diff --git a/docs/https-setup.md b/docs/https-setup.md
index 7676f3f..725ba6f 100644
--- a/docs/https-setup.md
+++ b/docs/https-setup.md
@@ -97,6 +97,10 @@ Go to **Hosts → Proxy Hosts → Add Proxy Host** and fill in the **Details** t
| Block Common Exploits | on |
| **Websockets Support** | **on — this one is not optional** |
+
+ 
+
+
> ### Websockets Support must be on
>
> mc-webui pushes new messages to open pages over a WebSocket. Without this switch, nginx
@@ -133,6 +137,14 @@ router to this host.
Then edit the proxy host → **SSL** tab → pick the certificate from the list → enable
**Force SSL** and **HTTP/2 Support** → Save.
+
+ 
+
+
+The screenshot shows the shortcut mentioned above: **Request a new Certificate** right on
+the proxy host's SSL tab, which creates the certificate and attaches it in one step
+instead of visiting the Certificates page first. Leave **HSTS Enabled** off for now.
+
That is it. The certificate is trusted by every browser and phone with no warnings, and
NPM renews it automatically.
@@ -177,6 +189,12 @@ Then, in NPM:
NPM warns, correctly, that this is stored in plain text in its database and in a file
on the server. Certbot needs to read it at every automatic renewal, which is why it is
kept — and why scoping the token to one zone matters.
+
+
+ 
+
+
+ The token shown in that box is NPM's own placeholder, not a real one — replace it.
6. Leave *Propagation Seconds* empty to use the plugin's default. If issuing fails on a
timeout, come back and try 60.
7. Save, and give it up to a minute. The certificate appears in the list with an expiry
@@ -298,14 +316,34 @@ front of everything.
on, satisfying *any one* condition is enough, which is not what you want when the
password is the only condition. Leave **Pass Auth to Upstream** off too; mc-webui does
not read the `Authorization` header, so there is nothing to pass on
+
+
+ 
+
+
3. On **Authorizations**, add a username and password. Add more than one if several people
use the instance — each gets their own
+
+
+ 
+
+
4. **Rules** is optional: it allows or denies whole IP addresses and ranges, on top of the
password
5. Save, then go to **Hosts → Proxy Hosts**, open your host's **⋮ → Edit**, and set
**Access List** to the one you just created. Save
-The host's **ACCESS** column should now name your list instead of *Publicly Accessible*.
+
+ 
+
+
+The host's **ACCESS** column should now name your list instead of *Publicly Accessible*,
+and the Access Lists page counts the hosts using it:
+
+
+ 
+
+
Every path is covered — the interface, the API, and the websocket — so there is no way in
that skips the prompt.
diff --git a/images/npm-01-proxy-host-details.png b/images/npm-01-proxy-host-details.png
new file mode 100644
index 0000000..8cec555
Binary files /dev/null and b/images/npm-01-proxy-host-details.png differ
diff --git a/images/npm-02-ssl-letsencrypt.png b/images/npm-02-ssl-letsencrypt.png
new file mode 100644
index 0000000..bcc05e3
Binary files /dev/null and b/images/npm-02-ssl-letsencrypt.png differ
diff --git a/images/npm-03-ssl-dns-challenge.png b/images/npm-03-ssl-dns-challenge.png
new file mode 100644
index 0000000..ca2c703
Binary files /dev/null and b/images/npm-03-ssl-dns-challenge.png differ
diff --git a/images/npm-04-access-list-details.png b/images/npm-04-access-list-details.png
new file mode 100644
index 0000000..0304871
Binary files /dev/null and b/images/npm-04-access-list-details.png differ
diff --git a/images/npm-05-access-list-users.png b/images/npm-05-access-list-users.png
new file mode 100644
index 0000000..52d6a8d
Binary files /dev/null and b/images/npm-05-access-list-users.png differ
diff --git a/images/npm-06-proxy-host-access-list.png b/images/npm-06-proxy-host-access-list.png
new file mode 100644
index 0000000..0b8b1fa
Binary files /dev/null and b/images/npm-06-proxy-host-access-list.png differ
diff --git a/images/npm-07-access-lists-overview.png b/images/npm-07-access-lists-overview.png
new file mode 100644
index 0000000..6543373
Binary files /dev/null and b/images/npm-07-access-lists-overview.png differ