Files
TREK/wiki/Document-Sync.md
T
Maurice ed18c37903 fix: the findings of the final 4.3.0 audit
Every file the release touches was read once more, and what survived an
independent check against the code is fixed here, with a test for each.

Data and credentials
- A document sync connection edited to a new address no longer carries the
  stored token along: a blank form under another origin is refused, the same
  rule the probe route already had. Dawarich and AirTrail testConnection send
  the stored key only to the host it was stored for.
- The key rotation script now covers document_connections.secrets and
  trip_document_links.webhook_secret, which it had skipped.
- Turning a booked night into a pause in the road trip popup asks first and
  says that the booking and its expense go with it. Deleting a place says the
  same when a night is booked there, on the desktop and on the phone.
- A moved version marker over unchanged bytes no longer replaces the TREK file
  and its attachments; a real revision carries the attachments over.

Planner
- A drop in the day plan names the row it lands ahead of in the full day, so a
  hidden hotel stop no longer shifts it one slot early; the store sorts before
  it splices. Via re-anchoring, the booked-night guard and the sidebar's day
  membership read the stored day, the index space the server uses.
- A hotel stop placed mid-day re-pins the road trip vias of that day, and the
  booking session receives the new stop order too. The Public API and the iCal
  feed list a booked hotel once. A plugin can no longer write a stay against
  another trip's day.

Road trip and map
- The route overview paces its requests to the public routers and retries a
  rate limit, and it says which legs it could not route instead of quietly
  reporting a shorter trip. A click on a via handle no longer drops a second
  via; handles hide when zooming out. Read-only members cannot edit the driving
  limits. The phone shows a way back when no day is picked and prints the night
  drive departure in the chosen clock format.

Integrations and search
- Google transit keeps conventional trains when the train chip is on.
  TREK_PLACES_ENABLED=false stops the details and enrichment calls too, and
  accepts the whole boolean family. A caller-supplied description no longer
  lands in the instance-wide enrichment cache. Nominatim searches carry a
  timeout. An OSM place id is checked for shape before it reaches Overpass.
- Dawarich puts a stay on the trip whose dates hold it, the Atlas hand-off
  knows what the Atlas already shows, and a host change with a new key clears
  the old instance's state.
- Document sync: a webhook address pasted by hand works on the token alone,
  deleting a connection unregisters its subscriptions, Nextcloud under a
  sub-path connects, Synology answers a name collision before uploading and
  verifies a move into the bin, Paperless titles are capped at 128 characters,
  a DNS failure reads as unreachable rather than as a policy verdict, videos
  from the store are accepted like uploads, and remote_missing has a way out.
  Conflict buttons only for the owner, a refused choice is reported, a refused
  credential gets a Reconnect button, disconnecting asks first on the desktop
  as it does on the phone, and the folder picker no longer spins forever.

Release
- The server holds the release notice back from a bundle that cannot draw it,
  so the previous shell served from the service worker cache after an update
  no longer shows bare keys and no longer lets a click use the notice up.
- Import into an existing list gets the same body limit as a new list. Chat
  images say when the limit is reached and the new controls are translated.
  The transit backend switch reports a failed save. The Helm chart carries the
  Amap credentials in its Secret; the shipped templates document the Places
  API and Amap variables and the Overpass default. The wiki follows.
2026-09-20 13:54:31 +02:00

33 KiB

Document Sync

A trip can keep its documents in step with a self-hosted document store: Paperless-ngx, Papra, Nextcloud, OpenCloud or a Synology NAS. What someone uploads in TREK appears in the store, and what someone files in the store appears in TREK.

Three rules shape everything else on this page:

  • The connection belongs to the trip, not to a person. The trip owner connects the store once, TREK talks to it under that one account, and TREK's own membership decides who sees what. Every member sees the same documents, and the store never learns who is on the trip.
  • TREK keeps its own copy of every document. A synced document is an ordinary file in the trip's Documents-and-Files manager, so preview, download, trash, offline use, PDF-Export and Backups work as before, and a store that is down does not empty a trip that starts tomorrow.
  • Nothing is deleted on the other side on its own. A document removed in the store is flagged in TREK and waits for a person. A document deleted in TREK is removed in the store only when the binding is set to move it to the store's recycle bin.

Admin: Each store is switched on separately under the Documents addon in Admin → Addons. They ship switched off. A store on your local network also needs ALLOW_INTERNAL_NETWORK=true on the TREK server. See Admin-Addons and Internal-Network-Access.

What each store syncs

Store A trip is bound to Shown in the list as
Paperless-ngx a tag Files by tag
Papra a tag inside one organisation Files by tag, inside an organisation
Nextcloud a folder Files in a folder
OpenCloud a space Files in a space
Synology Drive a folder inside a shared folder, reached through File Station Files in a folder on the NAS

Only what is inside that tag, folder or space is synced. Everything else in the store stays out of TREK.

On the TREK side, a binding covers all of the trip's documents in the file manager. Files attached to a chat message or to a collab note are left out: they belong to a conversation, not to the trip's paperwork.

Switching stores on

An administrator switches each store on under Admin → Addons. The stores are rows underneath the Documents addon, on the desktop and on the phone, and they only show while Documents itself is on: Paperless-ngx, Papra, Nextcloud, OpenCloud and Synology Drive.

  • All five ship switched off. The admin decides only which stores may be offered. The credentials are entered per trip, in the trip itself, never in the admin panel.
  • Switching a store off pauses every binding that uses it, without touching the binding or its documents. The binding card then reads Paused: an administrator has switched this provider off. Syncing resumes once it is back on. and resumes where it stopped once the store is back on.
  • Switching the Documents addon off switches every store off as well. When Documents comes back, each store has to be switched on again.
  • A store cannot be switched on while Documents is off. The server answers Enable the Documents addon first.

Binding a trip

Open the trip's Files tab. When a store is available, a Document sync button sits next to Trash in the toolbar; on the phone it sits between Upload and the trash button at the top of the Files tab. The button only shows where there is something behind it: on a trip that is already bound, for every member, and on any trip for the people who may bind it while at least one store is switched on.

Who may bind a trip: the trip owner, or an instance administrator. The credential a binding stores usually reaches that person's entire archive, so no other member can set one up, point it elsewhere or change its settings. Every member can open the dialog, see where the trip's documents go and press Sync now.

  1. Open Document sync. Under Connect a provider, pick the store.
  2. Fill in the form. The fields per store are listed below; optional ones are marked as such.
  3. Press Test connection. On success the footer reads Reached it, signed in as followed by the account name. On failure it names the reason; see Troubleshooting.
  4. Press Connect.
  5. TREK asks Where should this trip live in followed by the store's name. Either create a new tag, folder or space under Make a new one (the name is prefilled from the trip's title plus its id, for example japan-2026-42) and press Create, or pick an existing one under Or use one you already have.

The binding starts with both directions on, Keep both copies for deletions, Ask me for conflicts and Sync automatically on, and TREK runs it once straight away. A trip can be bound to several stores, one binding per store; each of them holds a full copy of the trip's documents. With a store bound, Add another lists the remaining ones.

Things worth knowing before you bind:

  • One account per store and trip. The binding runs under the account of the person who saved the connection, and only while that person is the trip owner or a member of the trip. When they leave the trip the binding stops, so an ex-member's credential is never used again. An instance administrator who is not on the trip can set a binding up, but it stops at the next scheduled check for the same reason.
  • Documents that arrive from the store are listed in TREK as uploaded by that person, since nobody in TREK uploaded them.
  • The credentials are stored encrypted with the trip and never sent back to a browser. Once a trip is connected to a store, picking that store again (after Disconnect, for example) goes straight to the folder picker with the stored credentials; the form is not shown again.
  • Bind a new, empty tag, folder or space rather than one that already holds this trip's documents from an earlier binding. A new binding knows nothing about earlier pairings, so it treats both sides as new: every document in the store is downloaded into TREK as a further copy, and TREK's documents are offered to the store again, which gives second copies in Paperless-ngx and failed uploads under Needs a look where a file name is already taken.

Setting up each store

Every connection form ends with Accept a self-signed certificate, off by default: For an instance on your own network with a self-signed certificate. It relaxes the certificate check only; the address rules in Stores on your own network still apply.

Paperless-ngx

TREK files this trip under its own tag and never touches the rest of your archive.

Field Notes
Address The Paperless-ngx address, for example https://paperless.example.com. A trailing /api is tolerated.
API token Create one under My Profile in Paperless. It carries that account's full rights.
  • Scope: a tag. The picker lists your tags; Make a new one creates a tag, and refuses a name that already exists rather than taking over a tag that may belong to someone else's filing. Pick an existing tag from the list instead.
  • Custom field: a document TREK uploads carries the trip's tag and a custom field named trek_trip_id, holding trek-trip- plus the trip's id. TREK creates the field on the first upload. It is a breadcrumb for whoever tidies the archive later; TREK does not filter on it. Removing the tag from a document takes it out of the trip, whatever the field says.
  • Names: Paperless-ngx keeps a title rather than a file name, so a document arrives in TREK as its title plus the extension of the original file. TREK downloads the original file, not the archived PDF Paperless-ngx makes from it.
  • File types: Paperless-ngx takes PDF, JPEG, PNG, TIFF, GIF, BMP, WebP, HEIC and HEIF images, plain text, CSV and email (.eml) files. Word, Excel, PowerPoint, OpenDocument and RTF files only go through on an instance that runs Tika and Gotenberg; without them Paperless-ngx refuses them and TREK lists them as Type not allowed.
  • Instant updates: when the token's user may add workflows, TREK creates a workflow named TREK document sync (link n) that calls TREK whenever a document with the trip's tag is added or updated. Disconnect deletes it again. Without that permission the binding runs on the timer, unless a user who may add workflows pastes the binding's Instant updates address into a workflow by hand. See When TREK checks.
  • Recycle bin: a document TREK removes goes to the Paperless-ngx trash.
  • Version: Paperless-ngx 3 or newer.

Papra

Pick the organisation this trip belongs to. TREK files it under its own tag inside it.

Field Notes
Address The Papra address, for example https://papra.example.com.
API key Starts with ppapi_. Create one under API keys in Papra. Papra keys always reach every organisation you belong to.
Organisation ID The org_… id from the Papra address bar. It is org_ followed by 24 lowercase letters and digits.
  • Scope: a tag inside that organisation. Make a new one creates the tag, and refuses a name that already exists.
  • Key permissions: a key limited in Papra must still be allowed to work with the organisation's documents and tags. Papra answers a missing permission exactly like a wrong key, so TREK can only report The credentials were refused.
  • Duplicates: Papra keeps one document for identical bytes, so of two identical files in TREK only the first reaches Papra; the second is listed under Needs a look.
  • Upload limit: Papra's own upload limit is an instance setting TREK cannot read. A file over it is listed as Too large.
  • Instant updates: by hand. Papra does not let an API key manage webhooks, so TREK cannot subscribe itself; paste the binding's Instant updates address into a webhook in Papra, and the binding runs on the timer until then. See When TREK checks.
  • Recycle bin: a document TREK removes goes to Papra's trash.

Nextcloud

Use an app password, not your account password: it survives two-factor and you can revoke it on its own.

Field Notes
Address The Nextcloud address, for example https://cloud.example.com.
Username Your Nextcloud login name, not your email address.
App password Settings, Security, Create new app password. Never your account password.
Base folder Optional. Where TREK looks for trip folders. Defaults to /TREK.
  • Scope: a folder directly under the base folder. Make a new one creates it there, and creates the base folder too if it does not exist yet. A folder of that name that already exists is refused; pick it from the list instead.
  • Only the top level of the folder is synced. Sub-folders inside it are left alone, so moving a file into one takes it out of the trip.
  • Instant updates: when the account may manage webhooks (an administrator account on an instance with the webhook_listeners app), TREK subscribes itself to files being created, written, deleted and renamed. Otherwise the binding runs on the timer, unless a Nextcloud administrator registers the binding's Instant updates address as a listener by hand.
  • Recycle bin: a document TREK removes goes to Nextcloud's Deleted files. On an instance without the Deleted files app, it is deleted for good.

OpenCloud

TREK gets its own space for this trip, separate from everything else.

Field Notes
Address The OpenCloud address, for example https://opencloud.example.com.
Username Your OpenCloud username.
App token Created under app tokens in OpenCloud.
  • Scope: a space. The picker lists the spaces the account can reach; Make a new one creates a new space, which needs an account OpenCloud allows to create spaces.
  • Only the top level of the space is synced. Sub-folders inside it are left alone.
  • Instant updates: none. OpenCloud has no subscription API TREK could use, so the binding runs on the timer.
  • Recycle bin: a document TREK removes goes to the space's trash.

Synology Drive

Best a DSM account that only reaches the shared folder this trip should use.

Field Notes
Address The DSM address. Include the port, for example https://nas.example.com:5001
Username Best a dedicated DSM account with access to just this shared folder.
Password The DSM password of that account. DSM has no app tokens, so this is the real account.
Two-factor code Optional. Only needed once, if the account uses two-factor authentication.
Base folder Optional. Defaults to /trek.
  • File Station: TREK talks to the NAS through the File Station API, so the account must be allowed to use File Station. If it is not, Test connection fails even though the login worked.
  • Scope: a folder. The picker lists every shared folder the account can see, plus the folders directly under the base folder. DSM paths start with the name of a shared folder, so the default /trek only exists if there is a shared folder called trek; set Base folder to a path inside an existing shared folder, such as /documents/trek, or bind a shared folder directly. Make a new one can create folders inside a shared folder, never a shared folder itself.
  • Sub-folders inside the bound folder are included.
  • Renames in File Station come through even though DSM has no file ids: TREK recognises the renamed or moved file by its size and modification time.
  • Two-factor accounts: the code is used once. DSM then hands TREK a trusted-device token, which TREK keeps encrypted with the trip's Synology connection, so it survives a restart of TREK and no new code is needed afterwards. TREK appears as TREK among the account's trusted devices in DSM.
  • Failed logins: DSM blocks an address after a few failed logins. TREK does not retry a refused password for a minute, and waits fifteen minutes when DSM has already blocked it.
  • Recycle bin: File Station's API only deletes permanently, so a document TREK removes is moved into a .trek-trash folder inside the bound folder instead, where anyone can take it back out in File Station. A file of the same name already in there is renamed with a timestamp rather than overwritten. TREK never lists the .trek-trash folder.
  • Instant updates: none. File Station has no change feed, so the binding runs on the timer.

The binding card

Once bound, the dialog lists the trip's stores under This trip and shows the selected one as a card:

  • The store's name with a state dot, and Paused while Sync automatically is off.
  • Where and when: the bound tag, folder or space, and the last run.
  • A notice line when the binding needs attention, for example Failed · The provider could not be reached.
  • The flow bar: TREK on one side, the store on the other, each with the number of documents it holds, and two lanes between them, Out to the store and In from the store. The trip owner switches a direction off by clicking its lane; the last lane cannot be switched off. Other members see the same bar without the switch.
  • Sync now, for every member, and Disconnect for the trip owner.

Settings, folded away under the card, holds what the owner sets once:

Setting Options
When a document is deleted Keep both copies (default) or Move to recycle bin. What happens to the copy on the other side.
When both sides changed Ask me (default), Keep the TREK copy or Keep the store's copy. Which copy survives when a document was edited in both places.
Sync automatically On by default. Off leaves the binding to Sync now alone.
Instant updates An address for the store to call. See When TREK checks.

On the phone the card opens as a sheet. The first three settings are buttons there that step through their options with each tap; the Instant updates address is only shown on the desktop.

Disconnect ends the binding and keeps every document where it is, on both sides: Documents stay in TREK and at the store. Only the pairing between them goes. Both the desktop and the phone ask before they disconnect. A workflow or webhook subscription TREK created for the binding is removed with it.

How changes travel

New documents

  • Uploaded in TREK: goes to the store on the next run, into the bound tag, folder or space.
  • Filed in the store: downloaded into TREK on the next run as an ordinary trip document, provided TREK accepts its type and size (see File types and sizes).

TREK itself has no way to rename a document or replace its content, so what travels from TREK to the store is new documents and deletions.

Changes in the store

A document whose content changed in the store is downloaded again as a new document, and the copy it replaces goes to TREK's trash. Links the old copy had to bookings, places or expenses stay with the old copy.

Renames in the store come through. The TREK copy takes the new name, on every store. On Paperless-ngx and Papra the listing carries a checksum of the file, so an edit that leaves the file alone, such as a rename, a new tag or a new correspondent, is not a new document either: the copy is downloaded again only when its content changed.

Deletions

Deleted in the store: TREK keeps its copy and flags it as Missing at the provider under Needs a look. Nothing is removed in TREK.

Deleted in TREK: the file goes to TREK's trash as usual, and the binding's When a document is deleted rule decides what happens in the store:

Rule In the store
Keep both copies The store's copy stays. TREK remembers the pairing, so it is not downloaded again.
Move to recycle bin The store's copy goes to the store's bin: the Paperless-ngx trash, Papra's trash, Nextcloud's Deleted files, the OpenCloud space's trash, or the .trek-trash folder on Synology.

The rule is applied once, at the run that notices the deletion. Changing it later does not reach back to documents deleted before. Emptying TREK's trash or deleting a file there permanently counts as a deletion too, and the store's copy is not downloaded again afterwards.

Restoring from TREK's trash

A document taken back out of TREK's trash syncs again, in one of three ways:

  • The store's copy is still there: the pairing counts again, and an edit made in the store in the meantime comes down.
  • TREK had moved the store's copy to the bin: the document goes up again as a new one.
  • Someone else deleted the store's copy: TREK does not upload it over their deletion. It flags it as Missing at the provider instead.

Conflicts

When a document changed in both places since the last run, When both sides changed decides. Keep the TREK copy and Keep the store's copy settle it on their own, as long as the binding still moves documents in the winner's direction; when that lane is switched off, the conflict waits as with Ask me.

With Ask me, the document waits under Needs a look as a Conflict. Resolve opens it with three choices: Keep the TREK version, Keep the provider version, or Keep both, which keeps the store's copy as a second document in TREK so nothing is lost. The trip owner or an instance administrator decides.

The mass-delete guard

An unmounted share, a revoked share or an expired token all answer the same way: a listing far shorter than the last one. Read literally, that would flag a whole trip as deleted.

So once a binding knows five or more documents in the store, a run that finds more than 40 percent of them gone at once is thrown away without acting on any of it, not even the parts that look fine. The binding shows Partly synced · Most documents vanished at once, so nothing was changed. Check that the folder is still mounted. and waits until the documents are back, or until the trip is bound again. Fewer missing documents are flagged one by one as Missing at the provider. Deleting documents in TREK never trips the guard.

Needs a look

The dialog lists what a person has to decide about under Needs a look, with a count per kind. On the phone the sheet shows conflicts; the full list is in the desktop dialog, and assistants read it through MCP.

Shown as What it says What to do
Conflict Changed in both places. Pick which one to keep. Press Resolve and pick a side.
Missing at the provider Gone from the store. The TREK copy is still here. Put the document back in the store, for example from its recycle bin, if it went by mistake. The flag clears on the first run that finds it again.
Type not allowed This file type is not allowed here. TREK refused an incoming file, or the store refused an outgoing one. See File types and sizes.
Too large Bigger than the limit. The file is over TREK's limit or over the store's.
Error The transfer did not go through. TREK tries again after 30 seconds, 2 minutes, 10 minutes and an hour. After six failed attempts in a row the document waits; Sync now gives it another go.

File types and sizes

Into TREK, a document from the store goes through the same checks as an upload in the file manager:

  • The size limit of 50 MB per file. A larger document is listed as Too large.
  • The blocked types, which are always refused (HTML, SVG, XML, scripts and executables; the full list is in Documents-and-Files).
  • The allowed types an admin sets under Admin → Settings → Allowed File Types. A file without an extension is refused too.

A document refused for its type stays refused until it changes in the store. Widening the allowed types does not fetch it again on its own.

Into the store, the store's own rules apply: the Paperless-ngx type list and Papra's upload limit (see above). A store that is out of space reports The provider is out of space.

When TREK checks

A binding runs straight after it is bound, and from then on on a timer, every five minutes by default. Each pass takes up to 20 bindings, the ones waiting longest first, and each run moves at most 25 documents; the rest follow on the next run, and the binding shows Partly synced until then.

  • Sync now runs a binding at once. It also gives documents that stopped retrying another attempt.
  • Sync automatically off leaves a binding to Sync now alone.
  • A failing binding backs off: the next attempt waits 1, 5, 15, 30, 60 and then 120 minutes. After ten failures in a row the timer stops trying until a run started with Sync now succeeds.

Instant updates

Where a store can tell TREK that something changed, it calls the binding's own address, and TREK runs the binding soon after instead of waiting for the timer. A call only ever means "look now": TREK waits five seconds so a burst of calls ends up as one run, and never reads anything from what the store sent. The timer keeps running either way, because no store reports every change: Paperless-ngx, for example, sends nothing when a document is deleted.

Store Instant updates
Paperless-ngx TREK creates the workflow itself when the token's user may add workflows. Otherwise a Paperless-ngx user who may add workflows can paste the Instant updates address into a workflow's webhook action by hand.
Nextcloud TREK subscribes itself when the account may manage webhooks (an administrator account with the webhook_listeners app). Where it may not, a Nextcloud administrator can register the Instant updates address as a listener by hand. Nextcloud sends these from its background jobs, so they arrive as promptly as its cron runs, and a TREK on a private address is only called when Nextcloud's allow_local_remote_servers is on.
Papra Paste the Instant updates address into a webhook in Papra by hand. Papra's webhook API is closed to API keys, so TREK cannot subscribe itself.
OpenCloud, Synology Timer only. Neither can call TREK.
  • The address TREK registers is built from the address the person binding the trip used to open TREK at that moment, including what the reverse proxy passes in X-Forwarded-Host and X-Forwarded-Proto. Bind the trip through the address the store can reach TREK under. Behind a proxy that passes no host, no address is registered and the timer carries the binding.
  • Paperless-ngx refuses a callback address longer than 256 characters. The binding then runs on the timer.
  • The address is the key. A call to the Instant updates address under Settings starts a run on its own, so an address pasted into a store by hand works for Papra, for a Nextcloud where TREK could not subscribe itself and for a Paperless-ngx whose token may not add workflows. Where TREK registered the subscription itself, it also hands over a secret and only acts on a call that carries it; the secret is not shown anywhere, so pasting that binding's address somewhere else by hand adds nothing. For OpenCloud and Synology there is nowhere to paste it, and once Test connection on the saved connection has reported that, their bindings show no address at all.

Tuning

There is no environment variable or admin screen for the timer. Two rows in the app_settings table are read on every pass, so a change needs no restart:

Key Effect
docsync_poll_interval_seconds Seconds between passes. Default 300, kept between 60 and 3600.
docsync_sync_enabled false stops the timer and ignores store calls for every binding on the instance. Sync now still works.

Stores on your own network

TREK reaches every store through its strict outbound guard (see Internal-Network-Access):

  • A store on a private address needs ALLOW_INTERNAL_NETWORK=true on the TREK server. That includes a store in another container on the same Docker network (the container name resolves to a private address), a Tailscale address (100.64.0.0/10) and a .local name.
  • Loopback is never reached, whatever the flag says: an address such as localhost or 127.0.0.1 is refused. Use the host's LAN address or the container name instead.
  • A private address is saved even while the flag is off, but every request to it is refused with That address is not allowed. Test connection shows the same message for a name that does not resolve at all.
  • A store with a self-signed certificate needs Accept a self-signed certificate in its connection form.

MCP tools

With the MCP addon on as well, an assistant can see where a trip's documents live and start a sync. The tools exist only while the Documents addon is on, and any member of the trip may use them. Connecting a store or changing a binding is deliberately not possible through MCP: it hands over a credential to someone's document archive, and that stays with the trip owner in the file manager.

Tool What it does Scope
get_trip_document_sync Shows the trip's bindings: the store, the bound tag, folder or space, the last run and its state, and how many documents are synced, waiting, in conflict or missing in the store. files:read
list_trip_document_sync_issues Lists what Needs a look lists: conflicts, refused types and sizes, failed transfers and documents gone from the store. Empty when everything is in step. files:read
sync_trip_documents Runs every binding of the trip now and reports what came in, what went out and what is in conflict. full: true compares both sides in full. A binding whose owner left the trip, or whose store an admin switched off, is reported and not run. files:write

See MCP-Addon-Tools and MCP-Scopes.

Which versions work

  • Paperless-ngx 3 and newer. TREK pins the Paperless-ngx API version it was written against, so a routine upgrade of Paperless-ngx does not change the answers under it.
  • The integration was checked against Paperless-ngx 3.1.3, Papra 26.6.2, Nextcloud 31.0.14 and OpenCloud 8.0.1.
  • Synology follows Synology's File Station API guide and was checked against a stand-in for it. It has not yet been confirmed on real DSM hardware.

Troubleshooting

Binding states

State What it means
Not synced yet Bound, first run still to come.
In sync The last run finished with nothing left over.
Partly synced The last run left something undone: more than 25 documents to move, documents listed under Needs a look, or the mass-delete guard. The notice line names which.
Failed The store could not be used. The notice line names the reason; TREK retries with the backoff described above.
Sign in again The store refused the stored credential while TREK was listing documents. More often a refused credential shows as Failed with The credentials were refused. The usual causes: a revoked Paperless-ngx token or Papra key, a deleted app password or app token, a changed DSM password, or TREK removed from the account's trusted devices in DSM. If the credential still exists in the store, Sync now tries again. A replaced credential goes in through Reconnect, which the trip owner finds next to the notice on the binding in both states: it opens the store's connection form again, and the binding runs as soon as the new credential is saved. Add another in the sidebar still lists only the stores the trip is not connected to.
Folder is gone The bound tag, folder or space no longer exists. TREK does not recreate it. Disconnect, then pick the store again under Add another and bind a new, empty one; TREK's documents go up into it.
Owner left the trip The person whose account the store was connected with is no longer on the trip. The binding stopped and Sync now is refused, also for a paused binding. Documents stay where they are on both sides. Once that person is back on the trip, switching Sync automatically on lets it run again; until then the switch stays off.

Messages

Message What it usually means
No document providers are available No store is switched on. An admin switches them on under Admin → Addons → Documents.
The provider could not be reached. Wrong address, the store is down, or the TREK server has no route to it. An https:// address on a port that only speaks plain HTTP lands here too.
The certificate was rejected. Allow self-signed certificates if you trust this instance. Turn on Accept a self-signed certificate.
The credentials were refused. Wrong token, key, app password or password. On Nextcloud, check that it is an app password and not the account password. On Papra, check the key's permissions.
This account is not allowed to do that. The account lacks a permission in the store, for example creating a space in OpenCloud or reaching a shared folder on the NAS.
Not found on the provider. On Nextcloud during Test connection, the username is not the login name. Otherwise the document or folder is gone.
The connected folder no longer exists. See Folder is gone above. On Synology, Create answers the same when Base folder does not start with an existing shared folder.
The provider is rate limiting us. TREK will try again later. The store asked TREK to slow down, or DSM blocked TREK's address after failed logins.
The file is larger than the provider accepts. The store refused the upload for its size.
The provider does not accept this file type. The store refused the upload for its type.
The provider is out of space. The account's quota in the store is full.
The document changed on both sides. A conflict. Nextcloud's Create also answers this when a folder of that name already exists; pick it from the list instead.
The transfer did not arrive intact. The store stored something different from what TREK sent. TREK tries again.
The provider reported an error. The store answered with an error TREK has no closer word for. On Synology, Test connection also answers this when the account may not use File Station, and Create when DSM will not accept the folder name.
The provider took too long to answer. The store accepted the request but did not answer in time.
That address is not allowed. The address points at loopback or link-local, does not resolve, or is private while ALLOW_INTERNAL_NETWORK is off. See Stores on your own network.
Most documents vanished at once, so nothing was changed. Check that the folder is still mounted. The mass-delete guard. See above.
Paused: an administrator has switched this provider off. Syncing resumes once it is back on. The store, or the whole Documents addon, is switched off. Nothing about the binding changed.
This provider is not available on this instance. The store is switched on but this TREK version has no adapter for it.
Something went wrong. Anything else, including Sync now on a binding whose owner left the trip.

See also