The shared Synthology.Shared.Dicom.ScpProxy library binds each enabled listener on startup AND on hot-reload via IProxyListenerProvider.SpecsChanged (300ms debounce). The per-listener AE Title is also used as the LocalCallingAe when ME opens the outbound association to the upstream — so the upstream's Sender / ACL whitelist must accept this AE.

Migration Engine secures data in transit with TLS — DICOM-TLS on the DICOM listeners (HIPAA §164.312(e)(1)) and, where enabled, HTTPS terminated at a reverse proxy. Generate a self-signed TLS certificate + private key (PEM) for this host with the standalone Certificate Builder, then point your TLS settings at the generated .crt / .key (or drop in your own CA-issued certificate). The private key is written on the server and never leaves it — the page shows only the file paths + SHA-256 fingerprint.

Export the full configuration as a JSON file for backup or migration, or import a previously exported configuration. Secrets (the TLS cert password, the progress-webhook bearer token, and each source / target PACS’s bearer / Basic-auth credentials) are redacted by default and re-applied from the running config on import; tick “Include credentials” to export them passphrase-encrypted for a full cross-host clone.

Drag sidebar sections or items (click & hold for ~200ms, then drag) to reorder them. Right-click any sidebar item to hide it, or right-click a section header to restore hidden items. Your layout is stored per user and follows you across sessions.

The dedicated Synthology Support Connector (a cloudflared service this engine supervises) carries engineer remote-support sessions. It starts only when remote_support is licensed and a tunnel token from Synthology is saved in the connector's own configuration; until then it reads not provisioned and is deliberately left stopped. See Help → Operations → “Remote Support Connector” for where to save the token. The token value is never shown here.

Control how many simultaneous DICOM associations are allowed. Outbound sends that exceed the system limit are queued and dispatched as slots become available. Inbound associations are accepted across all listeners combined — per-listener limits in Proxy Listener config still override per-listener.

Push-in migrations: when a remote modality C-STOREs studies into our SCP, we batch by silence. Once no new instances have arrived for a study for Quiescence Window seconds, the study auto-flips to the forward queue. Override per-source on the Sources page.