@@ -150,6 +150,7 @@ neon logo that doubles as the SVG favicon ([`7be5254`](../../commit/7be5254)):
 | **Now-playing metadata**: parses ID3 title/artist/album + embedded cover (with a folder `cover.jpg`/`folder.jpg` fallback); an info dialog shows the full detail (codec / sample-rate / bitrate / channels, path, play mode, RFID tag) via `GET /currenttrack`; artist/album are also published to MQTT + Home Assistant | [`ce3116c`](../../commit/ce3116c) · [`fda14a3`](../../commit/fda14a3) · [`4123db6`](../../commit/4123db6) · [`5cb0b8b`](../../commit/5cb0b8b) |
 | **Listening statistics**: per-day listening time (today / yesterday / 7 d / 30 d) in a 365-day NVS ring buffer, plus a most-played-cards top list — shown in the info dialog (`GET /info`, `GET /topcards`). The info dialog also draws a **30-day bar chart** (inline SVG, themed, no chart lib) and offers a **CSV export** of the full daily series (`GET /stats.csv`, `date,seconds`) | [`af6c8d3`](../../commit/af6c8d3) · [`c2e7d44`](../../commit/c2e7d44) |
 | **Full backup**: export/import all settings + RFID assignments + per-path EQ rules + listening stats as one JSON file; passwords are only included when explicitly ticked, so a shared backup doesn't leak credentials | [`4c90ff4`](../../commit/4c90ff4) · [`646ec5c`](../../commit/646ec5c) |
+| **Auto-backup to the sync server**: upload that same full backup (settings + RFID assignments + EQ rules + listening stats, **never** passwords) to a server straight from the device — no browser needed. A **Backup** section in the Sync settings tab takes the server URL (reusing the file-sync credentials) and a **once-a-day automatic** toggle; the file is streamed to SD entry-by-entry first (so a large RFID list fits in the limited heap) and then POSTed to the server, where the companion [`server/backup.php`](server/backup.php) stores it per-device and prunes old ones. The stored JSON drops straight back into the web interface's *import backup*. Run it from the Sync tab, command **189** or MQTT `backup` (Home Assistant button + status sensor included) | [`b134e7d`](../../commit/b134e7d) |
 | **Home Assistant MQTT discovery**: auto-registers all entities under one HA device — track/status/firmware/WiFi/battery sensors, volume & LED-brightness numbers, lock & ambient-light switches, equalizer select, transport/update/shutdown buttons | [`db73db1`](../../commit/db73db1) |
 | **Apple HomeKit + Siri** (`HOMEKIT_ENABLE`, via [HomeSpan](https://github.com/HomeSpan/HomeSpan)): pair the player straight into the Home app as a bridge with named tiles — **Playback** (play/pause + battery), **Volume** (brightness dimmer) and **Button-lock** — all controllable by Siri and usable in automations. State is mirrored back, so changes from buttons/RFID show up on the iPhone. Each device generates its **own random pairing code** on first boot (persisted in NVS) instead of a shared hard-coded one, so multiple ESPuinos — and everyone running this firmware — stay distinct and private. A dedicated **HomeKit settings section** shows the scannable pairing **QR code** + that setup code, a "reset pairing" button and an **on/off switch** to disable HomeKit entirely (HomeSpan then never starts, so it costs nothing at boot). HomeSpan now also comes up **lazily after boot** instead of inside `setup()`, so its multi-second start-up no longer stalls the boot LED. Pairs over the existing WiFi (no MFi chip needed); the HAP server runs on its own port and the poll task is pinned to core 0 so it never disturbs the audio pipeline on core 1 | [`6387563`](../../commit/6387563) |
 | **Control tab**: Repeat / Sleep-Timer (live countdown) / Night-Mode / button-lock / FTP start-stop and a Bluetooth-mode picker (Normal / Speaker / Headphones) right in the control tab; mobile-optimised (full-width louder/quieter buttons instead of the fiddly slider) | [`88a742c`](../../commit/88a742c) · [`520815a`](../../commit/520815a) · [`d57f24a`](../../commit/d57f24a) · [`aef1765`](../../commit/aef1765) |
 
@@ -684,6 +684,37 @@ paths:
       responses:
         "200":
           description: Stop requested.
+  /backupupload:
+    get:
+      tags: [Fork]
+      summary: Get configuration-backup upload status.
+      description: Poll the progress/result of the backup upload to the server.
+      responses:
+        "200":
+          description: Current backup state.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  status:
+                    type: integer
+                    description: "0=idle, 1=running, 2=done, 3=failed"
+                  message:
+                    type: string
+                    description: Result or error message.
+    post:
+      tags: [Fork]
+      summary: Upload a configuration backup to the server.
+      description: >-
+        Assembles the full configuration backup (settings + RFID assignments +
+        per-path EQ rules + listening statistics, never any passwords) on the SD
+        card and uploads it to the configured backup URL via HTTP POST, reusing
+        the file-sync credentials. No-op if an upload is already running. Also
+        bindable as command 189 or MQTT topic "backup".
+      responses:
+        "200":
+          description: Upload started (or already running).
   /playlist:
     post:
       tags: [Fork]
 
@@ -549,6 +549,18 @@
 			"peerHostPlaceholder": "IP oder Hostname",
 			"peerHostRequired": "Bitte IP/Hostname angeben",
 			"noPeers": "Noch keine Peers."
+		},
+		"backup": {
+			"title": "Auto-Backup auf Server",
+			"desc": "Lädt ein vollständiges Konfigurations-Backup (Einstellungen, RFID-Zuordnungen, EQ-Regeln und Hörstatistik) auf einen Server – dasselbe Backup wie beim Export-Knopf, also per Import wiederherstellbar. Passwörter sind nie enthalten. Verwendet Benutzername/Passwort aus dem Datei-Sync-Abschnitt oben.",
+			"url": "Backup-URL (backup.php)",
+			"urlPlaceholder": "http://server/espuino/backup.php",
+			"auto": "Einmal täglich automatisch sichern",
+			"autoHint": "Einmal pro Tag (sobald die Uhr gestellt und WLAN verbunden ist) wird das Backup im Hintergrund auf den Server geladen.",
+			"run": "Jetzt sichern",
+			"started": "Backup-Upload gestartet…",
+			"done": "Backup hochgeladen",
+			"failed": "Backup-Upload fehlgeschlagen"
 		}
 	},
 	"playlist": {
 
@@ -549,6 +549,18 @@
 			"peerHostPlaceholder": "IP or hostname",
 			"peerHostRequired": "Please enter an IP/hostname",
 			"noPeers": "No peers yet."
+		},
+		"backup": {
+			"title": "Auto-backup to server",
+			"desc": "Uploads a full configuration backup (settings, RFID assignments, EQ rules and listening statistics) to a server – the same backup the export button produces, so it can be restored via import. Passwords are never included. Uses the username/password from the file-sync section above.",
+			"url": "Backup URL (backup.php)",
+			"urlPlaceholder": "http://server/espuino/backup.php",
+			"auto": "Back up automatically once a day",
+			"autoHint": "Once a day (after the clock is set and WiFi is up) the backup is uploaded to the server in the background.",
+			"run": "Back up now",
+			"started": "Backup upload started…",
+			"done": "Backup uploaded",
+			"failed": "Backup upload failed"
 		}
 	},
 	"playlist": {
 
@@ -542,6 +542,18 @@
 			"peerHostPlaceholder": "IP ou nom d'hôte",
 			"peerHostRequired": "Veuillez saisir une IP/nom d'hôte",
 			"noPeers": "Aucun pair pour le moment."
+		},
+		"backup": {
+			"title": "Sauvegarde auto vers le serveur",
+			"desc": "Téléverse une sauvegarde complète de la configuration (réglages, affectations RFID, règles d'égaliseur et statistiques d'écoute) vers un serveur – la même sauvegarde que le bouton d'export, donc restaurable via l'import. Les mots de passe ne sont jamais inclus. Utilise l'identifiant/mot de passe de la section de synchronisation de fichiers ci-dessus.",
+			"url": "URL de sauvegarde (backup.php)",
+			"urlPlaceholder": "http://serveur/espuino/backup.php",
+			"auto": "Sauvegarder automatiquement une fois par jour",
+			"autoHint": "Une fois par jour (dès que l'horloge est réglée et le Wi-Fi connecté), la sauvegarde est téléversée vers le serveur en arrière-plan.",
+			"run": "Sauvegarder maintenant",
+			"started": "Téléversement de la sauvegarde démarré…",
+			"done": "Sauvegarde téléversée",
+			"failed": "Échec du téléversement de la sauvegarde"
 		}
 	},
 	"playlist": {
 
@@ -3449,6 +3449,31 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 							data-i18n="sync.run.gotools"></button>
 					</div>
 				</fieldset>
+
+				<!-- ===== Section 3: auto-backup to the server ===== -->
+				<fieldset class="col-md-12 mb-4">
+					<legend class="w-auto" data-i18n="sync.backup.title"></legend>
+					<p class="small text-muted" data-i18n="[html]sync.backup.desc"></p>
+					<label for="backupUrl" data-i18n="[prepend]sync.backup.url">:</label>
+					<input type="url" class="form-control" id="backupUrl" name="backupUrl"
+						data-i18n="[placeholder]sync.backup.urlPlaceholder" value="">
+					<small class="text-muted d-block mb-2">
+						<span data-i18n="sync.rfid.phpHint"></span>
+						<a href="https://github.com/fhirschmann/leoino/blob/master/server/backup.php"
+							target="_blank" rel="noopener">backup.php</a>
+					</small>
+					<div class="d-flex gap-2 mt-2">
+						<input type="checkbox" id="backupAuto" name="backupAuto" value="false">
+						<label for="backupAuto" data-i18n="sync.backup.auto"></label>
+					</div>
+					<small class="text-muted" data-i18n="sync.backup.autoHint"></small>
+					<div class="text-center mt-3">
+						<button type="button" class="btn btn-primary" id="backupSaveBtn" onclick="syncSettings()" data-i18n="submit"></button>
+						<button type="button" class="btn btn-primary ms-2" id="backupRunBtn" onclick="runBackupUpload()">
+							<i class="fas fa-cloud-upload-alt"></i> <span data-i18n="sync.backup.run"></span></button>
+					</div>
+					<div id="backupRunStatus" class="text-center small text-muted mt-2"></div>
+				</fieldset>
 			</div>
 		</div>
 		<div class="tab-pane fade" id="nav-homekit" role="tabpanel" aria-labelledby="nav-homekit-tab">
@@ -5439,6 +5464,10 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 				if (syncSettingsData.rfidLearn !== undefined) {
 					document.getElementById("rfidSyncLearn").checked = syncSettingsData.rfidLearn;
 				}
+				document.getElementById("backupUrl").value = syncSettingsData.backupUrl || "";
+				if (syncSettingsData.backupAuto !== undefined) {
+					document.getElementById("backupAuto").checked = syncSettingsData.backupAuto;
+				}
 				updateSyncSaveButtons();
 			}
 			// mqtt
@@ -6086,7 +6115,9 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 					abortOnButton: document.getElementById('syncAbortBtn').checked,
 					rfidUrl: document.getElementById('rfidSyncUrl').value,
 					rfidPeers: JSON.stringify(window.rfidPeers || []),
-					rfidLearn: document.getElementById('rfidSyncLearn').checked
+					rfidLearn: document.getElementById('rfidSyncLearn').checked,
+					backupUrl: document.getElementById('backupUrl').value,
+					backupAuto: document.getElementById('backupAuto').checked
 				}
 			};
 			await fetch("http://" + host + "/settings", {
@@ -6115,6 +6146,28 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 			}, 1500);
 		}
 
+		// Trigger a configuration-backup upload to the server and poll its status.
+		let backupPollTimer = null;
+		async function runBackupUpload() {
+			await fetch("http://" + host + "/backupupload", { method: "POST" });
+			toaster.info(i18next.t("sync.backup.started"));
+			clearInterval(backupPollTimer);
+			backupPollTimer = setInterval(async function () {
+				try {
+					const s = await (await fetch("http://" + host + "/backupupload")).json();
+					const el = document.getElementById('backupRunStatus');
+					if (el) {
+						el.textContent = (s.status === 1 ? "… " : "") + (s.message || "");
+					}
+					if (s.status !== 1) {
+						clearInterval(backupPollTimer);
+						if (s.status === 2) toaster.info(i18next.t("sync.backup.done"));
+						else if (s.status === 3) toaster.error(i18next.t("sync.backup.failed") + (s.message ? ": " + s.message : ""));
+					}
+				} catch (e) { clearInterval(backupPollTimer); }
+			}, 1500);
+		}
+
 		let syncPollTimer = null;
 		/* toggles the Sync now / Stop buttons depending on whether a sync is running */
 		function setSyncRunning(running) {
@@ -6253,9 +6306,13 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 			if (s && su) s.disabled = (su.value.trim() === "");
 			var r = document.getElementById('rfidSyncSaveBtn'), ru = document.getElementById('rfidSyncUrl');
 			if (r && ru) r.disabled = (ru.value.trim() === "");
+			var b = document.getElementById('backupSaveBtn'), bu = document.getElementById('backupUrl');
+			var brun = document.getElementById('backupRunBtn');
+			if (b && bu) b.disabled = (bu.value.trim() === "");
+			if (brun && bu) brun.disabled = (bu.value.trim() === "");
 		}
 		document.addEventListener("DOMContentLoaded", function () {
-			['syncUrl', 'rfidSyncUrl'].forEach(function (id) {
+			['syncUrl', 'rfidSyncUrl', 'backupUrl'].forEach(function (id) {
 				var el = document.getElementById(id);
 				if (el) el.addEventListener('input', updateSyncSaveButtons);
 			});
 
@@ -0,0 +1,86 @@
+<?php
+/**
+ * ESPuino configuration-backup receiver.
+ *
+ *   POST backup.php   (body = backup JSON, header X-ESPuino-Host: <hostname>)
+ *       -> stores ./backups/<host>/<host>_<UTC timestamp>.json and prunes old ones
+ *
+ * The ESPuino's auto-backup uploads the same JSON the web interface's "export backup" button
+ * produces (settings + RFID assignments + EQ rules + listening statistics, never any passwords).
+ * The stored file can be fed straight back into the web interface's "import backup".
+ *
+ * Deploy: place this at the web root that serves your sync domain (next to manifest.php). Backups
+ * land in ./backups (must be writable by PHP-FPM). Point the ESPuino's backup URL at
+ * https://<host>/backup.php and protect it with the same basic auth as the file sync.
+ *
+ * nginx (e.g. SWAG) — route to PHP-FPM and protect with basic auth:
+ *     location = /backup.php {
+ *         auth_basic "Restricted";
+ *         auth_basic_user_file /config/nginx/.htpasswd_espuino;
+ *         client_max_body_size 8m;            # backups with many RFID tags can be large
+ *         include /etc/nginx/fastcgi_params;
+ *         fastcgi_param SCRIPT_FILENAME /path/to/espuino/backup.php;
+ *         fastcgi_pass 127.0.0.1:9000;
+ *     }
+ */
+
+header('Content-Type: application/json; charset=utf-8');
+
+// How many backups to keep per device (older ones are pruned). 0 = keep all.
+const KEEP_PER_HOST = 30;
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    http_response_code(405);
+    echo json_encode(['error' => 'POST required']);
+    exit;
+}
+
+$body = file_get_contents('php://input');
+if ($body === false || strlen($body) === 0) {
+    http_response_code(400);
+    echo json_encode(['error' => 'empty body']);
+    exit;
+}
+
+// Validate it is the expected backup JSON (cheap sanity check, not a full schema check).
+$json = json_decode($body, true);
+if (!is_array($json) || ($json['espuinoBackup'] ?? 0) != 1) {
+    http_response_code(400);
+    echo json_encode(['error' => 'not an ESPuino backup']);
+    exit;
+}
+
+// Sanitize the device hostname into a safe directory/file component.
+$host = $_SERVER['HTTP_X_ESPUINO_HOST'] ?? 'espuino';
+$host = preg_replace('/[^A-Za-z0-9_.-]/', '_', $host);
+if ($host === '' || $host === null) {
+    $host = 'espuino';
+}
+
+$dir = __DIR__ . '/backups/' . $host;
+if (!is_dir($dir) && !mkdir($dir, 0775, true) && !is_dir($dir)) {
+    http_response_code(500);
+    echo json_encode(['error' => 'cannot create backup directory']);
+    exit;
+}
+
+$file = $dir . '/' . $host . '_' . gmdate('Ymd-His') . '.json';
+if (file_put_contents($file, $body) === false) {
+    http_response_code(500);
+    echo json_encode(['error' => 'cannot write backup']);
+    exit;
+}
+
+// Prune old backups, keeping the newest KEEP_PER_HOST.
+if (KEEP_PER_HOST > 0) {
+    $existing = glob($dir . '/*.json');
+    if ($existing !== false && count($existing) > KEEP_PER_HOST) {
+        sort($existing); // names sort chronologically (host_YYYYMMDD-HHMMSS.json)
+        $remove = array_slice($existing, 0, count($existing) - KEEP_PER_HOST);
+        foreach ($remove as $old) {
+            @unlink($old);
+        }
+    }
+}
+
+echo json_encode(['ok' => true, 'stored' => basename($file), 'bytes' => strlen($body)]);