frigate-audio`, `frigate-notify`, `sky-cam` |
 | `gaming` | `drum-rhythm-game`, `js99er`, `kyber-launcher`, `kyber-server`, `minecraft`, `wolf`, `wolf-pair` |

services/anki-sync-server.md

@@ -0,0 +1,82 @@
+## Client setup — pointing Anki at this server instead of AnkiWeb
+
+Every client below needs the **Sync URL** and one of the **accounts** shown
+higher up in this README. Do this on every device you want synced — a client
+still pointed at AnkiWeb won't see collections synced here, and vice versa.
+
+### Anki Desktop (2.1.66 and newer)
+1. **Preferences → Network**
+2. Tick **"Self-hosted sync server"**
+3. Paste the Sync URL into the field that appears
+4. **Sync → log in** with one of the accounts above
+
+### Anki Desktop (older than 2.1.66)
+There's no GUI field yet — set an environment variable before launching Anki
+instead, then sync normally:
+```bash
+# Linux/macOS
+export SYNC_ENDPOINT="https://your-sync-url/"
+anki
+
+# Windows (Command Prompt)
+set SYNC_ENDPOINT=https://your-sync-url/
+anki.exe
+```
+Upgrading Anki to 2.1.66+ is the easier long-term fix — do that if you're
+setting this up for anyone who isn't comfortable with environment variables.
+
+### AnkiDroid
+**Settings → Advanced → Custom sync server**, then enter the Sync URL and
+log in with one of the accounts above (AnkiDroid 2.16+; update the app if
+this option isn't there).
+
+### AnkiMobile (iOS)
+**Settings → Advanced → Custom Sync Server**, same as AnkiDroid — enter the
+Sync URL and log in.
+
+### First sync on each device
+The very first sync from a device that already has a local collection will
+ask whether to upload local data or download from the server — pick upload
+from whichever device has your real collection, and download on every other
+device, or you'll end up with two different collections that never merge.
+
+## Importing your existing Quizlet sets
+
+This server only handles syncing already-existing Anki collections — it
+doesn't import anything itself. Quizlet import happens once, locally, in the
+Anki desktop app, before your first sync:
+
+1. **In Quizlet:** open the set → **Export** → choose the plain-text /
+   tab-separated format (Quizlet's export dialog lets you pick the delimiter
+   between term and definition, and between rows — tab and newline are the
+   Anki-friendly defaults) → copy the exported text or download it as a
+   `.txt`/`.csv` file.
+2. **In Anki Desktop:** **File → Import**, pick the file (or paste the text
+   into a `.txt` file first if you copied it to the clipboard).
+3. Map the two columns to **Front** and **Back** in the import dialog, pick
+   or create the deck and note type, and import.
+4. For **math facts or other simple front/back cards**, the Basic note type
+   is enough. For **more complex cards** (extra example fields, images,
+   audio, cloze deletions), switch the note type in the import dialog to a
+   template with more fields, or convert cards afterward — Anki's own
+   built-in note types (Basic, Basic (and reversed card), Cloze) cover most
+   of what Quizlet's own card types can do.
+5. Sync from this device once the import looks right, so the imported deck
+   becomes the copy every other device downloads.
+
+### Exporting back out (Anki → Quizlet or anywhere else)
+**File → Export**, choose "Notes in Plain Text" and pick the deck — this
+produces the same tab-separated format Quizlet's own import expects, so the
+round trip works in both directions.
+
+## Why spaced repetition here actually reschedules failed cards
+
+Anki's scheduler (FSRS, the default since recent Anki versions) tracks a
+per-card memory-strength estimate and schedules the next review right before
+you'd be expected to forget it. Answering "Again" on a card doesn't just
+requeue it for later the same session — it lowers that card's estimated
+strength, which shortens every subsequent interval for it until you've
+proven you know it again, so a card you keep failing gets shown far more
+often than one you consistently get right. This is scheduling logic inside
+the Anki client itself; this sync server only stores and syncs the resulting
+review history, it doesn't change how reviews are scheduled.

services/anki-sync-server.sh

@@ -0,0 +1,669 @@
+#!/bin/bash
+# services/anki-sync-server.sh — Self-hosted Anki flashcard sync server.
+# Part of the modular post-install system (sourced by setup.sh).
+#
+# Can also be run standalone on any machine:
+#   sudo bash anki-sync-server.sh
+# (Docker must already be installed when run standalone)
+
+# ── Standalone bootstrap ──────────────────────────────────────────────────────
+# Detected when the script is executed directly rather than sourced by setup.sh.
+# Sets up helpers and globals, then defers execution until after the function
+# definition at the bottom of this file.
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    [[ "$(id -u)" == "0" ]] || { echo "Run with sudo: sudo bash $0"; exit 1; }
+
+    _SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+    _COMMON="$_SELF_DIR/../lib/common.sh"
+
+    if [[ -f "$_COMMON" ]]; then
+        # Full repo present — use the real helpers (picks up ~/docker/.config too)
+        # shellcheck source=../lib/common.sh
+        source "$_COMMON"
+    else
+        # One-off copy — inline minimal stubs so the script works without the repo
+        log_info()    { echo -e "\033[0;34m[INFO]\033[0m $*"; }
+        log_success() { echo -e "\033[0;32m[OK]\033[0m $*"; }
+        log_warning() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
+        log_error()   { echo -e "\033[0;31m[ERROR]\033[0m $*" >&2; }
+
+        require_docker() {
+            command -v docker &>/dev/null || {
+                log_error "Docker not found. Install it first:"
+                log_error "  curl -fsSL https://get.docker.com | sudo sh"
+                return 1
+            }
+            docker compose version &>/dev/null || {
+                log_error "Docker Compose plugin missing:"
+                log_error "  sudo apt-get install -y docker-compose-plugin"
+                return 1
+            }
+        }
+
+        ensure_docker_dir_ownership() {
+            chown -R "$ACTUAL_USER:$ACTUAL_USER" "$@" 2>/dev/null || true
+        }
+
+        port_in_use() {
+            local _port="$1" _proto="${2:-tcp}"
+            local _flag="-tlnH"
+            [ "$_proto" = "udp" ] && _flag="-ulnH"
+            ss "$_flag" "sport = :${_port}" 2>/dev/null | grep -q .
+        }
+
+        find_free_port() {
+            local _varname="$1" _port="$2" _proto="${3:-tcp}"
+            while port_in_use "$_port" "$_proto"; do
+                _port=$((_port + 1))
+            done
+            eval "$_varname='$_port'"
+        }
+
+        # Match common.sh's eval-based pattern so local vars in install_* are set correctly
+        prompt_text() {
+            local _q="$1" _def="$2" _var="$3" _r
+            [[ "${UNATTENDED:-false}" == "true" ]] && { eval "$_var='$_def'"; return; }
+            read -r -p "  $_q " _r
+            eval "$_var='${_r:-$_def}'"
+        }
+
+        prompt_yn() {
+            local _q="$1" _def="$2" _var="$3" _r
+            [[ "${UNATTENDED:-false}" == "true" ]] && { eval "$_var='$_def'"; return; }
+            read -r -p "  $_q " _r
+            eval "$_var='${_r:-$_def}'"
+        }
+
+        prompt_reinstall_mode() {
+            local _var="$1" _r
+            if [[ "${UNATTENDED:-false}" == "true" ]]; then eval "$_var='cancel'"; return; fi
+            echo "  Already installed."
+            read -r -p "  (u)pdate / (f)resh reinstall / (c)ancel [c]: " _r
+            case "${_r,,}" in
+                u|update) eval "$_var='update'" ;;
+                f|fresh)  eval "$_var='fresh'"  ;;
+                *)        eval "$_var='cancel'" ;;
+            esac
+        }
+
+        generate_password() {
+            local length="${1:-32}"
+            openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | head -c "$length"
+        }
+
+        configure_caddy_for_service() {
+            local _name="$1" _upstream="$2" _subdomain="$3" _extra="${4:-}"
+            local _caddy_dir="$DOCKER_DIR/caddy"
+            local _caddyfile="$_caddy_dir/Caddyfile"
+            local _display_port="${_upstream##*:}"
+
+            # Determine mode: local Caddy, remote Caddy, or none
+            local _mode="none"
+            [[ -d "$_caddy_dir" ]] && _mode="local"
+            [[ -n "${CADDY_REMOTE_HOST:-}" ]] && [[ "$_mode" != "local" ]] && _mode="remote"
+            [[ "$_mode" == "none" ]] && {
+                log_info "Access $_name directly on port $_display_port."
+                return 0
+            }
+
+            echo ""
+            local _do_caddy=""
+            if [[ "$_mode" == "remote" ]]; then
+                log_info "Remote Caddy configured (${CADDY_REMOTE_HOST})."
+                log_info "A snippet file will be saved to ~/docker/caddy-snippets/."
+            fi
+            read -r -p "  Configure Caddy reverse proxy for $_name? [y/N]: " _do_caddy
+            [[ "${_do_caddy,,}" == "y" ]] || {
+                log_info "Skipping — access at: http://localhost:$_display_port"
+                return 0
+            }
+
+            # Domain prompt — pre-fill from SITE_DOMAIN when available
+            local _default_domain=""
+            if [[ -n "${SITE_DOMAIN:-}" ]] && [[ "$SITE_DOMAIN" != "example.com" ]]; then
+                _default_domain="${_subdomain}.${SITE_DOMAIN}"
+                log_info "Default: $_default_domain"
+            fi
+            local _domain=""
+            read -r -p "  Domain [${_default_domain:-required}]: " _domain
+            _domain="${_domain:-$_default_domain}"
+            [[ -n "$_domain" ]] || { log_warning "No domain entered — skipping Caddy."; return 0; }
+
+            # Build upstream — remote Caddy uses host IP:port, not container name
+            local _block_upstream="$_upstream"
+            if [[ "$_mode" == "remote" ]]; then
+                _block_upstream="${CADDY_REMOTE_HOST}:${_display_port}"
+            fi
+
+            local _site_block
+            _site_block="$(cat << CBLOCK
+
+# $_name
+${_domain} {
+    reverse_proxy ${_block_upstream}
+
+    header {
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        X-Content-Type-Options "nosniff"
+        X-Frame-Options "SAMEORIGIN"
+        Referrer-Policy "strict-origin-when-cross-origin"
+    }
+
+    log {
+        output file /var/log/caddy/${_domain}.log
+        format json
+    }
+${_extra}
+}
+CBLOCK
+)"
+
+            if [[ "$_mode" == "local" ]]; then
+                if [[ -f "$_caddyfile" ]]; then
+                    local _bk="$_caddy_dir/Caddyfile.backup.$(date +%Y%m%d-%H%M%S)"
+                    cp "$_caddyfile" "$_bk"
+                    log_info "Backed up Caddyfile to $(basename "$_bk")"
+                else
+                    touch "$_caddyfile"
+                fi
+
+                if grep -q "^${_domain}" "$_caddyfile" 2>/dev/null; then
+                    log_warning "$_domain already in Caddyfile"
+                    local _ow=""
+                    read -r -p "  Overwrite? [y/N]: " _ow
+                    [[ "${_ow,,}" == "y" ]] || { log_info "Keeping existing entry."; return 0; }
+                    sed -i "/^${_domain}/,/^}/d" "$_caddyfile"
+                fi
+
+                printf '%s\n' "$_site_block" >> "$_caddyfile"
+                log_success "Added $_domain to Caddyfile"
+                docker exec caddy caddy fmt --overwrite /etc/caddy/Caddyfile 2>/dev/null || true
+                if docker exec caddy caddy reload --config /etc/caddy/Caddyfile 2>/dev/null; then
+                    log_success "$_name accessible at: https://$_domain"
+                else
+                    log_warning "Reload failed — check: docker logs caddy"
+                    log_info "Manual reload: docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
+                fi
+            else
+                local _snippet_dir="$DOCKER_DIR/caddy-snippets"
+                local _snippet_file="$_snippet_dir/${_subdomain}.caddy"
+                mkdir -p "$_snippet_dir"
+                printf '%s\n' "$_site_block" > "$_snippet_file"
+                chown "$ACTUAL_USER:$ACTUAL_USER" "$_snippet_file" 2>/dev/null || true
+                log_success "Snippet saved: $_snippet_file"
+                log_info "Copy to Caddy machine:"
+                log_info "  scp $_snippet_file caddy-host:~/caddy-snippets/"
+                log_info "  rsync -av $_snippet_dir/ caddy-host:~/caddy-snippets/  (all at once)"
+            fi
+        }
+        write_readme() {
+            local _dir="$1"; shift
+            mkdir -p "$_dir"
+            cat > "$_dir/README.md"
+        }
+        backup_if_exists() {
+            local _file="$1"
+            [ -f "$_file" ] || return 0
+            cp -p "$_file" "${_file}.bak.$(date +%Y%m%d-%H%M%S)" 2>/dev/null
+        }
+    fi
+
+    # Globals — ACTUAL_USER/ACTUAL_HOME must come before DOCKER_DIR
+    # ($HOME under sudo is /root, not the real user's home)
+    ACTUAL_USER="${ACTUAL_USER:-${SUDO_USER:-$USER}}"
+    ACTUAL_HOME="$(getent passwd "$ACTUAL_USER" 2>/dev/null | cut -d: -f6 || echo "${HOME:-/root}")"
+    DOCKER_DIR="${DOCKER_DIR:-$ACTUAL_HOME/docker}"
+    DRY_RUN="${DRY_RUN:-false}"
+    UNATTENDED="${UNATTENDED:-false}"
+    SITE_TZ="${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}"
+    SITE_DOMAIN="${SITE_DOMAIN:-example.com}"
+    SITE_CADDY_NET="${SITE_CADDY_NET:-caddy_net}"
+
+    register_service() { :; }   # no-op — no wizard to register into
+    _RUN_STANDALONE=1
+fi
+# ─────────────────────────────────────────────────────────────────────────────
+
+register_service anki-sync-server utilities "Self-hosted Anki flashcard sync server (spaced repetition, syncs across devices without AnkiWeb)" 8080
+
+# Reads the current ANKI_SYNC_USERn/ANKI_SYNC_PASSWORDn pairs out of an
+# instance's .env into the caller's ANKI_USERS/ANKI_PASSWORDS arrays (bash's
+# dynamic scoping means a `local` array declared in the caller is visible
+# here without being passed explicitly — same assumption every other helper
+# below makes). Numbering is always kept contiguous from 1 by
+# _anki_rewrite_account_block, so stopping at the first missing index is
+# safe — there's never a gap to skip over.
+_anki_load_accounts() {
+    local _dir="$1" _n=1 _u _p
+    ANKI_USERS=() ANKI_PASSWORDS=()
+    while true; do
+        _u="$(grep "^ANKI_SYNC_USER${_n}=" "$_dir/.env" 2>/dev/null | cut -d= -f2-)"
+        [ -z "$_u" ] && break
+        _p="$(grep "^ANKI_SYNC_PASSWORD${_n}=" "$_dir/.env" 2>/dev/null | cut -d= -f2-)"
+        ANKI_USERS+=("$_u")
+        ANKI_PASSWORDS+=("$_p")
+        _n=$((_n + 1))
+    done
+}
+
+# Regenerates the SYNC_USERn=... lines in docker-compose.yml and the
+# matching ANKI_SYNC_USERn/ANKI_SYNC_PASSWORDn pairs in .env from the
+# caller's current ANKI_USERS/ANKI_PASSWORDS arrays (always renumbered
+# contiguously from 1 — see _anki_load_accounts). Used by both the initial
+# install and every account-management mutation (add/remove/rotate) so the
+# two never drift apart, same reasoning as CLAUDE.md's shared-helper
+# guidance for update vs. fresh-install codepaths. Leaves the port, Caddy
+# block, and every other line in either file untouched — only lines
+# matching the SYNC_USER/ANKI_SYNC_* patterns are touched.
+_anki_rewrite_account_block() {
+    local _dir="$1"
+    local _compose="$_dir/docker-compose.yml"
+    local _env="$_dir/.env"
+
+    sed -i '/^      - SYNC_USER[0-9]\+=/d' "$_compose"
+    sed -i '/^ANKI_SYNC_USER[0-9]\+=/d; /^ANKI_SYNC_PASSWORD[0-9]\+=/d' "$_env"
+
+    local _compose_lines="" _env_lines="" i idx
+    for i in "${!ANKI_USERS[@]}"; do
+        idx=$((i + 1))
+        _compose_lines+="      - SYNC_USER${idx}=\${ANKI_SYNC_USER${idx}}:\${ANKI_SYNC_PASSWORD${idx}}
+"
+        _env_lines+="ANKI_SYNC_USER${idx}=${ANKI_USERS[$i]}
+ANKI_SYNC_PASSWORD${idx}=${ANKI_PASSWORDS[$i]}
+"
+    done
+
+    # Insert right after the fixed SYNC_BASE anchor line — always present,
+    # written by every version of this script's install flow — instead of
+    # appending at the end, so the block stays grouped with SYNC_HOST/
+    # SYNC_PORT/SYNC_BASE rather than drifting after `volumes:`.
+    local _tmp
+    _tmp="$(mktemp)"
+    printf '%s' "$_compose_lines" > "$_tmp"
+    sed -i "\|^      - SYNC_BASE=/data\$|r $_tmp" "$_compose"
+    rm -f "$_tmp"
+
+    printf '%s' "$_env_lines" >> "$_env"
+}
+
+# Interactive add/remove/rotate menu for an existing instance's sync
+# accounts, offered from install_anki-sync-server's "already installed"
+# menu. Every mutation restarts the container (`docker compose up -d`
+# re-reads .env for the new/removed/rotated credentials) but never touches
+# the port, Caddy config, or the image — the things CLAUDE.md's "update vs.
+# fresh reinstall" convention says a non-destructive path must leave alone.
+_anki_manage_accounts() {
+    local _dir="$1"
+    local ANKI_USERS=() ANKI_PASSWORDS=()
+    while true; do
+        _anki_load_accounts "$_dir"
+        echo ""
+        echo "  Current sync accounts:"
+        local i
+        for i in "${!ANKI_USERS[@]}"; do
+            echo "    $((i + 1))) ${ANKI_USERS[$i]}"
+        done
+        [ "${#ANKI_USERS[@]}" -eq 0 ] && echo "    (none)"
+        echo ""
+        echo "  a) Add an account"
+        echo "  r) Remove an account"
+        echo "  p) Rotate (reset) an account's password"
+        echo "  0) Done"
+        echo ""
+        local ACTION=""
+        prompt_text "  Choice [a/r/p/0]:" "0" ACTION
+        case "$ACTION" in
+            a|A)
+                if [ "${#ANKI_USERS[@]}" -ge 8 ]; then
+                    log_warning "That's plenty — stopping at 8 accounts."
+                    continue
+                fi
+                local _u=""
+                prompt_text "  New username:" "" _u
+                if [ -z "$_u" ]; then
+                    log_warning "Name can't be empty."; continue
+                fi
+                ANKI_USERS+=("$_u")
+                ANKI_PASSWORDS+=("$(generate_password 24)")
+                _anki_rewrite_account_block "$_dir"
+                ( cd "$_dir" && docker compose up -d ) \
+                    && log_success "Account '$_u' added — password: ${ANKI_PASSWORDS[-1]} (also saved in $_dir/.env)" \
+                    || log_warning "Container restart failed — check: docker compose -f $_dir/docker-compose.yml logs"
+                ;;
+            r|R)
+                if [ "${#ANKI_USERS[@]}" -eq 0 ]; then
+                    log_warning "No accounts to remove."; continue
+                fi
+                local _n=""
+                prompt_text "  Remove which number?" "" _n
+                if ! [[ "$_n" =~ ^[0-9]+$ ]] || [ "$_n" -lt 1 ] || [ "$_n" -gt "${#ANKI_USERS[@]}" ]; then
+                    log_warning "Invalid choice."; continue
+                fi
+                local _removed="${ANKI_USERS[$((_n - 1))]}"
+                unset 'ANKI_USERS[_n - 1]' 'ANKI_PASSWORDS[_n - 1]'
+                ANKI_USERS=("${ANKI_USERS[@]}")
+                ANKI_PASSWORDS=("${ANKI_PASSWORDS[@]}")
+                _anki_rewrite_account_block "$_dir"
+                ( cd "$_dir" && docker compose up -d ) \
+                    && log_success "Account '$_removed' removed" \
+                    || log_warning "Container restart failed — check: docker compose -f $_dir/docker-compose.yml logs"
+                ;;
+            p|P)
+                if [ "${#ANKI_USERS[@]}" -eq 0 ]; then
+                    log_warning "No accounts yet."; continue
+                fi
+                local _n=""
+                prompt_text "  Rotate password for which number?" "" _n
+                if ! [[ "$_n" =~ ^[0-9]+$ ]] || [ "$_n" -lt 1 ] || [ "$_n" -gt "${#ANKI_USERS[@]}" ]; then
+                    log_warning "Invalid choice."; continue
+                fi
+                ANKI_PASSWORDS[$((_n - 1))]="$(generate_password 24)"
+                _anki_rewrite_account_block "$_dir"
+                ( cd "$_dir" && docker compose up -d ) \
+                    && log_success "New password for '${ANKI_USERS[$((_n - 1))]}': ${ANKI_PASSWORDS[$((_n - 1))]} (also saved in $_dir/.env)" \
+                    || log_warning "Container restart failed — check: docker compose -f $_dir/docker-compose.yml logs"
+                ;;
+            0)
+                break
+                ;;
+            *)
+                log_warning "Unrecognized choice."
+                ;;
+        esac
+    done
+}
+
+install_anki-sync-server() {
+    require_docker || return 1
+    log_info "Installing Anki Sync Server..."
+
+    # ── Instance selection ───────────────────────────────────────────────────
+    # First instance keeps the plain "anki-sync-server" name/paths/port exactly
+    # as before (zero behavior change for anyone with a single instance). Only
+    # asking to add a second one introduces suffixed naming — same pattern as
+    # services/ntfy.sh and services/homebox.sh. A second instance is a real
+    # use case here (e.g. a second household wanting fully separate data on
+    # the same box) even though one instance already supports multiple
+    # independent accounts via SYNC_USER1/SYNC_USER2/... — see CLAUDE.md's
+    # "Multi-instance services" section.
+    local ANKI_DIR="$DOCKER_DIR/anki-sync-server"
+    local INSTANCE_SUFFIX="" CONTAINER="anki-sync-server"
+    local WEB_PORT="8080"
+
+    if [ "$DRY_RUN" = true ]; then
+        echo "[DRY-RUN] Would offer to add a new, separate instance if one already exists"
+        echo "[DRY-RUN] Would create $ANKI_DIR(-<name>)"
+        echo "[DRY-RUN] Would prompt for one or more sync accounts and generate passwords"
+        echo "[DRY-RUN] Would write docker-compose.yml and .env"
+        echo "[DRY-RUN] Would auto-scan for a free host port"
+        return 0
+    fi
+
+    if [ -d "$ANKI_DIR" ]; then
+        echo ""
+        echo "  Anki Sync Server is already installed at $ANKI_DIR."
+        echo "    1) Manage sync accounts (add / remove / rotate a password — doesn't"
+        echo "       touch the port, Caddy, or the image)"
+        echo "    2) Manage that install (update image / full reinstall / cancel)"
+        echo "    3) Add a NEW, separate Anki Sync Server instance alongside it (its"
+        echo "       own data and port — full isolation)"
+        echo ""
+        local _TOP_CHOICE=""
+        prompt_text "  Choice [1/2/3]:" "2" _TOP_CHOICE
+        if [ "$_TOP_CHOICE" = "1" ]; then
+            _anki_manage_accounts "$ANKI_DIR"
+            return 0
+        elif [ "$_TOP_CHOICE" = "3" ]; then
+            local _suffix=""
+            while true; do
+                prompt_text "  Short name for the new instance (letters/numbers/hyphens, e.g. 'family'):" "" _suffix
+                _suffix="$(echo "$_suffix" | tr -cs 'a-zA-Z0-9-' '-' | sed 's/^-*//;s/-*$//')"
+                if [ -z "$_suffix" ]; then
+                    log_warning "Name can't be empty."; continue
+                fi
+                if [ -d "$DOCKER_DIR/anki-sync-server-$_suffix" ]; then
+                    log_warning "anki-sync-server-$_suffix already exists — pick another name."; continue
+                fi
+                break
+            done
+            INSTANCE_SUFFIX="$_suffix"
+            ANKI_DIR="$DOCKER_DIR/anki-sync-server-$_suffix"
+            CONTAINER="anki-sync-server-$_suffix"
+            log_info "New instance: $ANKI_DIR"
+        else
+            # "Manage that install" on THIS instance — the banner above promises
+            # update/fresh/cancel, so actually offer it instead of falling straight
+            # through into the same unconditional-overwrite flow as a new install.
+            if [[ -f "$ANKI_DIR/docker-compose.yml" ]]; then
+                local MODE=""
+                prompt_reinstall_mode MODE
+                case "$MODE" in
+                    update)
+                        log_info "Refreshing the Anki Sync Server image only — existing accounts, port, and Caddy setup are left as-is."
+                        # The image is a Google distroless "nonroot" build (fixed UID/GID
+                        # 65532, no shell — it can't chown anything itself at startup), so
+                        # ./data has to already be writable by that exact UID or the
+                        # container fails to start. Versions of this installer before this
+                        # fix chowned it to ACTUAL_USER instead, which the container can't
+                        # write to — re-asserting the correct ownership here repairs any
+                        # install made under that bug, non-destructively (it's the
+                        # installer's own bug being corrected, not a config choice, so it
+                        # belongs in the non-destructive update path).
+                        chown -R 65532:65532 "$ANKI_DIR/data" 2>/dev/null
+                        ( cd "$ANKI_DIR" && docker compose pull && docker compose up -d ) \
+                            && log_success "Anki Sync Server image refreshed" \
+                            || log_warning "Refresh failed — check: docker compose -f $ANKI_DIR/docker-compose.yml logs"
+                        return 0
+                        ;;
+                    cancel)
+                        log_info "Leaving the existing install as-is."
+                        return 0
+                        ;;
+                    fresh) ;;  # fall through to the full install flow below
+                esac
+            fi
+        fi
+    fi
+
+    # Scan for a free port unconditionally — not just when adding an explicit
+    # additional instance. A plain first install can just as easily collide
+    # with an unrelated service that already claimed this default port — see
+    # CLAUDE.md's "Port collision avoidance" section.
+    find_free_port WEB_PORT "$WEB_PORT"
+
+    # ── Sync accounts ─────────────────────────────────────────────────────────
+    # The official sync server has no signup flow of its own — accounts are
+    # fixed credentials baked in as SYNC_USER1, SYNC_USER2, ... at container
+    # start, one per line in .env. Ask for at least one now (each Anki client
+    # — desktop, AnkiDroid, AnkiMobile — logs in with one of these) and offer
+    # to add more for other people sharing this box, since a single instance
+    # already keeps each account's collection completely separate.
+    local ANKI_USERS=() ANKI_PASSWORDS=()
+    local _u=""
+    prompt_text "  Username for your Anki sync account:" "$ACTUAL_USER" _u
+    ANKI_USERS+=("$_u")
+    ANKI_PASSWORDS+=("$(generate_password 24)")
+    while true; do
+        local _more=""
+        prompt_yn "  Add another Anki sync account (e.g. for a family member)? (y/n):" "n" _more
+        [[ "$_more" =~ ^[Yy]$ ]] || break
+        prompt_text "  Username for the additional account:" "" _u
+        if [ -z "$_u" ]; then
+            log_warning "Name can't be empty."; continue
+        fi
+        ANKI_USERS+=("$_u")
+        ANKI_PASSWORDS+=("$(generate_password 24)")
+        if [ "${#ANKI_USERS[@]}" -ge 8 ]; then
+            log_warning "That's plenty — stopping at 8 accounts."
+            break
+        fi
+    done
+
+    mkdir -p "$ANKI_DIR/data"
+    ensure_docker_dir_ownership "$ANKI_DIR"
+    cd "$ANKI_DIR" || return 1
+
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
+    local _CADDY_NET_BLOCK=""
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
+        _CADDY_NET_BLOCK="    networks:
+      - caddy_net
+"
+        _CADDY_NET_SECTION="
+networks:
+  caddy_net:
+    external: true
+    name: ${SITE_CADDY_NET:-caddy_net}
+"
+    fi
+
+    # Build the SYNC_USERn=... lines for docker-compose.yml (compose-time
+    # interpolation of ${ANKI_SYNC_USERn}/${ANKI_SYNC_PASSWORDn} from .env —
+    # same \${VAR} pattern services/homebox.sh uses for its own .env values)
+    # and the matching ANKI_SYNC_USERn/ANKI_SYNC_PASSWORDn lines for .env.
+    local _COMPOSE_USER_LINES="" _ENV_USER_LINES="" i idx
+    for i in "${!ANKI_USERS[@]}"; do
+        idx=$((i + 1))
+        _COMPOSE_USER_LINES+="      - SYNC_USER${idx}=\${ANKI_SYNC_USER${idx}}:\${ANKI_SYNC_PASSWORD${idx}}
+"
+        _ENV_USER_LINES+="ANKI_SYNC_USER${idx}=${ANKI_USERS[$i]}
+ANKI_SYNC_PASSWORD${idx}=${ANKI_PASSWORDS[$i]}
+"
+    done
+
+    backup_if_exists docker-compose.yml
+    cat > docker-compose.yml << ANKI_COMPOSE
+name: $CONTAINER
+
+services:
+  anki-sync-server:
+    image: afrima/anki-sync-server:latest
+    container_name: $CONTAINER
+    hostname: $CONTAINER
+    restart: unless-stopped
+    environment:
+      - SYNC_HOST=0.0.0.0
+      - SYNC_PORT=8080
+      - SYNC_BASE=/data
+${_COMPOSE_USER_LINES}    volumes:
+      - ./data:/data
+    ports:
+      - "${WEB_PORT}:8080"
+${_CADDY_NET_BLOCK}${_CADDY_NET_SECTION}
+ANKI_COMPOSE
+
+    backup_if_exists .env
+    cat > .env << ANKI_ENV
+TZ=${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}
+CADDY_NET=$SITE_CADDY_NET
+
+# One username/password pair per Anki sync account (SYNC_USER1, SYNC_USER2,
+# ... in docker-compose.yml). Enter these exact values as the account on
+# each Anki client (Preferences/Settings → self-hosted sync server). To add,
+# remove, or reset one of these later, re-run this installer against the
+# existing install and pick "Manage sync accounts" — don't hand-edit these
+# lines, the matching docker-compose.yml lines have to change in lockstep.
+${_ENV_USER_LINES}
+ANKI_ENV
+    chmod 600 .env
+
+    chown -R "$ACTUAL_USER:$ACTUAL_USER" "$ANKI_DIR"
+
+    # afrima/anki-sync-server is built on gcr.io/distroless/static-debian12:nonroot
+    # — the process always runs as that image's fixed "nonroot" UID/GID (65532),
+    # never as ACTUAL_USER, and distroless has no shell so nothing inside the
+    # container can chown its own data dir at startup. Applied AFTER the
+    # ACTUAL_USER chown above (not before — that call would just clobber it,
+    # since it recurses over the whole $ANKI_DIR including data/) so ./data ends
+    # up owned by 65532 specifically while docker-compose.yml/.env/README.md
+    # (which the sysadmin edits, not the container) stay owned by ACTUAL_USER.
+    # Confirmed live: getting this wrong is exactly what makes the container
+    # fail to come up with a permissions error the moment it tries to create
+    # anything under /data (e.g. a new user's collection).
+    chown -R 65532:65532 "$ANKI_DIR/data"
+
+    echo ""
+    log_success "Anki Sync Server${INSTANCE_SUFFIX:+ ($INSTANCE_SUFFIX)} configured at $ANKI_DIR (port $WEB_PORT)"
+    echo ""
+    echo "  Sync accounts (also saved in $ANKI_DIR/.env):"
+    for i in "${!ANKI_USERS[@]}"; do
+        echo "    ${ANKI_USERS[$i]} / ${ANKI_PASSWORDS[$i]}"
+    done
+    echo ""
+
+    # No Authelia gate here, unlike most other web-facing services in this
+    # repo: this is a raw HTTP sync API that the Anki client itself talks to
+    # (not a browser session), so a forward_auth login portal in front of it
+    # would just break every sync request instead of protecting anything.
+    # SYNC_USER1/SYNC_USER2/... above is this service's own auth boundary —
+    # same reasoning as the has-built-in-auth services in CLAUDE.md, just
+    # with no web UI to additionally gate.
+    configure_caddy_for_service "Anki Sync Server${INSTANCE_SUFFIX:+ ($INSTANCE_SUFFIX)}" "${CONTAINER}:8080" "anki${INSTANCE_SUFFIX:+-$INSTANCE_SUFFIX}"
+
+    local START=""
+    prompt_yn "Start Anki Sync Server${INSTANCE_SUFFIX:+ ($INSTANCE_SUFFIX)} now? (y/n):" "y" START
+    if [ "$START" = "y" ] || [ "$START" = "Y" ]; then
+        docker compose up -d \
+            && log_success "Anki Sync Server started" \
+            || log_warning "Start failed — check: docker compose logs"
+    fi
+
+    write_readme "$ANKI_DIR" << MD
+# Anki Sync Server${INSTANCE_SUFFIX:+ — $INSTANCE_SUFFIX}
+
+Self-hosted sync server for the [Anki](https://apps.ankiweb.net/) flashcard
+app — syncs your collection across devices without going through AnkiWeb.
+Anki's own spaced-repetition scheduler (FSRS) gives failed cards more
+repetition and correctly-recalled cards longer gaps automatically; nothing
+here changes that, it's purely the sync backend.
+$( [ -n "$INSTANCE_SUFFIX" ] && echo "
+This is a separate, fully isolated instance (own data directory, own
+accounts, own port) — not shared collections with another Anki Sync Server
+instance.")
+
+## Access
+- Sync URL: $( [ -n "${CADDY_SERVICE_CONFIGURED:-}" ] && [ "$CADDY_SERVICE_CONFIGURED" = "true" ] && echo "https://${CADDY_SERVICE_DOMAIN}/" || echo "http://localhost:${WEB_PORT}/" )
+- Accounts (username / password):
+$(for i in "${!ANKI_USERS[@]}"; do echo "  - ${ANKI_USERS[$i]} / ${ANKI_PASSWORDS[$i]}"; done)
+
+Enter the Sync URL and one of the above accounts on each Anki client — see
+the client setup section below for exactly where.
+
+## Data
+- Collections: \`$ANKI_DIR/data\`
+- Credentials: \`$ANKI_DIR/.env\` (readable by $ACTUAL_USER only)
+
+## Manage
+\`\`\`bash
+cd $ANKI_DIR
+docker compose up -d
+docker compose down
+docker compose logs -f
+docker compose pull && docker compose up -d
+\`\`\`
+
+To add, remove, or reset the password of a sync account later, re-run the
+installer against this install and pick **"Manage sync accounts"** —
+don't hand-edit \`.env\`, the matching lines in \`docker-compose.yml\` have
+to change alongside it:
+\`\`\`bash
+sudo ./setup.sh anki-sync-server
+\`\`\`
+MD
+
+    log_info "Full client setup + Quizlet import walkthrough written to $ANKI_DIR/README.md"
+}
+
+# ── Standalone execution ───────────────────────────────────────────────────
+if [[ "${_RUN_STANDALONE:-0}" == "1" ]]; then
+    install_anki-sync-server
+fi

services/authelia.sh

@@ -242,7 +242,8 @@ install_authelia() {
         echo "    7) Reconfigure from scratch (regenerates secrets/users — breaks"
         echo "       existing sessions for every domain already on this instance)"
         echo "    8) Show who has universal vs. service-scoped access"
-        echo "    9) Change \"Remember me\" session duration (stay logged in longer)"
+        echo "    9) Change \"Remember me\" session duration (stay logged in longer — also"
+        echo "       raises the inactivity timeout to match, so it can't cut it short)"
         echo "    10) Protect an existing site with this instance (pick a local Caddy site,"
         echo "       or type one on a different box — gates it with a login, same as any"
         echo "       other service already protected this way)"
@@ -501,7 +502,12 @@ access_control:
 session:
   name: authelia_session
   expiration: 12h
-  inactivity: 2h
+  # Matches remember_me below, not a shorter default — an idle timeout
+  # shorter than remember_me silently cuts a "remembered" session short
+  # regardless of its own duration. See _authelia_set_remember_me()'s
+  # comment for the live case this caused. Change both together (that
+  # function does exactly this) rather than one at a time.
+  inactivity: 7d
   remember_me: 7d
   cookies:
     - domain: ${AUTHELIA_DOMAIN}
@@ -2383,6 +2389,19 @@ _authelia_report_access_scope() {
 # earlier version of this very file's own README section) uses the old
 # name, which Authelia would just silently ignore rather than error on.
 #
+# Also writes the SAME value into `inactivity` — a separate session field
+# (default 2h, set alongside remember_me in install_authelia()'s own
+# template) that ends a session after that much idle time regardless of
+# remember_me, since it isn't disabled or extended by the "Remember me"
+# checkbox. Confirmed live: a user who'd set remember_me to 1y still got
+# logged out after ordinary daily gaps (overnight, a workday) because
+# inactivity was still sitting at its 2h default — remember_me alone does
+# NOT deliver "won't be asked to log in again for the duration I set"
+# without this. Tying the two together is what actually delivers that.
+# `expiration` (the session cap when "Remember me" is NOT checked) is left
+# alone — a shorter default there for an un-remembered session is correct,
+# separate behavior, not the same gap.
+#
 # This only controls AUTHELIA's own session — it does not touch how long
 # a native-OIDC app's (Gitea/Mealie/ActualBudget) own session/token lasts
 # after logging in via Authelia. A long remember_me makes re-authenticating
@@ -2393,27 +2412,48 @@ _authelia_set_remember_me() {
     local config_file="$DOCKER_DIR/authelia/config/configuration.yml"
     [ -f "$config_file" ] || { log_warning "No configuration.yml found — install Authelia first."; return 1; }
 
-    local current
+    local current current_inactivity
     current="$(grep -E '^  remember_me:' "$config_file" | awk '{print $2}' | tr -d "'\"")"
+    current_inactivity="$(grep -E '^  inactivity:' "$config_file" | awk '{print $2}' | tr -d "'\"")"
     echo ""
-    echo "  Current \"remember me\" duration: ${current:-not set}"
+    echo "  Current \"remember me\" duration: ${current:-not set} (inactivity timeout: ${current_inactivity:-not set})"
     echo "  How long a session lasts when someone checks \"Remember me\" at login —"
-    echo "  applies to every domain this Authelia instance protects."
+    echo "  applies to every domain this Authelia instance protects. Also sets"
+    echo "  \"inactivity\" (idle timeout) to the same value, so a gap between visits"
+    echo "  shorter than this can't log you out early — otherwise inactivity's own"
+    echo "  separate, much shorter default cuts a long remember_me short."
     echo "  Examples: 12h, 7d, 1M (month), 1y. Set to -1 to disable Remember Me entirely."
     local new_duration=""
     prompt_text "  New duration [${current:-7d}]:" "${current:-7d}" new_duration
-    if [ -z "$new_duration" ] || [ "$new_duration" = "$current" ]; then
+    if [ -z "$new_duration" ]; then
         log_info "No change made."
         return 0
     fi
+    # Only truly a no-op if BOTH keys already match — remember_me alone
+    # matching isn't enough to skip, or an install still carrying the old
+    # mismatched inactivity default (from before this function synced the
+    # two) could never actually get inactivity fixed by re-entering the
+    # same remember_me value. Confirmed live: this is exactly what
+    # happened on a box that had already set remember_me: 1y before this
+    # sync existed — re-running with "1y" again hit this early return and
+    # left inactivity untouched.
+    if [ "$new_duration" = "$current" ] && [ "$new_duration" = "$current_inactivity" ]; then
+        log_info "No change made — remember_me and inactivity already both ${new_duration}."
+        return 0
+    fi
 
     if grep -qE '^  remember_me:' "$config_file"; then
         sed -i "s/^  remember_me:.*/  remember_me: '${new_duration}'/" "$config_file"
     else
         sed -i "/^session:\$/a\\  remember_me: '${new_duration}'" "$config_file"
     fi
+    if grep -qE '^  inactivity:' "$config_file"; then
+        sed -i "s/^  inactivity:.*/  inactivity: '${new_duration}'/" "$config_file"
+    else
+        sed -i "/^  remember_me:/a\\  inactivity: '${new_duration}'" "$config_file"
+    fi
     chown 1000:1000 "$config_file" 2>/dev/null || true
-    log_success "\"Remember me\" duration set to ${new_duration}."
+    log_success "\"Remember me\" duration and inactivity timeout both set to ${new_duration}."
 
     local restart_auth=""
     prompt_yn "  Restart Authelia to apply? (y/n):" "y" restart_auth
@@ -2425,9 +2465,10 @@ _authelia_set_remember_me() {
 
     echo ""
     log_info "Takes effect for NEW logins where \"Remember me\" is checked at Authelia's"
-    log_info "login page — existing sessions keep whatever expiration they already had."
-    log_info "The checkbox itself is already on the login form by default; this only"
-    log_info "changes how long checking it actually keeps you signed in."
+    log_info "login page — existing sessions keep whatever expiration/inactivity they"
+    log_info "already had. The checkbox itself is already on the login form by default;"
+    log_info "this only changes how long checking it actually keeps you signed in, and"
+    log_info "stops the separate inactivity timeout from cutting that short."
 }
 
 # Export/import accounts (+ optionally 2FA/session state) — for migrating to

services/wolf.sh

@@ -285,6 +285,84 @@ print(pick[0]["browser_download_url"] if pick else "")
     esac
 }
 
+# Same job as _wolf_download_emulator_appimage above, but against GitLab's
+# Releases API instead of GitHub's — needed for any project (ES-DE included)
+# that's hosted on GitLab rather than GitHub, since GitHub's API obviously
+# can't answer for a repo it doesn't host. Mirrors the same arch-matching /
+# post-download ELF-header verification logic so both call sites behave
+# identically from the caller's point of view.
+_wolf_download_emulator_appimage_gitlab() {
+    local _display_name="$1" _project_path="$2" _existing_glob="$3" _dir="$4"
+    if ls "$_dir"/$_existing_glob 2>/dev/null | grep -q .; then
+        log_info "$_display_name already present in $_dir/"
+        return 0
+    fi
+    local _get=""
+    echo ""
+    log_info "$_display_name can be auto-downloaded."
+    prompt_yn "Download $_display_name AppImage now? (y/n):" "y" _get
+    [[ "$_get" =~ ^[Yy]$ ]] || return 0
+
+    log_info "Fetching latest $_display_name release from GitLab..."
+    local _encoded_path
+    _encoded_path=$(python3 -c "import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1], safe=''))" "$_project_path")
+    local _url
+    _url=$(curl -fsSL "https://gitlab.com/api/v4/projects/${_encoded_path}/releases" \
+        | HOST_ARCH="$(uname -m)" python3 -c '
+import sys, json, os
+host = os.environ.get("HOST_ARCH", "")
+arch_tags = {
+    "x86_64": ["x86_64", "amd64", "x64"],
+    "aarch64": ["aarch64", "arm64"],
+    "arm64": ["aarch64", "arm64"],
+}.get(host, [host] if host else [])
+all_arch_tags = ["x86_64", "amd64", "x64", "aarch64", "arm64", "armv7", "armhf", "i386", "i686"]
+def has(name, tags):
+    n = name.lower()
+    return any(t in n for t in tags)
+releases = json.load(sys.stdin)
+# GitLab does not guarantee list order — sort explicitly instead of
+# assuming index 0 is the newest (the mistake that would silently pick a
+# stale/older release on some future API response ordering change).
+releases = sorted(releases, key=lambda r: r.get("released_at") or "", reverse=True)
+assets = []
+for r in releases:
+    for link in r.get("assets", {}).get("links", []):
+        url = link.get("direct_asset_url") or link.get("url") or ""
+        if url.endswith(".AppImage"):
+            assets.append({"name": link.get("name", url), "browser_download_url": url})
+    if assets:
+        break
+matching = [a for a in assets if arch_tags and has(a["name"], arch_tags)]
+untagged = [a for a in assets if not has(a["name"], all_arch_tags)]
+pick = matching or untagged or assets
+print(pick[0]["browser_download_url"] if pick else "")
+' 2>/dev/null)
+    if [[ -z "$_url" ]]; then
+        log_warning "Could not resolve download URL — get it manually from https://gitlab.com/${_project_path}/-/releases"
+        return 1
+    fi
+    local _file="$_dir/$(basename "$_url")"
+    curl -fL --progress-bar -o "$_file" "$_url" \
+        && chmod +x "$_file" \
+        && chown "$ACTUAL_USER:$ACTUAL_USER" "$_file" \
+        && log_success "$_display_name downloaded: $_file" \
+        || { log_warning "Download failed — get it manually from https://gitlab.com/${_project_path}/-/releases"; return 1; }
+
+    local _got_arch
+    _got_arch=$(file -b "$_file" 2>/dev/null)
+    case "$(uname -m)" in
+        x86_64)
+            echo "$_got_arch" | grep -qi 'x86-64\|x86_64' || \
+                log_warning "$_file doesn't look like an x86_64 build ($_got_arch) — it will fail with 'exec format error'. Grab the x86_64 asset by hand from https://gitlab.com/${_project_path}/-/releases"
+            ;;
+        aarch64|arm64)
+            echo "$_got_arch" | grep -qi 'aarch64\|arm64' || \
+                log_warning "$_file doesn't look like an aarch64 build ($_got_arch) — it may fail to run. Grab the aarch64 asset by hand from https://gitlab.com/${_project_path}/-/releases"
+            ;;
+    esac
+}
+
 install_wolf() {
     require_docker || return 1
 
@@ -939,6 +1017,85 @@ UDEV
     log_info "not something this installer can supply. Cemu's own First-Time Setup Wizard covers where"
     log_info "to put it once you have one."
 
+    # ── Optional: ES-DE and RetroArch as standalone AppImages (for Steam) ────
+    # These are ADDITIONAL to the esde/retroarch Wolf catalog containers
+    # above, not a replacement — nothing here removes or changes those. The
+    # only reason to want this: once added as a Steam non-Steam game
+    # (./manage.sh steam-add-nonsteam-game, which the wolf mount fix above
+    # already extended to reach the same roms/saves/bios/retro-home/
+    # retroarch paths the esde/retroarch containers use), Steam Input can
+    # give each of up to 4 identical-model controllers its own distinct
+    # identity by device path — the one thing Wolf's own 3-concrete-pad-type
+    # ceiling can't do for a 4th controller (see manage.sh's own "4
+    # controllers (Cemu / Wii U games)" help text). Skip both prompts below
+    # if you're happy running Wii U/retro systems through the esde app
+    # directly and don't need Steam's per-device controller assignment.
+    #
+    # Both download to a FIXED, predictable filename (ES-DE.AppImage /
+    # RetroArch.AppImage) regardless of the real upstream release asset's
+    # own name — steam-add-nonsteam-game matches by substring against the
+    # actual filename on disk, and bash glob matching is case-sensitive, so
+    # a fixed name (same symlink trick already used for Dolphin above) is
+    # what makes './manage.sh steam-add-nonsteam-game es-de' reliably find
+    # it regardless of how the vendor's own release happens to be named.
+    if [ ! -f "$_EMU_DIR/ES-DE.AppImage" ]; then
+        echo ""
+        # ES-DE is hosted on GitLab, not GitHub (confirmed against its own
+        # project page) — a different Releases API than every other
+        # standalone emulator above, hence the separate _gitlab helper.
+        log_info "ES-DE also ships an official standalone Linux AppImage — separate from the esde Wolf"
+        log_info "app above. Only useful for adding to Steam (see this repo's wolf README); skip this if"
+        log_info "you'll only ever use the esde app directly."
+        local _GET_ESDE_APPIMAGE=""
+        prompt_yn "Download the ES-DE AppImage for use via Steam? (y/n):" "n" _GET_ESDE_APPIMAGE
+        if [[ "$_GET_ESDE_APPIMAGE" =~ ^[Yy]$ ]]; then
+            _wolf_download_emulator_appimage_gitlab \
+                "ES-DE" "es-de/emulationstation-de" "ES-DE.AppImage" "$_EMU_DIR"
+            local _ESDE_REAL
+            _ESDE_REAL=$(ls "$_EMU_DIR"/*.AppImage 2>/dev/null \
+                | grep -iE '/(es-?de|emulationstation)[^/]*\.AppImage$' \
+                | grep -v '/ES-DE\.AppImage$' | head -1)
+            if [[ -n "$_ESDE_REAL" ]]; then
+                ln -sf "$(basename "$_ESDE_REAL")" "$_EMU_DIR/ES-DE.AppImage"
+                chown -h "$ACTUAL_USER:$ACTUAL_USER" "$_EMU_DIR/ES-DE.AppImage" 2>/dev/null || true
+                log_success "Linked $_EMU_DIR/ES-DE.AppImage -> $(basename "$_ESDE_REAL")"
+                log_info "Once Wolf is running, add it to Steam with: cd $WOLF_DIR && ./manage.sh steam-setup-frontends"
+                log_info "(waits for Steam sign-in — QR code via Moonlight — then wires this in automatically)"
+            fi
+        fi
+    fi
+
+    if [ ! -f "$_EMU_DIR/RetroArch.AppImage" ]; then
+        echo ""
+        # Libretro's own buildbot doesn't publish through a GitHub/GitLab
+        # Releases API this installer can automate against — hizzlekizzle/
+        # RetroArch-AppImage is the well-regarded THIRD-PARTY nightly-build
+        # project the AppImage community catalogs (appimage.github.io etc.)
+        # themselves point to, same "flagged, not silently offered as
+        # official" treatment as the Dolphin community build above.
+        log_info "RetroArch also has a standalone Linux AppImage, separate from the retroarch Wolf app"
+        log_info "above — same rationale as ES-DE just above (Steam Input's per-device controller"
+        log_info "assignment). This comes from hizzlekizzle/RetroArch-AppImage, a well-regarded but"
+        log_info "THIRD-PARTY nightly-build project, not an official libretro.org release — grab"
+        log_info "RetroArch's own build by hand instead if you'd rather not run that."
+        local _GET_RA_APPIMAGE=""
+        prompt_yn "Download the RetroArch AppImage for use via Steam? (y/n):" "n" _GET_RA_APPIMAGE
+        if [[ "$_GET_RA_APPIMAGE" =~ ^[Yy]$ ]]; then
+            _wolf_download_emulator_appimage \
+                "RetroArch" "hizzlekizzle/RetroArch-AppImage" "RetroArch.AppImage" "$_EMU_DIR"
+            local _RA_REAL
+            _RA_REAL=$(ls "$_EMU_DIR"/*[Rr]etro[Aa]rch*.AppImage 2>/dev/null \
+                | grep -v '/RetroArch\.AppImage$' | head -1)
+            if [[ -n "$_RA_REAL" ]]; then
+                ln -sf "$(basename "$_RA_REAL")" "$_EMU_DIR/RetroArch.AppImage"
+                chown -h "$ACTUAL_USER:$ACTUAL_USER" "$_EMU_DIR/RetroArch.AppImage" 2>/dev/null || true
+                log_success "Linked $_EMU_DIR/RetroArch.AppImage -> $(basename "$_RA_REAL")"
+                log_info "Once Wolf is running, add it to Steam with: cd $WOLF_DIR && ./manage.sh steam-setup-frontends"
+                log_info "(waits for Steam sign-in — QR code via Moonlight — then wires this in automatically)"
+            fi
+        fi
+    fi
+
     # ── Optional: TI-99/4A as its own ES-DE system ────────────────────────────
     # TI-99/4A has no libretro core and isn't one of ES-DE's built-in systems,
     # so getting it real ES-DE treatment (artwork scraping, gameplay-time
@@ -2166,7 +2323,26 @@ CATALOG = {
                 # (see below) — without it, an emulator AppImage (Cemu, etc.)
                 # added as a non-Steam game (./manage.sh steam-add-nonsteam-game)
                 # has no file to actually point Exe at from inside this container.
-                f'{games}/emulators:/home/retro/Applications:rw'],
+                f'{games}/emulators:/home/retro/Applications:rw',
+                # Same roms/saves/bios/retro-home/retroarch mounts as esde/
+                # retroarch below — without these, a standalone ES-DE or
+                # RetroArch AppImage added here as a non-Steam game (same
+                # mechanism as Cemu above) would see none of the ROMs, cores,
+                # save states, BIOS files, or ES-DE's own settings/custom
+                # systems (TI-99, Wii U AntiMicroX command) that the esde/
+                # retroarch containers already have — it'd start from a
+                # completely empty config instead of reusing what's already
+                # set up. Every path here is the exact same host directory
+                # those two containers mount, just also visible from Steam.
+                f'{games}/roms:/ROMs:rw',
+                f'{games}/saves:/mnt/games/saves:rw',
+                f'{games}/media:/media:rw',
+                f'{games}/bios:/home/retro/bioses:rw',
+                f'{games}/retro-home:/home/retro/.config:rw',
+                f'{games}/retro-home-data:/home/retro/.local/share:rw',
+                f'{games}/retroarch:/home/retro/.config/retroarch:rw',
+                f'{games}/esde-custom-systems:/home/retro/ES-DE/custom_systems:rw',
+                f'{games}/esde-settings:/home/retro/ES-DE/settings:rw'],
         env=['PROTON_LOG=1', 'RUN_SWAY=true',
              'GOW_REQUIRED_DEVICES=/dev/input/* /dev/dri/* /dev/nvidia*'],
         cap_add=['SYS_ADMIN', 'SYS_NICE', 'SYS_PTRACE', 'NET_RAW', 'MKNOD', 'NET_ADMIN'],
@@ -3554,7 +3730,7 @@ _manage_wolf_complete() {
     local commands="start stop restart logs status pin controllers update apps cores reorder
                     add-web ge-proton games setup-swbf2 fix-ea-game wait-ea-app
                     install-ea-app diagnose-ea fix-perms install-completion backup
-                    steam-add-nonsteam-game cemu-clone-controller"
+                    steam-add-nonsteam-game steam-setup-frontends cemu-clone-controller cemu-sync-controllers"
     COMPREPLY=( $(compgen -W "$commands" -- "$cur") )
 }
 # Register for both 'manage.sh' and './manage.sh' invocation styles
@@ -4014,6 +4190,75 @@ VDFPY
         echo "'Force the use of a specific Steam Play compatibility tool' is OFF — Cemu and"
         echo "other native Linux AppImages don't run through Proton."
         ;;
+    steam-setup-frontends)
+        # One command covering what the ES-DE/RetroArch AppImage download
+        # step in setup.sh can't finish on its own: that step runs before
+        # Wolf/Steam containers even exist, so it can only download the
+        # AppImages and print instructions. This picks up from there —
+        # start Steam if needed, WAIT for it to be signed in (Steam Guard's
+        # QR-code sign-in itself can't be scripted: it needs a phone
+        # approving a prompt, so this only polls for the result, never
+        # performs the sign-in), then add whichever AppImage(s) already got
+        # downloaded as Steam non-Steam games via the existing
+        # steam-add-nonsteam-game command above (re-invoked, not
+        # reimplemented, so the two never drift apart).
+        if ! docker ps --format '{{.Names}}' | grep -qi WolfSteam; then
+            echo "Starting Wolf (docker compose up -d)..."
+            docker compose up -d
+            sleep 5
+        fi
+
+        _SSF_SIGNED_IN() {
+            local _home
+            _home=$(_steam_home)
+            [ -n "$_home" ] && [ -n "$(sudo ls "$_home/.steam/steam/userdata/" 2>/dev/null)" ]
+        }
+
+        if _SSF_SIGNED_IN; then
+            echo "Steam is already signed in — proceeding."
+        else
+            echo ""
+            echo "Steam isn't signed in yet. In Moonlight:"
+            echo "  1. Connect to the Steam app."
+            echo "  2. On Steam's login screen, choose 'Sign in with QR code'."
+            echo "  3. Scan it with your phone's Steam app and approve the prompt."
+            echo ""
+            echo "Waiting for sign-in (up to 10 minutes, checking every 5s — Ctrl+C to give up"
+            echo "and finish this later by re-running './manage.sh steam-setup-frontends')..."
+            _SSF_WAITED=0
+            until _SSF_SIGNED_IN; do
+                sleep 5
+                _SSF_WAITED=$((_SSF_WAITED + 5))
+                if [ "$_SSF_WAITED" -ge 600 ]; then
+                    echo "Still not signed in after 10 minutes — giving up for now."
+                    exit 1
+                fi
+            done
+            echo "Signed in."
+        fi
+
+        GAME_DIR=$(grep '^GAME_STORAGE_DIR=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d= -f2-)
+        if [ -z "$GAME_DIR" ]; then read -r -p "  Game storage path: " GAME_DIR; fi
+        _SSF_EMU_DIR="$GAME_DIR/emulators"
+        _SSF_ADDED_ANY=0
+        if [ -f "$_SSF_EMU_DIR/ES-DE.AppImage" ]; then
+            "$0" steam-add-nonsteam-game es-de "EmulationStation (ES-DE)" && _SSF_ADDED_ANY=1
+        else
+            echo "ES-DE.AppImage not found in $_SSF_EMU_DIR — download it first: sudo ./setup.sh wolf"
+        fi
+        if [ -f "$_SSF_EMU_DIR/RetroArch.AppImage" ]; then
+            "$0" steam-add-nonsteam-game retroarch "RetroArch" && _SSF_ADDED_ANY=1
+        else
+            echo "RetroArch.AppImage not found in $_SSF_EMU_DIR — download it first: sudo ./setup.sh wolf"
+        fi
+
+        if [ "$_SSF_ADDED_ANY" = 1 ]; then
+            echo ""
+            echo "Cores/shaders/overlays live in the same retroarch/ directory the esde/retroarch apps"
+            echo "already use (shared mount — nothing new to configure there). If you haven't already:"
+            echo "  ./manage.sh cores all   (downloads every libretro core + shaders/overlays/database)"
+        fi
+        ;;
     cemu-clone-controller)
         # Clones a WORKING Cemu controller mapping onto a new device slot,
         # skipping Cemu's own Input Settings dialog entirely for that slot.
@@ -4123,6 +4368,156 @@ CLONEPY
         echo "Close Cemu COMPLETELY and relaunch for this to take effect — a hand-edited"
         echo "profile file isn't picked up by an already-running Cemu."
         ;;
+    cemu-sync-controllers)
+        # Fully automates cemu-clone-controller above: queries SDL directly
+        # (the exact same library Cemu itself links against) for the REAL
+        # live GUID of every controller currently connected to the active
+        # session's app container, then clones a proven-working mapping
+        # onto each one's controllerN.xml — no Cemu GUI interaction at all,
+        # not even the single-button-and-Save step cemu-clone-controller
+        # still needs to learn a brand-new device's uuid.
+        #
+        # CONFIRMED LIVE: querying SDL_JoystickGetDeviceGUID() this way
+        # inside a running ES-DE session reproduced the EXACT uuids Cemu
+        # had already written by hand for two different real controllers
+        # (Nintendo Switch Pro and Xbox One S) — byte-for-byte identical to
+        # controllerProfiles/controller0.xml and controller1.xml. SDL's own
+        # library is the authoritative source for this value — an earlier
+        # attempt to reverse-engineer just the CRC16 portion of the GUID by
+        # hand, tried against 7 different CRC16 variants, matched neither
+        # device. This sidesteps that entirely by asking the same library
+        # Cemu itself calls, instead of recomputing what it would return.
+        #
+        # Wolf's own controller numbering (0-indexed) matched SDL's
+        # enumeration order for that session 1:1 in testing (index 0 was
+        # the controller Wolf logged as "controller 0", index 1 was
+        # "controller 1") — so the Nth joystick SDL reports maps directly
+        # onto controllerN.xml, the same file-naming convention used
+        # everywhere else in this script.
+        GAME_DIR=$(grep '^GAME_STORAGE_DIR=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d= -f2-)
+        if [ -z "$GAME_DIR" ]; then read -r -p "  Game storage path: " GAME_DIR; fi
+        if [ -z "$GAME_DIR" ]; then echo "No game storage path."; exit 1; fi
+        _CSC_DIR="$GAME_DIR/retro-home/Cemu/controllerProfiles"
+        if [ ! -d "$_CSC_DIR" ]; then
+            echo "No controllerProfiles/ yet at $_CSC_DIR — set up at least one controller"
+            echo "in Cemu's own Input Settings first (Controller 1), so there's a real,"
+            echo "working profile for this to clone the mapping from."
+            exit 1
+        fi
+
+        # Find whichever currently-running Wolf app container actually has
+        # joysticks wired up — the active session's controllers could be
+        # attached to ES-DE, Desktop, RetroArch, or Steam depending on what
+        # you're connected to right now, so this isn't hard-wired to one app.
+        _CSC_CONTAINER=""
+        for _c in $(docker ps --format '{{.Names}}' | grep -i '^Wolf'); do
+            if docker exec "$_c" test -e /dev/input/js0 2>/dev/null; then
+                _CSC_CONTAINER="$_c"
+                break
+            fi
+        done
+        if [ -z "$_CSC_CONTAINER" ]; then
+            echo "No running Wolf app container has any controller attached right now."
+            echo "Connect via Moonlight with your controllers active, then re-run this."
+            exit 1
+        fi
+        echo "Reading live controller GUIDs from $_CSC_CONTAINER..."
+
+        _CSC_PROBE=$(docker exec -i -u retro "$_CSC_CONTAINER" python3 - << 'PROBEPY'
+import ctypes, ctypes.util, sys
+
+libname = ctypes.util.find_library("SDL2") or "libSDL2-2.0.so.0"
+try:
+    sdl = ctypes.CDLL(libname)
+except OSError as e:
+    print(f"ERROR: could not load libSDL2 ({libname}): {e}", file=sys.stderr)
+    sys.exit(1)
+
+class SDL_JoystickGUID(ctypes.Structure):
+    _fields_ = [("data", ctypes.c_uint8 * 16)]
+
+sdl.SDL_Init.argtypes = [ctypes.c_uint32]
+sdl.SDL_Init.restype = ctypes.c_int
+sdl.SDL_NumJoysticks.restype = ctypes.c_int
+sdl.SDL_JoystickGetDeviceGUID.argtypes = [ctypes.c_int]
+sdl.SDL_JoystickGetDeviceGUID.restype = SDL_JoystickGUID
+sdl.SDL_JoystickGetGUIDString.argtypes = [SDL_JoystickGUID, ctypes.c_char_p, ctypes.c_int]
+sdl.SDL_JoystickNameForIndex.argtypes = [ctypes.c_int]
+sdl.SDL_JoystickNameForIndex.restype = ctypes.c_char_p
+
+if sdl.SDL_Init(0x00000200) != 0:
+    print("ERROR: SDL_Init(JOYSTICK) failed", file=sys.stderr)
+    sys.exit(1)
+
+n = sdl.SDL_NumJoysticks()
+for i in range(n):
+    guid = sdl.SDL_JoystickGetDeviceGUID(i)
+    buf = ctypes.create_string_buffer(64)
+    sdl.SDL_JoystickGetGUIDString(guid, buf, 64)
+    name = sdl.SDL_JoystickNameForIndex(i)
+    name = name.decode() if name else f"Controller {i}"
+    print(f"{i} 0_{buf.value.decode()} {name}")
+PROBEPY
+)
+        if [ -z "$_CSC_PROBE" ]; then
+            echo "SDL reported zero joysticks inside $_CSC_CONTAINER — nothing to sync."
+            echo "Make sure controllers are actually connected and active in this session."
+            exit 1
+        fi
+        echo "$_CSC_PROBE"
+        echo ""
+
+        _CSC_ANY_SYNCED=0
+        while read -r _idx _uuid _live_name; do
+            [ -z "$_idx" ] && continue
+            _target="$_CSC_DIR/controller${_idx}.xml"
+
+            # Already has this exact uuid — nothing to do, don't churn a backup.
+            if [ -f "$_target" ] && grep -qF "<uuid>$_uuid</uuid>" "$_target"; then
+                echo "controller${_idx}.xml already has this device's mapping — skipping."
+                continue
+            fi
+
+            # Pick any OTHER existing, non-empty controllerN.xml as the source.
+            _src=""
+            for _n in 0 1 2 3; do
+                _cand="$_CSC_DIR/controller${_n}.xml"
+                if [ -s "$_cand" ] && [ "$_n" != "$_idx" ]; then
+                    _src="$_cand"
+                    break
+                fi
+            done
+            if [ -z "$_src" ]; then
+                echo "controller${_idx}.xml: no other working profile to clone from yet — skipping."
+                continue
+            fi
+
+            [ -f "$_target" ] && cp "$_target" "$_target.bak.$(date +%s)"
+            # Use SDL's own live device name if it reported one — more useful
+            # in Cemu's own UI than inheriting whatever device the mapping
+            # template happened to come from.
+            _name="${_live_name:-$(grep -o '<display_name>[^<]*</display_name>' "$_src" | head -1 | sed -E 's#</?display_name>##g')}"
+
+            python3 - "$_src" "$_target" "$_uuid" "$_name" << 'SYNCPY'
+import re, sys
+src_path, out_path, uuid, display_name = sys.argv[1:5]
+with open(src_path) as f:
+    template = f.read()
+new = re.sub(r'<uuid>[^<]*</uuid>', f'<uuid>{uuid}</uuid>', template, count=1)
+new = re.sub(r'<display_name>[^<]*</display_name>', f'<display_name>{display_name}</display_name>', new, count=1)
+with open(out_path, 'w') as f:
+    f.write(new)
+SYNCPY
+            chown 1000:1000 "$_target"
+            echo "controller${_idx}.xml: synced (uuid $_uuid, cloned from $(basename "$_src"))."
+            _CSC_ANY_SYNCED=1
+        done <<< "$_CSC_PROBE"
+
+        echo ""
+        if [ "$_CSC_ANY_SYNCED" = 1 ]; then
+            echo "Close Cemu COMPLETELY and relaunch for the synced profiles to take effect."
+        fi
+        ;;
     pin)
         # Wolf logs: "Insert pin at http://SOMEIP:47989/pin/#HEXHASH"
         # Extract just the hash fragment and build URLs for every interface
@@ -4177,8 +4572,11 @@ CLONEPY
         echo "  ./manage.sh install-completion           - Enable tab-completion for this script"
         echo "  ./manage.sh steam-add-nonsteam-game [name] [display name]"
         echo "                                            - Add an emulator (emulators/) as a non-Steam game, no GUI needed"
+        echo "  ./manage.sh steam-setup-frontends        - Wait for Steam sign-in (QR code via Moonlight), then add"
+        echo "                                              downloaded ES-DE/RetroArch AppImages to Steam"
         echo "  ./manage.sh cemu-clone-controller [slot 0-3] [uuid] [display name]"
         echo "                                            - Clone a working Cemu controller mapping onto a new device slot"
+        echo "  ./manage.sh cemu-sync-controllers        - Auto-detect connected controllers via SDL and clone mappings onto all of them"
         echo "  ./manage.sh backup                       - How to set up backups"
         ;;
 esac
@@ -4668,7 +5066,17 @@ PYEOF
     echo "  Online together    → each player launches their own session,"
     echo "                        all connect to the same game server"
     echo ""
-    echo "Manage:  cd $WOLF_DIR && ./manage.sh {start|stop|restart|logs|status|pin|update|apps|reorder|add-web|ge-proton|fix-ea-game}"
+    echo "  4 controllers, one game (e.g. Cemu/Wii U)? Steam Input tells identical"
+    echo "  controllers apart by device path, not just SDL GUID — add the emulator"
+    echo "  to Steam as a non-Steam game instead of launching it from ES-DE:"
+    echo "    ./manage.sh steam-setup-frontends       # ES-DE/RetroArch AppImages into Steam"
+    echo "    ./manage.sh steam-add-nonsteam-game cemu"
+    echo "    ./manage.sh cemu-clone-controller / cemu-sync-controllers"
+    echo "  For the ES-DE/RetroArch Wolf apps directly, force distinct virtual pad"
+    echo "  types per slot instead:  ./manage.sh controllers   (see README.md)"
+    echo ""
+    echo "Manage:  cd $WOLF_DIR && ./manage.sh {start|stop|restart|logs|status|update|cores|reorder|add-web|backup|ge-proton|fix-ea-game|controllers|steam-add-nonsteam-game|steam-setup-frontends|pin}"
+    echo "         ./manage.sh install-completion   # tab-complete every command above"
     echo ""
     echo "── EA GAMES (Battlefront II, etc.) ───────────────────"
     echo ""
@@ -4740,6 +5148,7 @@ cd $WOLF_DIR
 ./manage.sh install-completion # enable tab-completion for manage.sh
 ./manage.sh steam-add-nonsteam-game  # add an emulator as a non-Steam game, no GUI needed
 ./manage.sh cemu-clone-controller    # clone a working Cemu controller mapping onto a new device slot
+./manage.sh cemu-sync-controllers    # auto-detect connected controllers via SDL, clone mappings onto all of them
 \`\`\`
 
 ### Tab completion
@@ -4777,6 +5186,69 @@ container-created virtual controllers specifically (real hardware behaves
 this way; whether Steam Input sees Wolf's virtual joypads the same way is
 still to be tested) — worth trying before assuming it works.
 
+## Running ES-DE and/or RetroArch through Steam instead of their own Wolf apps
+The same Steam Input reasoning above applies beyond just Cemu: ES-DE and
+RetroArch both ship their own official standalone Linux AppImages
+(separate from the \`esde\`/\`retroarch\` Wolf catalog apps this installer
+already runs), and adding one of those to Steam gets you the same
+per-device controller assignment for every system it covers, not just
+Cemu. \`sudo ./setup.sh wolf\` offers to download both (opt-in, default
+no) right after the Cemu step — ES-DE's from its GitLab releases (it
+isn't on GitHub), RetroArch's from \`hizzlekizzle/RetroArch-AppImage\` (a
+well-regarded third-party nightly build — libretro.org's own buildbot
+doesn't publish through an API this installer can automate against).
+Both land in \`emulators/\` under a fixed name (\`ES-DE.AppImage\` /
+\`RetroArch.AppImage\`) regardless of the real release asset's own
+filename, so Steam's non-Steam-game matching finds them reliably.
+
+They reuse the exact same \`roms/\`, \`saves/\`, \`bios/\`, \`retro-home\`, and
+\`retroarch\` (cores/shaders/overlays) directories the \`esde\`/\`retroarch\`
+containers already use — the \`steam\` Wolf app mounts all of the same
+paths, so nothing needs re-downloading or re-scraping just because it's
+now also reachable from Steam. If you haven't already populated cores:
+\`\`\`bash
+cd $WOLF_DIR && ./manage.sh cores all
+\`\`\`
+
+Finishing the Steam side needs one thing that can't be scripted — Steam
+Guard's QR-code sign-in requires a phone approving a prompt — so this
+polls for it instead of trying to script past it:
+\`\`\`bash
+cd $WOLF_DIR && ./manage.sh steam-setup-frontends
+\`\`\`
+Starts Wolf if it isn't already up, checks whether Steam's already
+signed in (proceeds immediately if so), otherwise prints the QR-code
+steps and waits (up to 10 minutes) for sign-in to complete, then adds
+whichever of ES-DE.AppImage/RetroArch.AppImage was downloaded as a Steam
+non-Steam game — re-using \`steam-add-nonsteam-game\` above rather than
+duplicating its shortcuts.vdf-writing logic. Safe to re-run any time
+(e.g. if it timed out waiting, or you downloaded the second AppImage
+later) — already-added shortcuts are updated in place, not duplicated.
+
+**Returning to Steam from ES-DE, without a second instance:** if ES-DE
+is running as a Steam non-Steam game (via the AppImage above, not the
+separate \`esde\` Wolf app), Steam is the parent process the whole
+time — quitting ES-DE drops you back into the same still-running Steam
+Big Picture session rather than starting a new one. This only works for
+the AppImage-in-Steam path; the standalone \`esde\` Wolf app is a
+completely separate container, and Wolf has no supported way to hand off
+from one running app to another mid-session (switching apps means
+closing the Moonlight session and reconnecting to the other one).
+
+**Multiple devices, same Steam account, same controller mappings?**
+Worth knowing before relying on it: Wolf gives each *paired client* its
+own separate Steam container/home directory (confirmed against this
+repo's own \`_steam_home()\` — it searches across multiple
+\`.../Steam\` directories, not just one), so a second device connecting
+to Wolf doesn't reuse the first device's Steam install and has to sign
+in separately the first time. Once it's signed into the *same* Steam
+account, Valve's own account-level Steam Cloud config sync should
+replicate your Steam Input controller bindings across those separate
+local installs (the same mechanism that syncs bindings between a Steam
+Deck and a gaming PC) — but that's a Steam-account feature, not
+something Wolf or this installer controls, and hasn't been confirmed
+live in this specific setup.
+
 ## Multiple controllers (same game/emulator can't tell them apart)
 **Symptom:** two or more controllers connected through the same Moonlight
 session, but the game/emulator only ever sees one — the first controller
@@ -5265,6 +5737,25 @@ uuid — no per-button rebinding, no fighting the cut-off Save button for
 every single controller. Backs up any existing \`controllerN.xml\` first,
 and needs Cemu closed and relaunched afterward like any other hand-edit.
 
+**\`./manage.sh cemu-sync-controllers\` skips the uuid step too — genuinely
+zero Cemu GUI interaction for any controller.** Instead of getting each
+new device's uuid from Cemu itself, this asks **SDL directly** — the exact
+library Cemu links against — for the live GUID of every controller
+currently connected to your active session, then clones the mapping onto
+each one automatically. **Confirmed live:** querying SDL this way inside a
+real session reproduced the *exact* uuids Cemu had already written by hand
+for two different controllers, byte-for-byte. With your controller types
+already assigned via \`./manage.sh controllers\` and at least one slot
+mapped once (by hand, or via \`cemu-clone-controller\` above), just:
+\`\`\`bash
+cd $WOLF_DIR && ./manage.sh cemu-sync-controllers
+\`\`\`
+Run it any time after connecting with controllers active — already-synced
+slots are detected and skipped (no needless backups), and it works
+regardless of which app (ES-DE, Desktop, RetroArch, Steam) currently has
+the controllers attached, since it looks for whichever running Wolf
+container actually has joysticks wired up.
+
 ROMs are mounted at \`/ROMs\` inside Desktop too, so Cemu's own File → Load
 can browse straight to \`/ROMs/wiiu/\` without needing ES-DE at all.