# Example environment file. Copy to `.env` and adjust.
#
#   podman-compose --env-file .env \
#     -f docker-compose.yml -f docker-compose.podman.yml up -d


# ── REQUIRED ─────────────────────────────────────────────────────────────────

# Host path to your photo library. PhotoPrism reads this in place and
# writes EXIF backwrites next to originals (when PP_ORIGINALS_MODE=rw).
PHOTO_DIRS=/mnt/library/homecloud/admin/files/

# Bootstrap admin password. The first PhotoPrism boot creates an `admin`
# account with this password. Rotate after first login from the UI.
PP_ADMIN_PASSWORD=please-change-me

# MariaDB passwords. Generate with `openssl rand -hex 24`.
PP_DB_PASSWORD=please-change-me
PP_DB_ROOT_PASSWORD=please-change-me


# ── OPTIONAL ─────────────────────────────────────────────────────────────────

# Loopback host port for PhotoPrism's API (and UI, if you tunnel to it).
# Vite proxies /api/v1/* here and the host-mode sidecar reaches it on
# localhost. Not published on the public interface.
PP_PORT=2342

# Site URL — used for share links, OIDC redirect URI, and reverse-proxy aware
# URL generation. Set to the public hostname once the proxy is in front.
PP_SITE_URL=http://localhost:2342/

# Auth mode — "password" for username/password (default), "public" for an
# unauthenticated kiosk mode (don't use this on a multi-user library).
PP_AUTH_MODE=password

# Library mount mode. "rw" allows rename / folder mutations / EXIF backwrite;
# "ro" is safe-for-archives but disables those sidecar endpoints. Set in
# lockstep with PP_READONLY below.
PP_ORIGINALS_MODE=rw
PP_READONLY=false

# UID/GID inside the PhotoPrism container. Set these to the host UID/GID that
# owns ${PHOTO_DIRS}. `id -u` and `id -g`.
PP_UID=1000
PP_GID=1000


# ── OIDC SSO (Authentik or equivalent) ───────────────────────────────────────
# Leave blank to keep OIDC dormant. Fill in to enable the "Sign in with OIDC"
# button on the login page; OIDC_REGISTER=true auto-creates accounts at role
# `user` (override to `admin` to grant full access on first SSO login).
#
# The compose file reads these and maps them to PhotoPrism's actual env-var
# names (PHOTOPRISM_OIDC_URI / _CLIENT / _SECRET / _PROVIDER) — see the
# comment in docker-compose.yml. The PhotoPrism callback URI is auto-derived
# from PP_SITE_URL; do not set it manually.

# OIDC_PROVIDER_NAME=Authentik
# OIDC_ISSUER_URL=https://auth.example.com/application/o/photoprism/
# OIDC_CLIENT_ID=...
# OIDC_CLIENT_SECRET=...
# OIDC_SCOPES=openid profile email
# OIDC_REGISTER=true
# OIDC_ROLE=user


# ── USER LIBRARY ISOLATION ───────────────────────────────────────────────────
# Maps PhotoPrism usernames to originals-relative subdirectories so each
# user only sees their own photos. Format: comma-separated user:path pairs.
# The sidecar reconciler applies this to auth_users.base_path on boot and
# every 60s. Leave empty for single-user deployments.
#
# USER_BASEPATHS="alice:alice, bob:bob"

# Sidecar DB password — provisioned by mariadb/init/01-sidecar.sql on first
# boot. Rotate before any non-local deployment.
# SIDECAR_DB_PASSWORD=replace-at-m4-bringup


# ── LOGGING ──────────────────────────────────────────────────────────────────

PP_LOG_LEVEL=info