diff --git a/frontend/public/config.generated.yaml b/frontend/public/config.generated.yaml
index 307a481b7..0850ea365 100644
--- a/frontend/public/config.generated.yaml
+++ b/frontend/public/config.generated.yaml
@@ -50,6 +50,7 @@ server:
           configured: false               # true when explicitly set (allows intentional deny-all)
   cacheDir: "tmp"                         # path to the cache directory, used for thumbnails and other cached files
   cacheDirCleanup: false                  # whether to automatically cleanup the cache directory. Note: docker must also mount a persistent volume to persist the cache (default: false)
+  cacheDirMaxSizeMB: 0                    # maximum size in MB of the preview cache (cacheDir/diskcache). Past it, the least recently used files are deleted. 0 means no limit (default: 0)
   maxArchiveSize: 20                      # maximum archive/unarchive size in GB. 0 means no limit. (default: 20)
   filesystem:                             # filesystem settings
     createFilePermission: "644"           # Unix permissions like 644, 755, 2755 (default: 644)  validate:required,file_permission
@@ -224,6 +225,7 @@ userDefaults:                             # optional signup/CLI defaults; per-us
     uploadChunkSizeMb: 10
     clearAll: false
     downloadChunkSizeMb: 0
+    uploadStallTimeoutSeconds: 10         # seconds without progress before an upload is paused, 0 uses the default (10)
   account:
     permissions:
       api: false                          # allow api access
@@ -296,9 +298,12 @@ http:
   trustProxyHeaders: false                # honor X-Forwarded-* and X-Real-IP from a reverse proxy (default: false)
   trustedProxies:                         # IPs/CIDRs of trusted proxies; forwarded client headers are only honored when the socket peer matches one of these (default: empty = forwarded headers ignored)
   unixSocketTrustedUIDs:                  # UnixSocketTrustedUIDs and UnixSocketTrustedGIDs list peer credentials (Linux SO_PEERCRED) allowed to
-                                          # present X-Forwarded-* on a filesystem http.socket listener. When both are empty, forwarded headers
-                                          # are not trusted on Unix sockets. Abstract sockets (@name) never trust forwarded headers.
+                                          # present X-Forwarded-* on a filesystem http.socket listener. When both are empty, peers are not trusted
+                                          # unless UnixSocketTrustAllLocalPeers is true (legacy; startup logs a warning). A GID allowlist trusts
+                                          # every peer with that GID, not only a single reverse-proxy process. Abstract sockets (@name) never trust
+                                          # forwarded headers.
   unixSocketTrustedGIDs:
+  unixSocketTrustAllLocalPeers: false     # default false: set true to trust forwarded headers from any local filesystem socket peer when allowlists are empty
   socketFileMode: ""                      # octal mode for filesystem http.socket (default "0660"); ignored for abstract sockets
   socketGroup: ""                         # optional group name or numeric gid for the socket file (filesystem sockets only)
   disableRateLimit: false                 # turns off built-in auth route rate limiting and failed-login lockout (default false).