Tutorial - Deploy Ente.io as selfhosted instance

[vicky-bs]

Hello, Please consider the following tutorial with a pinch of salt. Thanks to the dev community here on github and discord and a huge thank you to the ente community members who helped bring the puzzle together (specially @ekadin-mtc and @LI-NA)

I hope this helps someone like me a one place instruction to deploy your own instance

Requirements to build

1. Linux & Docker Installed. VSCode is an advantage
2. To build the image from source you will require
   • Yarn - sudo apt install yarn
   • NPM - sudo apt install npm
   • Git - sudo apt install git
     Follow the guide here to install dependencies - https://help.ente.io/self-hosting/

Building Ente Server from source

1. Pull Ente git repo to VSCode folder/workspace
   git clone https://github.com/ente-io/ente.git
2. Go to root ente folder and run the following git command
   git submodule update --init --recursive
3. Navigate to ente/server folder and locate the Dockerfile
4. in VSCode run command

docker build --no-cache --progress=plain -t <dockerhub repo>/<image name>:<imagetag> -f Dockerfile . |& tee build.log

5. Once image is built use command docker push to your personal dockerhub repository

Building Ente Web/Albums/Auth/Accounts from source

1. Navigate to ente/web folder and create new file called Dockerfile at the root of web folder.

FROM node:21-alpine AS builder

WORKDIR /app
COPY . .

ARG NEXT_PUBLIC_ENTE_ENDPOINT=https://ente.example.com
ENV NEXT_PUBLIC_ENTE_ENDPOINT=${NEXT_PUBLIC_ENTE_ENDPOINT}

ARG NEXT_PUBLIC_ENTE_ALBUMS_ENDPOINT=https://album.example.com
ENV NEXT_PUBLIC_ENTE_ALBUMS_ENDPOINT=${NEXT_PUBLIC_ENTE_ALBUMS_ENDPOINT}

ARG NEXT_PUBLIC_ENTE_ACCOUNTS_URL=https://accounts.example.com
ENV NEXT_PUBLIC_ENTE_ACCOUNTS_URL=${NEXT_PUBLIC_ENTE_ACCOUNTS_URL}

RUN yarn install && yarn build:photos && yarn build:auth && yarn build:accounts

FROM node:21-alpine

WORKDIR /app
COPY --from=builder /app/apps/photos/out /app/photos
COPY --from=builder /app/apps/auth/out /app/auth
COPY --from=builder /app/apps/accounts/out /app/accounts

RUN npm install -g serve

ENV WEBPORT=3000
EXPOSE ${WEBPORT}

ENV PUBLICPORT=3002
EXPOSE ${PUBLICPORT}

ENV ACCOUNTS=3001
EXPOSE ${ACCOUNTS}

ENV AUTHPORT=3005
EXPOSE ${AUTHPORT}

CMD ["sh", "-c", "serve /app/photos -l tcp://0.0.0.0:${WEBPORT} -l tcp://0.0.0.0:${PUBLICPORT} & serve /app/auth -l tcp://0.0.0.0:${AUTHPORT} & serve /app/accounts -l tcp://0.0.0.0:${ACCOUNTS}"]

2. in VSCode run command

docker build --no-cache --progress=plain -t <dockerhub repo>/<image name>:<imagetag> -f Dockerfile . |& tee build.log

3. Once image is built use command docker push to your personal dockerhub repository

Docker Compose File

services:
  museum:
    # Uncomment below if you prefer to build
    #build:
      #context: .
      #args:
        #GIT_COMMIT: development-cluster
    image: <repo>/<imagename>:<tagname>
    container_name: ente-museum
    restart: always
    ports:
      - 8080:8080 # API
      #- 2112:2112 # Prometheus metrics
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      # Pass-in the config to connect to the DB and MinIO
      ENTE_CREDENTIALS_FILE: /credentials.yaml
    volumes:
      - ./ente/custom-logs:/var/logs
      - ./ente/museum.yaml:/museum.yaml:ro
      - ./ente/scripts/compose/credentials.yaml:/credentials.yaml:ro
      - ./ente/data:/data:ro
    networks:
      - ente
  
  web:
    image: <repo>/<imagename>:<tagname>
    container_name: ente-web
    restart: always
    environment:
      NEXT_PUBLIC_ENTE_ENDPOINT: https://ente.example.com
      NEXT_PUBLIC_ENTE_ALBUMS_ENDPOINT: https://album.example.com
      NEXT_PUBLIC_ENTE_ACCOUNTS_URL: https://accounts.example.com
    ports:
      - "3000:3000"
      - "3001:3001"
      - "3002:3002"
      - "3005:3005"
    networks:
      - ente

  # Resolve "localhost:3200" in the museum container to the minio container.
  socat:
    image: alpine/socat
    container_name: ente-socat
    restart: always
    network_mode: service:museum
    depends_on:
      - museum
    command: "TCP-LISTEN:3200,fork,reuseaddr TCP:minio:3200"

  postgres:
    image: postgres:16
    container_name: ente-postgres
    restart: always
    ports:
      - 5432:5432
    environment:
      POSTGRES_USER: pguser
      POSTGRES_PASSWORD: changemechangeme
      POSTGRES_DB: ente_db
    # Wait for postgres to be accept connections before starting museum.
    healthcheck:
      test:
        [
          "CMD",
          "pg_isready",
          "-q",
          "-d",
          "ente_db",
          "-U",
          "pguser"
        ]
      start_period: 40s
      start_interval: 1s
    volumes:
      - ./ente/postgres-data:/var/lib/postgresql/data
    networks:
      - ente

  minio:
    image: minio/minio
    container_name: ente-minio
    restart: always
    # Use different ports than the minio defaults to avoid conflicting
    # with the ports used by Prometheus.
    ports:
      - 3200:3200 # API
      - 3201:3201 # Console
    environment:
      MINIO_SERVER_URL: "http://minio.example.com/"
      MINIO_BROWSER_REDIRECT_URL: "http://minio.example.com/console/"
      MINIO_ROOT_USER: admin
      MINIO_ROOT_PASSWORD: changemechangeme
    command: server /data --address ":3200" --console-address ":3201"
    volumes:
      - ./ente/minio-data:/data
    networks:
      - ente

  minio-provision:
    image: minio/mc
    container_name: ente-provision
    depends_on:
      - minio
    volumes:
      - ./ente/scripts/compose/minio-provision.sh:/provision.sh:ro
      - ./ente/minio-data:/data
    networks:
      - ente
    entrypoint: sh /provision.sh

networks:
  ente:
    external: true

4. Note
   • Don't change the container port
   • Volume where museum.yaml, credentials.yaml is stored when containers spins up
   • The following ports for web is exposed
     • 3000 - Web application port
     • 3001 - Accounts port (Passkey support)
     • 3002 - Albums port (To share public albums)
     • 3005 - Ente auth (For Ente Auth application)
   • Check passwords for postgres, minio matches with museum.yaml, credentials.yaml and minio-provision.sh
   • If hosted behind proxy then FQDN is need to expose all the environments correctly eg. NEXT_PUBLIC_ENTE_ENDPOINT or MINIO_SERVER_URL
   • Network (Please note that the containers needs to speak to on another so should be under a single network)

Save the following file within the path mentioned in docker compose file

Credentials.yaml

db:
    host: postgres
    port: 5432
    name: ente_db
    user: pguser
    password: changemechangeme

s3:
    are_local_buckets: true
    b2-eu-cen:
        key: admin
        secret: changemechangeme
        endpoint: https://minio.example.com
        region: eu-central-2
        bucket: b2-eu-cen
    wasabi-eu-central-2-v3:
        key: admin
        secret: changemechangeme
        endpoint: http://localhost:3200
        region: eu-central-2
        bucket: wasabi-eu-central-2-v3
        compliance: false
    scw-eu-fr-v3:
        key: admin
        secret: changemechangeme
        endpoint: http://localhost:3200
        region: eu-central-2
        bucket: scw-eu-fr-v3

Museum.yaml

# HTTP connection parameters
http:
    # If true, bind to 443 and use TLS.
    # By default, this is false, and museum will bind to 8080 without TLS.
    # use-tls: true

# Specify the base endpoints for various apps
apps:
    # Default is https://albums.ente.io
    #
    # If you're running a self hosted instance and wish to serve public links,
    # set this to the URL where your albums web app is running.
    public-albums: https://pics.example.com

# SMTP configuration (optional)
#
# Configure credentials here for sending mails from museum (e.g. OTP emails).
#
# The smtp credentials will be used if the host is specified. Otherwise it will
# try to use the transmail credentials. Ideally, one of smtp or transmail should
# be configured for a production instance.
#
# username and password are optional (e.g. if you're using a local relay server
# and don't need authentication).
#smtp:
#    host: 
#    port: 
#    username: 
#    password: 
#    # The email address from which to send the email. Set this to an email
#    # address whose credentials you're providing.
#    email: 

# Passkey support (optional)
# Use case: MFA
webauthn:
    # Our "Relying Party" ID. This scopes the generated credentials.
    # See: https://www.w3.org/TR/webauthn-3/#rp-id
    rpid: accounts.example.com
    # Whitelist of origins from where we will accept WebAuthn requests.
    # See: https://github.com/go-webauthn/webauthn
    rporigins:
        - "https://accounts.example.com"

s3:
    are_local_buckets: true
    b2-eu-cen:
        key: admin
        secret: changeme
        endpoint: https://minio.example.com
        region: eu-central-2
        bucket: b2-eu-cen

# Add this once you have done the CLI part
#internal:
#    admins:
#        - 1580559962386438

Minio-provision.sh

#!/bin/sh

# Script used to prepare the minio instance that runs as part of the development
# Docker compose cluster.

while ! mc config host add h0 http://minio:3200 admin changemechangeme
do
   echo "waiting for minio..."
   sleep 0.5
done

cd /data

mc mb -p b2-eu-cen
mc mb -p wasabi-eu-central-2-v3
mc mb -p scw-eu-fr-v3

You can now go ahead and run docker-compose up -d or use the docker-compose content and deploy via portainer

Please note - My set up does reverse proxy via nginx using Linuxserv.io Swag container and the following .conf files to expose all the services from the docker-compose file

ente-server.subdomain.conf

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name ente.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;
    location / {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app 192.168.1.102;
        set $upstream_port 3001;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }
}

ente-web.subdomain.conf

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name pics.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;
    location / {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app 192.168.1.102;
        set $upstream_port 3000; 
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
	}
}

ente-album.subdomain.conf

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name album.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    location / {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app 192.168.1.102;
        set $upstream_port 3002;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
	}
}

ente-accounts.subdomain.conf

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name accounts.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    location / {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app 192.168.1.102;
        set $upstream_port 3001;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
	}
}

ente-auth.subdomain.conf

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name auth.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    location / {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app 192.168.1.102;
        set $upstream_port 3005;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }
}

ente-minio.subdomain.conf

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name minio.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;
    proxy_buffering off;
    ignore_invalid_headers off;
    
    set $upstream "minio";

    location /console/ {
        rewrite ^/console/(.*)$ /$1 break;
        proxy_pass http://$upstream:3201;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        proxy_connect_timeout 300;
        # To support websocket
        # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        chunked_transfer_encoding off;  

    }

    # Proxy requests to the Minio API on port 9000
    location / {
        proxy_pass http://$upstream:3200;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        proxy_connect_timeout 300;
        # To support websocket
        # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        chunked_transfer_encoding off;
        
    }

}

Use Ente CLI to remove storage restrictions. Follow the link here to download CLI and use the respective commands to remove restrictions

https://help.ente.io/self-hosting/guides/admin

[vicky-bs]

@mnvr FYI if this helps in documentation

[mnvr]

Thanks, I've linked to this from the docs

[Magneticdud]

I have less than a week of experience with ente so I might say something stupid: for public albums does it really needs to expose another port? Can't just forward port 3000 (web) and then set that url ffor the public albums?

[ekadin-mtc]

@Magneticdud I think you're right. I just tested it out and it seems to work as expected. The web URL goes to the regular photos app and the public album URL goes to there.
Here it clearly says that you either need a different port OR a different hostname. The one question is why they write that it needs to be 2 instances? Unless that just means 2 hostnames?

@vicky-bs You can test for yourself with your setup and report back.

[vicky-bs]

@Magneticdud @ekadin-mtc Yup looks like you don't need to expose a new port for album afterall. You just need another hostname to serve on the same port 3000 and album sharing would work well

Changes to Dockerfile

ENV WEBPORT=3000
EXPOSE ${WEBPORT}

ENV PUBLICPORT=3002
EXPOSE ${PUBLICPORT}

ENV ACCOUNTS=3001
EXPOSE ${ACCOUNTS}

ENV AUTHPORT=3005
EXPOSE ${AUTHPORT}

CMD ["sh", "-c", "serve /app/photos -l tcp://0.0.0.0:${WEBPORT} -l tcp://0.0.0.0:${PUBLICPORT} & serve /app/auth -l tcp://0.0.0.0:${AUTHPORT} & serve /app/accounts -l tcp://0.0.0.0:${ACCOUNTS}"]

Changes to Compose File
ports:
- "3000:3000"
- "3001:3001"
- "3002:3002"
- "3005:3005"

Changes to ente-album.subdomain.conf

server {
listen 443 ssl;
listen [::]:443 ssl;

server_name album.*;

include /config/nginx/ssl.conf;

client_max_body_size 0;

location / {
    include /config/nginx/proxy.conf;
    include /config/nginx/resolver.conf;
    set $upstream_app 192.168.1.102;
    set $upstream_port 3000;
    set $upstream_proto http;
    proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}

}

[mngshm]

Credentials.yaml

is supposed to be a hidden file right ? ".credentials.yaml" ? Not sure if that is mandatory but I've seen it that way, nothing mandatory though.

[vicky-bs]

@mngshm If you changing the filename remember to change it under volume and environment under museum service so it is able to pick the right file

[709397578]

How can the client build it themselves? The app does not need to fill in configuration？

[mngshm]

Which app are you talking about ? Is it the web app ? If so, the web app is built and served with yarn

[709397578]

I'm referring to the mobile app

[mngshm]

https://help.ente.io/self-hosting/guides/mobile-build

steps to build the mobile app.

[709397578]

thank you very much

[A4alli]

Thankyou! But can I get a local storage instead of S3. And what will be the configuration for caddy as reverse proxy

Regards

[mngshm]

1. Yes, you can do that.
2. https://gist.github.com/mngshm/72e32bd483c2129621ed0d74412492fd this has the config to reverse_proxy with caddy.

[A4alli]

Thankyou. I'm giving it a try

[A4alli]

On November 5, 2024 8:20:45 AM UTC, mangesh ***@***.***> wrote: 1. Yes, you can do that. 2. https://gist.github.com/mngshm/72e32bd483c2129621ed0d74412492fd this has the config to reverse_proxy with caddy. -- Reply to this email directly or view it on GitHub: #3778 (comment) You are receiving this because you commented. Message ID: ***@***.***>

What about local storage. Can I use it instead of S3

[mngshm]

Yes, you can do that. You can check #3844 on how to bump up the storage.

[A4alli]

Struggling to setup with Tailscale and caddy. Any help. May be tutorial.

[mngshm]

I haven't used tailscale before :( Can try helping with whatever errors you face. Additionally, tomorrow I'll try learning and using tailscale (or maybe headscale the open source alternative).

[A4alli]

I will be looking forward. Btw, tailscale is mostly open source. And used widely. Well this will be interesting. Figure crossed.... 🥰🥰🥰🤞🤞

[A4alli]

you had mentioned that no ports to change? whats the effect. I have other service running on 8080, 443,80. what is recommended in my use case?

[Seele0oO]

Is there a storage capacity limit for self-hosting? I've tried turning on a self-hosted server and still see the 5GB space limit (but I haven't verified if it's real).

[mngshm]

No, you can increase/bump the storage whenever you want. If you are using any external Object Storage service like AWS S3, Hetzner Object Storage then you can increase that any time. Perhaps, if you are just using your servers disk storage as S3 then that limit will be applied.

Also you have to increase the storage from 5GB after you complete the basic setup.

Ref:

1. https://help.ente.io/self-hosting/guides/configuring-s3
2. https://help.ente.io/self-hosting/guides/external-s3

[Seele0oO]

No, you can increase/bump the storage whenever you want. If you are using any external Object Storage service like AWS S3, Hetzner Object Storage then you can increase that any time. Perhaps, if you are just using your servers disk storage as S3 then that limit will be applied.

Also you have to increase the storage from 5GB after you complete the basic setup.

Ref:

1. https://help.ente.io/self-hosting/guides/configuring-s3

2. https://help.ente.io/self-hosting/guides/external-s3

if you are just using your servers disk storage as S3 then that limit will be applied.

Limit by my storage size or this application?

I have a huge TrueNAS,If I setup S3 storage,the performance maybe lower.

[mngshm]

Limit by my storage size

What I mean to say is, if you use your server disk storage for storing your ente media (photos etc) then your servers disk storage will be the limit here, and you might need to push your servers disk storage. WIth my little experience with AWS S3, I think AWS charges in a "charge as you go" model wherein they do not limit you but charge for whatever resource you've used in a particular time span.

I have a huge TrueNAS

I am not much aware of TrueNAS because I've never used or setup TrueNAS myself.

[Seele0oO]

Thank you very much for your quick reply, it solved my query.
As far as the cost is concerned, I would prefer to purchase rather than subscribe.

[A4alli]

@mngshm have you tried Ente with Tailscale?

[A4alli]

I mean you told that you will give it a try may be.

[mngshm]

Hey nope, I was busy with other work and I did not want to break it again (had broke it last week while trying to replicate someone's issue :p). Does it work well for you ?

I don't think there should be an issue. In my understanding as the only thing tailscale would change is the IP's and the routes for reverse proxies.

[A4alli]

I miss config things. If you could make a compose.ymal, and I will spin it forb testing

[A4alli]

@mngshm any good news regarding tailscale test?

[bgthb]

I have hosted it in a similar way (only on Portainer with volumes instead of direct links) and everything is working perfectly, except: If I try to open the Webapp or the Auth webapp, they are redirecting me to the official sites. Any hint on why this might happen?

[bgthb]

Good spot! The ports seem messed up.
just to make sure: how many domains should I have?
Accounts -> Webapplication
API -> museum api
Albums -> Albums Web Application
Auth -> Auth webapp
Pics -> public accessible webapp (?)

Is that it?

[ekadin-mtc]

No.
Accounts = Passkeys
Albums = Public Pics
Pics = Pics (web application)

[bgthb]

Ah okay thanks for the clarification. Seems like I got that wrong and messed the config up.
What’s the AUTHPORT for?

Thank you for helping me setting this up.

[ekadin-mtc]

That's for the 2FA auth webapp. Just allows you to view and copy your codes. Nothing else at the moment.

[bgthb]

Okay thanks for the clarification. After a redeployment and a rebuild of the web-container, everything seems to work except the accounts-webapp.
The current port-mapping is as follows:

web:
    image: ente-web:latest
    container_name: ente-web
    restart: always
    environment:
      NEXT_PUBLIC_ENTE_ENDPOINT: https://pics.int.tld
      NEXT_PUBLIC_ENTE_ALBUMS_ENDPOINT: https://entealbum.int.tld
      NEXT_PUBLIC_ENTE_ACCOUNTS_URL: https://enteaccounts.int.tld
    ports:
      - "3000:3000" # webport
      - "3001:3001" # accounts
      - "3002:3002" # publicport
      - "3005:3005" # authport
    networks:
      - ente
      - traefik_proxy
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik_proxy"
      
      - "traefik.http.routers.enteweb.rule=Host(`pics.int.tld`)"
      - "traefik.http.routers.enteweb.entrypoints=websecure"
      - "traefik.http.routers.enteweb.tls=true"
      - "traefik.http.routers.enteweb.service=enteweb"
      - "traefik.http.services.enteweb.loadbalancer.server.port=3000"
      
      - "traefik.http.routers.entealbum.rule=Host(`entealbum.int.tld`)"
      - "traefik.http.routers.entealbum.entrypoints=websecure"
      - "traefik.http.routers.entealbum.tls=true"
      - "traefik.http.routers.entealbum.service=entealbum"
      - "traefik.http.services.entealbum.loadbalancer.server.port=3002"
      
      - "traefik.http.routers.enteaccounts.rule=Host(`enteaccounts.int.tld`)"
      - "traefik.http.routers.enteaccounts.entrypoints=websecure"
      - "traefik.http.routers.enteaccounts.tls=true"
      - "traefik.http.routers.enteaccounts.service=enteaccounts"
      - "traefik.http.services.enteaccounts.loadbalancer.server.port=3001"

      - "traefik.http.routers.enteauth.rule=Host(`enteauth.int.tld`)"
      - "traefik.http.routers.enteauth.entrypoints=websecure"
      - "traefik.http.routers.enteauth.tls=true"
      - "traefik.http.routers.enteauth.service=enteauth"
      - "traefik.http.services.enteauth.loadbalancer.server.port=3005"

Also I dropped into the container to check the env variables:

/app/accounts # env
NODE_VERSION=21.7.3
HOSTNAME=11f65ede3fbb
YARN_VERSION=1.22.19
SHLVL=1
HOME=/root
OLDPWD=/app
NEXT_PUBLIC_ENTE_ENDPOINT=https://pics.int.tld
ACCOUNTS=3001
NEXT_PUBLIC_ENTE_ALBUMS_ENDPOINT=https://entealbum.int.tld
TERM=xterm-256color
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PUBLICPORT=3002
LANG=C.UTF-8
WEBPORT=3000
LC_ALL=C.UTF-8
AUTHPORT=3005
PWD=/app/accounts
NEXT_PUBLIC_ENTE_ACCOUNTS_URL=https://enteaccounts.int.tld

Pics, Album and Auth work, the accouts-app keeps redirecting me to web.ente.io. Can anybody spot something I am missing?

Thanks again for your support and a great project!

[kabatp]

I would like to continue with this thread and ask for help with my setup issues. I am running TrueNas Scale 24.10 with Docker support. I composed Ente as a custom app via compose.yaml. I want to run Ente exposed to the internet so it is usable from Phones or laptops outside of my network. For this reason, I am using Nginx Proxy Manager. I managed the following:

• Manage the server via CLI from outside and inside of the network. - working correctly
• SMTP setup for verification codes and so on. - working correctly

I have no issue with running all services inside of my network - mobile apps are working correctly, and web apps are working almost flawlessly (I have an issue with album sharing and cast "Device not found").

Once I disconnect from my network, I am able to access all of the web apps - cast, auth, and photos. I am able to log into Auth and Photos. Photos are not showing pictures but only placeholders - this is fixed with me connecting to the home network. The phone is not able to upload but is showing the pictures.

If we do not count Cast and Albums, everything works fine when I set up the MinIO container for the home network.

I am assuming the issue is with the museum not being able to connect to MinIO as the setup is rooting it to an outside network via Nginx reverse proxy. I tried to ping that address from the museum container but with no success - curl works but authentication will fail.

As I mentioned, when I change the outside addresses for the home network, uploading and loading pictures works correctly.

My config:

compose.yaml :

services:
  museum:
    image: ghcr.io/ente-io/server
    ports:
      - 8080:8080 # API
      - 2112:2112 # Prometheus metrics
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      # Pass-in the config to connect to the DB and MinIO
      ENTE_CREDENTIALS_FILE: /mnt/Tank1/ente/server/credentials.yaml
    volumes:
      - custom-logs:/var/logs
      - /mnt/Tank1/ente/server/museum.yaml:/museum.yaml:ro
      - /mnt/Tank1/ente/server/credentials.yaml:/credentials.yaml:ro
      - /mnt/Tank1/ente/server/data:/data:ro
    networks:
      - internal

  # Resolve "localhost:3200" in the museum container to the minio container.
  socat:
    image: alpine/socat
    network_mode: service:museum
    depends_on:
      - museum
    command: "TCP-LISTEN:3200,fork,reuseaddr TCP:minio:3200"

  postgres:
    image: postgres:15
    ports:
      - 5432:5432
    environment:
      POSTGRES_USER: pguser
      POSTGRES_PASSWORD: pgpass
      POSTGRES_DB: ente_db
    # Wait for postgres to accept connections before starting museum.
    healthcheck:
      test:
        [
          "CMD",
          "pg_isready",
          "-q",
          "-d",
          "ente_db",
          "-U",
          "pguser"
        ]
      start_period: 40s
      start_interval: 1s
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - internal

  minio:
    image: minio/minio
    # Use different ports than the minio defaults to avoid conflicting
    # with the ports used by Prometheus.
    ports:
      - 3200:3200 # API
      - 3201:3201 # Console
    environment:
      MINIO_ROOT_USER: test
      MINIO_ROOT_PASSWORD: testtest
    command: server /data --address ":3200" --console-address ":3201"
    volumes:
      - minio-data:/data
    networks:
      - internal

  minio-provision:
    image: minio/mc
    depends_on:
      - minio
    volumes:
      - /mnt/Tank1/ente/server/minio-provision.sh:/provision.sh:ro
      - minio-data:/data
    networks:
      - internal
    entrypoint: sh /provision.sh

  ente-web:
    image: ente-web:20241223 # name of the image you used while building
    ports:
      - 3000:3000
      - 3001:3001
      - 3002:3002
      - 3003:3003
      - 3004:3004
    environment:
      - NEXT_PUBLIC_ENTE_ALBUMS_ENDPOINT=https://ealbum.example.com:1543
      - NEXT_PUBLIC_ENTE_ACCOUNTS_ENDPOINT=https://eaccounts.example.com:1543
    restart: always

volumes:
  custom-logs:
  postgres-data:
  minio-data:

networks:
  internal:

credentials.yaml

db:
    host: postgres
    port: 5432
    name: ente_db
    user: pguser
    password: pgpass

s3:
    are_local_buckets: true
    b2-eu-cen:
        key: test
        secret: testtest
        endpoint: https://eminio.example.com:1543
        region: eu-central-2
        bucket: b2-eu-cen
    wasabi-eu-central-2-v3:
        key: test
        secret: testtest
        endpoint: https://eminio.example.com:1543
        region: eu-central-2
        bucket: wasabi-eu-central-2-v3
        compliance: false
    scw-eu-fr-v3:
        key: test
        secret: testtest
        endpoint: https://eminio.example.com:1543
        region: eu-central-2
        bucket: scw-eu-fr-v3

minio-provision.sh

#!/bin/sh

# Script used to prepare the minio instance that runs as part of the development
# Docker compose cluster.

while ! mc config host add h0 http://minio:3200 test testtest
do
   echo "waiting for minio..."
   sleep 0.5
done

cd /data

mc mb -p b2-eu-cen
mc mb -p wasabi-eu-central-2-v3
mc mb -p scw-eu-fr-v3

museum.yaml

apps:
  public-albums: https://ealbum.example.com:1543

webauth:
  rpid: eaccounts.example.com:1543
  rporigins:
    - "https://eaccounts.example.com:1543"

SMTP PART REDACTED

internal:
    admins:
        - adminID

Dockerfile for ente-web

FROM node:20-bookworm-slim AS builder

WORKDIR ./ente

COPY . .
COPY apps/ .

# Will help default to yarn versoin 1.22.22
RUN corepack enable

# Configure Albums and Accounts Endpoints
ENV NEXT_PUBLIC_ENTE_ALBUMS_ENDPOINT=https://ealbums.example.com:1543
ENV NEXT_PUBLIC_ENTE_ACCOUNTS_ENDPOINT=https://eaccounts.example.com:1543

RUN yarn cache clean
RUN yarn install --network-timeout 1000000000
RUN yarn build:photos && yarn build:auth && yarn build:accounts && yarn build:cast

FROM node:20-bookworm-slim

WORKDIR /app

COPY --from=builder /ente/apps/photos/out /app/photos
COPY --from=builder /ente/apps/accounts/out /app/accounts
COPY --from=builder /ente/apps/auth/out /app/auth
COPY --from=builder /ente/apps/cast/out /app/cast

RUN npm install -g serve

ENV PHOTOS=3000
EXPOSE ${PHOTOS}

ENV ACCOUNTS=3001
EXPOSE ${ACCOUNTS}

ENV AUTHPORT=3002
EXPOSE ${AUTHPORT}

ENV CAST=3003
EXPOSE ${CAST}

# The albums app does not have navigable pages on it, but the 
# port will be exposed in-order to self up the albums endpoint 
# `apps.public-albums` in museum.yaml configuration file.
ENV ALBUMS=3004
EXPOSE ${ALBUMS}

CMD ["sh", "-c", "serve /app/photos -l tcp://0.0.0.0:${PHOTOS} & serve /app/accounts -l tcp://0.0.0.0:${ACCOUNTS} & serve /app/auth -l tcp://0.0.0.0:${AUTHPORT} & serve /app/cast -l tcp://0.0.0.0:${CAST}"]

Command used to build the ente-web container:

sudo docker build -t ente-web:20241223 --no-cache --progress plain .

Nginx setup:
SSL from Let Encrypt is forced for all addresses. Cache assets and block common exploits enabled.

eaccounts.example.com:1543 -> http://192.168.100.13:3001
ealbum.example.com:1543 -> http://192.168.100.13:3000
eap.example.com:1543 -> http://192.168.100.13:8080
eauth.example.com:1543 -> http://192.168.100.13:3002
ecast.example.com:1543 -> http://192.168.100.13:3003
eminio.example.com:1543 -> http://192.168.100.13:3200
ente.example.com:1543 -> http://192.168.100.13:3001
eph.example.com:1543 -> http://192.168.100.13:3000

In the future, I would like to decrease the number of open ports/proxied addresses, but I am currently testing the Ente. Once the setup is done correctly, I would like to limit them only to Photos, Auth, album-sharing web apps, Cast I am playing with if it is needed for me.

[mngshm]

if you setup admin endpoint then for museum and web app the passkeys will redirect to the desired endpoint which you specify. but as of now for the mobile app and desktop app passkeys are hardcoded and they'll end up routing you to accounts.ente.io by default.

[kabatp]

I set up these in compose for web apps:

    environment:
      - NEXT_PUBLIC_ENTE_ENDPOINT=https://api.example.com
      - NEXT_PUBLIC_ENTE_ALBUMS_ENDPOINT=https://albums.example.com
      - NEXT_PUBLIC_ENTE_ACCOUNTS_ENDPOINT=https://accounts.example.com

These are in Docker file for webapps

ENV NEXT_PUBLIC_ENTE_ENDPOINT=https://api.example.com
ENV NEXT_PUBLIC_ENTE_ALBUMS_ENDPOINT=https://albums.example.com
ENV NEXT_PUBLIC_ENTE_ACCOUNTS_ENDPOINT=https://accounts.example.com

Also these in the museum.yaml

apps:
    accounts: https://accounts.example.com

# Passkey support (optional)
# Use case: MFA
webauth:
  rpid: accounts.example.com
  rporigins:
    - "https://accounts.example.com"

but the web app will still point to the accounts.ente.io page.

I am not sure if I am missing some more setup, tried to check local.yaml settings for server on Github but there is nothing more about passkey and/or accounts.

[mngshm]

The albums endpoint is wrong, its NEXT_PUBLIC_ENTE_ALBUMS_URL. Is this somewhere in the documents ? If so, please point me towards it and i'll fix it.

Check .env file inside web/apps/photos for details docs.

[kabatp]

The album endpoint for web apps is mentioned there: https://help.ente.io/self-hosting/guides/web-app If you mean in compose, I just kinda went with it. I will check the .env, thank you! BTW the albums sharing functionality is working correctly with this setup - I used the same way as mentioned above with only one port open - for Photos apps and everything I tested so far is working flawlessly.

[kabatp]

@mngshm hey so the change of ENV for accounts helped - changed in both compose and Dockerfile and works great now. Regarding the ALBUM variable, the NEXT_PUBLIC_ENTE_ALBUMS_URL is not existing in https://github.com/ente-io/ente/blob/main/web/apps/photos/.env but NEXT_PUBLIC_ENTE_ALBUMS_ENDPOINT does exist.