# Podman-rootless overlay for the PhotoPrism stack.
#
# Apply alongside the base compose file:
#   podman-compose --env-file .env \
#     -f docker-compose.yml \
#     -f docker-compose.podman.yml \
#     up -d
#
# Adds the podman-specific bits that would break a vanilla docker compose run:
#   - userns_mode: keep-id maps container UID to the invoking host UID, so
#     PhotoPrism (running as PP_UID:PP_GID inside) can actually read the
#     bind-mounted originals volume on the host (which is owned by the host
#     user, not by uid 1000-in-the-container-namespace).
#   - the explicit security_opt entries on the base file work in podman as-is.

services:
  # MariaDB writes to a named volume managed by podman; its in-container
  # `mysql` user expects to own that volume. keep-id breaks this by mapping
  # in-container UID 999 to a podman-subuid that doesn't own the volume,
  # so let mariadb use the default userns mapping (root-in-namespace).
  mariadb:
    # No userns_mode override — use podman defaults.
    init: true

  # PhotoPrism does need keep-id, so its container UID maps back to the
  # host UID that owns the bind-mounted originals/.
  photoprism:
    userns_mode: keep-id

  # Sidecar mutates the originals tree (rename / folder ops / heap
  # convert / .duplicates archive) — same keep-id mapping so its writes
  # land as the host user, not as a podman-subuid the host doesn't own.
  sidecar:
    userns_mode: keep-id