diff --git a/backend/src/app.module.ts b/backend/src/app.module.ts
index b9a927f..da25673 100644
--- a/backend/src/app.module.ts
+++ b/backend/src/app.module.ts
@@ -5,12 +5,12 @@ import { PicsurConfigModule } from './config/config.module';
 import { ServeStaticConfigService } from './config/servestatic.config.service';
 import { TypeOrmConfigService } from './config/typeorm.config.service';
 import { PicsurLoggerModule } from './logger/logger.module';
+import { AuthManagerModule } from './managers/auth/auth.module';
 import { DemoManagerModule } from './managers/demo/demomanager.module';
 import { AuthModule } from './routes/api/auth/auth.module';
 import { PrefModule } from './routes/api/pref/pref.module';
 import { ImageModule } from './routes/image/imageroute.module';
 
-
 @Module({
   imports: [
     TypeOrmModule.forRootAsync({
@@ -21,6 +21,7 @@ import { ImageModule } from './routes/image/imageroute.module';
       useExisting: ServeStaticConfigService,
       imports: [PicsurConfigModule],
     }),
+    AuthManagerModule,
     AuthModule,
     ImageModule,
     DemoManagerModule,
diff --git a/backend/src/collections/syspreferencesdb/syspreferencedefaults.service.ts b/backend/src/collections/syspreferencesdb/syspreferencedefaults.service.ts
index efbd6af..18e2c4e 100644
--- a/backend/src/collections/syspreferencesdb/syspreferencedefaults.service.ts
+++ b/backend/src/collections/syspreferencesdb/syspreferencedefaults.service.ts
@@ -24,5 +24,6 @@ export class SysPreferenceDefaultsService {
       }
     },
     jwt_expires_in: () => this.jwtConfigService.getJwtExpiresIn() ?? '7d',
+    upload_require_auth: () => 'true',
   };
 }
diff --git a/backend/src/managers/auth/auth.module.ts b/backend/src/managers/auth/auth.module.ts
new file mode 100644
index 0000000..98c5b6d
--- /dev/null
+++ b/backend/src/managers/auth/auth.module.ts
@@ -0,0 +1,55 @@
+import { Logger, Module, OnModuleInit } from '@nestjs/common';
+import { JwtModule } from '@nestjs/jwt';
+import { PassportModule } from '@nestjs/passport';
+import { SysPreferenceModule } from '../../collections/syspreferencesdb/syspreferencedb.module';
+import { UsersModule } from '../../collections/userdb/userdb.module';
+import { AuthConfigService } from '../../config/auth.config.service';
+import {
+  JwtConfigService,
+  JwtSecretProvider
+} from '../../config/jwt.lateconfig.service';
+import { PicsurLateConfigModule } from '../../config/lateconfig.module';
+import { AuthManagerService } from './auth.service';
+import { JwtStrategy } from './guards/jwt.strategy';
+import { LocalAuthStrategy } from './guards/localauth.strategy';
+
+@Module({
+  imports: [
+    UsersModule,
+    PassportModule,
+    SysPreferenceModule,
+    PicsurLateConfigModule,
+    JwtModule.registerAsync({
+      useExisting: JwtConfigService,
+      imports: [PicsurLateConfigModule],
+    }),
+  ],
+  providers: [
+    AuthManagerService,
+    LocalAuthStrategy,
+    JwtStrategy,
+    JwtSecretProvider,
+  ],
+  exports: [AuthManagerService],
+})
+export class AuthManagerModule implements OnModuleInit {
+  private readonly logger = new Logger('AuthModule');
+
+  constructor(
+    private authService: AuthManagerService,
+    private authConfigService: AuthConfigService,
+  ) {}
+
+  async onModuleInit() {
+    await this.ensureAdminExists();
+  }
+
+  private async ensureAdminExists() {
+    const username = this.authConfigService.getDefaultAdminUsername();
+    const password = this.authConfigService.getDefaultAdminPassword();
+    this.logger.debug(`Ensuring admin user "${username}" exists`);
+
+    await this.authService.createUser(username, password);
+    await this.authService.makeAdmin(username);
+  }
+}
diff --git a/backend/src/routes/api/auth/auth.service.ts b/backend/src/managers/auth/auth.service.ts
similarity index 92%
rename from backend/src/routes/api/auth/auth.service.ts
rename to backend/src/managers/auth/auth.service.ts
index cc22e57..87f63f6 100644
--- a/backend/src/routes/api/auth/auth.service.ts
+++ b/backend/src/managers/auth/auth.service.ts
@@ -5,11 +5,11 @@ import { instanceToPlain, plainToClass } from 'class-transformer';
 import { validate } from 'class-validator';
 import { JwtDataDto } from 'picsur-shared/dist/dto/auth.dto';
 import { AsyncFailable, Fail, HasFailed } from 'picsur-shared/dist/types';
-import { UsersService } from '../../../collections/userdb/userdb.service';
-import { EUserBackend } from '../../../models/entities/user.entity';
+import { UsersService } from '../../collections/userdb/userdb.service';
+import { EUserBackend } from '../../models/entities/user.entity';
 
 @Injectable()
-export class AuthService {
+export class AuthManagerService {
   private readonly logger = new Logger('AuthService');
 
   constructor(
diff --git a/backend/src/routes/api/auth/admin.guard.ts b/backend/src/managers/auth/guards/admin.guard.ts
similarity index 100%
rename from backend/src/routes/api/auth/admin.guard.ts
rename to backend/src/managers/auth/guards/admin.guard.ts
diff --git a/backend/src/routes/api/auth/jwt.guard.ts b/backend/src/managers/auth/guards/jwt.guard.ts
similarity index 100%
rename from backend/src/routes/api/auth/jwt.guard.ts
rename to backend/src/managers/auth/guards/jwt.guard.ts
diff --git a/backend/src/routes/api/auth/jwt.strategy.ts b/backend/src/managers/auth/guards/jwt.strategy.ts
similarity index 100%
rename from backend/src/routes/api/auth/jwt.strategy.ts
rename to backend/src/managers/auth/guards/jwt.strategy.ts
diff --git a/backend/src/routes/api/auth/localauth.guard.ts b/backend/src/managers/auth/guards/localauth.guard.ts
similarity index 100%
rename from backend/src/routes/api/auth/localauth.guard.ts
rename to backend/src/managers/auth/guards/localauth.guard.ts
diff --git a/backend/src/routes/api/auth/localauth.strategy.ts b/backend/src/managers/auth/guards/localauth.strategy.ts
similarity index 85%
rename from backend/src/routes/api/auth/localauth.strategy.ts
rename to backend/src/managers/auth/guards/localauth.strategy.ts
index a12528e..4bc886a 100644
--- a/backend/src/routes/api/auth/localauth.strategy.ts
+++ b/backend/src/managers/auth/guards/localauth.strategy.ts
@@ -3,11 +3,11 @@ import { PassportStrategy } from '@nestjs/passport';
 import { Strategy } from 'passport-local';
 import { AsyncFailable, HasFailed } from 'picsur-shared/dist/types';
 import { EUserBackend } from '../../../models/entities/user.entity';
-import { AuthService } from './auth.service';
+import { AuthManagerService } from '../auth.service';
 
 @Injectable()
 export class LocalAuthStrategy extends PassportStrategy(Strategy, 'local') {
-  constructor(private authService: AuthService) {
+  constructor(private authService: AuthManagerService) {
     super();
   }
 
diff --git a/backend/src/routes/api/auth/authrequest.ts b/backend/src/models/dto/authrequest.dto.ts
similarity index 66%
rename from backend/src/routes/api/auth/authrequest.ts
rename to backend/src/models/dto/authrequest.dto.ts
index 4eacf26..4f3c942 100644
--- a/backend/src/routes/api/auth/authrequest.ts
+++ b/backend/src/models/dto/authrequest.dto.ts
@@ -1,5 +1,5 @@
 import { FastifyRequest } from 'fastify';
-import { EUserBackend } from '../../../models/entities/user.entity';
+import { EUserBackend } from '../entities/user.entity';
 
 export default interface AuthFasityRequest extends FastifyRequest {
   user: EUserBackend;
diff --git a/backend/src/routes/api/auth/auth.controller.ts b/backend/src/routes/api/auth/auth.controller.ts
index 6564331..c8d65cd 100644
--- a/backend/src/routes/api/auth/auth.controller.ts
+++ b/backend/src/routes/api/auth/auth.controller.ts
@@ -8,15 +8,15 @@ import {
   AuthRegisterRequest
 } from 'picsur-shared/dist/dto/auth.dto';
 import { HasFailed } from 'picsur-shared/dist/types';
-import { AdminGuard } from './admin.guard';
-import { AuthService } from './auth.service';
-import AuthFasityRequest from './authrequest';
-import { JwtAuthGuard } from './jwt.guard';
-import { LocalAuthGuard } from './localauth.guard';
+import { AuthManagerService } from '../../../managers/auth/auth.service';
+import { AdminGuard } from '../../../managers/auth/guards/admin.guard';
+import { JwtAuthGuard } from '../../../managers/auth/guards/jwt.guard';
+import { LocalAuthGuard } from '../../../managers/auth/guards/localauth.guard';
+import AuthFasityRequest from '../../../models/dto/authrequest.dto';
 
 @Controller('api/auth')
 export class AuthController {
-  constructor(private authService: AuthService) {}
+  constructor(private authService: AuthManagerService) {}
 
   @UseGuards(LocalAuthGuard)
   @Post('login')
diff --git a/backend/src/routes/api/auth/auth.module.ts b/backend/src/routes/api/auth/auth.module.ts
index 2a8de3c..757f50f 100644
--- a/backend/src/routes/api/auth/auth.module.ts
+++ b/backend/src/routes/api/auth/auth.module.ts
@@ -1,54 +1,9 @@
-import { Logger, Module, OnModuleInit } from '@nestjs/common';
-import { JwtModule } from '@nestjs/jwt';
-import { PassportModule } from '@nestjs/passport';
-import { SysPreferenceModule } from '../../../collections/syspreferencesdb/syspreferencedb.module';
-import { UsersModule } from '../../../collections/userdb/userdb.module';
-import { AuthConfigService } from '../../../config/auth.config.service';
-import { JwtConfigService, JwtSecretProvider } from '../../../config/jwt.lateconfig.service';
-import { PicsurLateConfigModule } from '../../../config/lateconfig.module';
+import { Module } from '@nestjs/common';
+import { AuthManagerModule } from '../../../managers/auth/auth.module';
 import { AuthController } from './auth.controller';
-import { AuthService } from './auth.service';
-import { JwtStrategy } from './jwt.strategy';
-import { LocalAuthStrategy } from './localauth.strategy';
-
 
 @Module({
-  imports: [
-    UsersModule,
-    PassportModule,
-    SysPreferenceModule,
-    PicsurLateConfigModule,
-    JwtModule.registerAsync({
-      useExisting: JwtConfigService,
-      imports: [PicsurLateConfigModule],
-    }),
-  ],
-  providers: [
-    AuthService,
-    LocalAuthStrategy,
-    JwtStrategy,
-    JwtSecretProvider,
-  ],
+  imports: [AuthManagerModule],
   controllers: [AuthController],
 })
-export class AuthModule implements OnModuleInit {
-  private readonly logger = new Logger('AuthModule');
-
-  constructor(
-    private authService: AuthService,
-    private authConfigService: AuthConfigService,
-  ) {}
-
-  async onModuleInit() {
-    await this.ensureAdminExists();
-  }
-
-  private async ensureAdminExists() {
-    const username = this.authConfigService.getDefaultAdminUsername();
-    const password = this.authConfigService.getDefaultAdminPassword();
-    this.logger.debug(`Ensuring admin user "${username}" exists`);
-
-    await this.authService.createUser(username, password);
-    await this.authService.makeAdmin(username);
-  }
-}
+export class AuthModule {}
diff --git a/backend/src/routes/api/pref/pref.controller.ts b/backend/src/routes/api/pref/pref.controller.ts
index b9380f0..90db5c5 100644
--- a/backend/src/routes/api/pref/pref.controller.ts
+++ b/backend/src/routes/api/pref/pref.controller.ts
@@ -12,8 +12,8 @@ import {
 } from 'picsur-shared/dist/dto/syspreferences.dto';
 import { HasFailed } from 'picsur-shared/dist/types';
 import { SysPreferenceService } from '../../../collections/syspreferencesdb/syspreferencedb.service';
-import { AdminGuard } from '../auth/admin.guard';
-import { JwtAuthGuard } from '../auth/jwt.guard';
+import { AdminGuard } from '../../../managers/auth/guards/admin.guard';
+import { JwtAuthGuard } from '../../../managers/auth/guards/jwt.guard';
 
 @UseGuards(JwtAuthGuard, AdminGuard)
 @Controller('api/pref')
diff --git a/shared/src/dto/syspreferences.dto.ts b/shared/src/dto/syspreferences.dto.ts
index e36e42e..8ec5c11 100644
--- a/shared/src/dto/syspreferences.dto.ts
+++ b/shared/src/dto/syspreferences.dto.ts
@@ -1,9 +1,11 @@
-import { generateRandomString } from '../util/random';
-import tuple from '../types/tuple';
-import { randomBytes } from 'crypto';
 import { IsNotEmpty } from 'class-validator';
+import tuple from '../types/tuple';
 
-const SysPreferencesTuple = tuple('jwt_secret', 'jwt_expires_in');
+const SysPreferencesTuple = tuple(
+  'jwt_secret',
+  'jwt_expires_in',
+  'upload_require_auth',
+);
 
 export const SysPreferences: string[] = SysPreferencesTuple;
 export type SysPreferences = typeof SysPreferencesTuple[number];