diff --git a/docker-compose.yml b/docker-compose.yml
index d442d74..1f85ba3 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,10 +1,7 @@
 version: "3.9"
 
 # =============================================================
-# Dragon Wind — Full Stack
-# Services:
-#   dragon-wind   — Main upload web app (port 3000)
-#   udp-relay     — UDP relay server (TCP 3001 + UDP 5000)
+# Dragon Wind — Upload Portal
 # =============================================================
 
 services:
@@ -30,30 +27,9 @@ services:
       - S3_BUCKET=${S3_BUCKET:-}
       - S3_ACCESS_KEY=${S3_ACCESS_KEY:-}
       - S3_SECRET_KEY=${S3_SECRET_KEY:-}
-      # Relay URL for UDP mode
-      - RELAY_URL=${RELAY_URL:-http://udp-relay:3001}
-      - UDP_PORT=${UDP_PORT:-5000}
       # AMPP (optional)
       - AMPP_BASE_URL=${AMPP_BASE_URL:-https://us-east-1.gvampp.com}
       - AMPP_API_KEY=${AMPP_API_KEY:-}
-    depends_on:
-      - udp-relay
-    networks:
-      - dragon-wind-net
-
-  udp-relay:
-    build:
-      context: ./udp-relay
-      dockerfile: Dockerfile
-    container_name: dragon-wind-relay
-    restart: unless-stopped
-    ports:
-      - "${RELAY_TCP_PORT:-3001}:3001"       # Control API (TCP)
-      - "${RELAY_UDP_PORT:-5000}:5000/udp"   # Data transfer (UDP)
-    environment:
-      - PORT=3001
-      - UDP_PORT=5000
-      - MAX_SESSIONS=${MAX_RELAY_SESSIONS:-50}
     networks:
       - dragon-wind-net
 
diff --git a/public/index.html b/public/index.html
index 75b6f57..257c68b 100644
--- a/public/index.html
+++ b/public/index.html
@@ -468,7 +468,6 @@ body::before{content:'';position:fixed;inset:0;background:radial-gradient(ellips
       </div>
       <div class="mode-desc" id="mode-desc" style="margin-bottom:0">
         <strong id="mode-label">HTTP Mode:</strong> <span id="mode-detail">Parallel chunked HTTP upload (6 concurrent 32 MB parts). Aspera-class speed — no UDP needed.</span>
-        <span id="udp-ext-hint" style="display:none;margin-left:.5rem;color:var(--dragon-bright);font-size:.75rem">⚡ UDP extension detected</span>
       </div>
     </div>
 
@@ -524,7 +523,6 @@ body::before{content:'';position:fixed;inset:0;background:radial-gradient(ellips
       <div class="admin-tab" data-tab="users" onclick="switchAdminTab('users')">Users</div>
       <div class="admin-tab" data-tab="sharelinks" onclick="switchAdminTab('sharelinks')">🔗 Share Links</div>
       <div class="admin-tab" data-tab="folders" onclick="switchAdminTab('folders')">Folders</div>
-      <div class="admin-tab" data-tab="relay" onclick="switchAdminTab('relay')">⚡ UDP Relay <span style="font-size:.65rem;background:var(--dragon-bright);color:#000;border-radius:4px;padding:1px 5px;margin-left:4px;vertical-align:middle">COMING SOON</span></div>
     </div>
 
     <!-- S3 -->
@@ -553,7 +551,7 @@ body::before{content:'';position:fixed;inset:0;background:radial-gradient(ellips
     </div>
 
     <!-- Relay -->
-    <div class="admin-panel" id="admin-relay">
+    <div class="admin-panel" id="admin-relay" style="display:none!important">
       <div class="section-title">UDP Relay Configuration</div>
       <div style="background:linear-gradient(135deg,rgba(255,180,0,.08),rgba(255,120,0,.08));border:1px solid rgba(255,180,0,.3);border-radius:10px;padding:1.2rem 1.4rem;margin-bottom:1.5rem">
         <div style="font-size:1rem;font-weight:700;color:var(--dragon-bright);margin-bottom:.4rem">⚡ Coming Soon — Electron Desktop Uploader</div>
diff --git a/server.js b/server.js
index de32bc5..c34727d 100644
--- a/server.js
+++ b/server.js
@@ -426,12 +426,16 @@ app.put("/api/s3/config", requireAdmin, (req, res) => {
   // endpoint is optional for AWS S3 (leave blank to use AWS default)
   if (!region || !bucket || !accessKeyId)
     return res.status(400).json({ success: false, error: "region, bucket, and accessKeyId are required" });
+  // First-time setup requires a secret key
+  const existingSecret = db.s3Config?.secretAccessKey;
+  if (!secretAccessKey && !existingSecret)
+    return res.status(400).json({ success: false, error: "Secret Access Key is required (no existing secret on file)" });
   if (!db.s3Config) db.s3Config = {};
   db.s3Config.endpoint = (endpoint || "").trim();
   db.s3Config.region = region.trim();
   db.s3Config.bucket = bucket.trim();
   db.s3Config.accessKeyId = accessKeyId.trim();
-  if (secretAccessKey) db.s3Config.secretAccessKey = secretAccessKey;
+  if (secretAccessKey) db.s3Config.secretAccessKey = secretAccessKey.trim();
   saveData(db);
   initS3();
   res.json({ success: true, message: "S3 configuration saved" });