# PhotoPrism stack — example environment file.
#
# Copy to `.env.photoprism` and adjust. The compose file is invoked with
# `--env-file .env.photoprism` so this never collides with the legacy
# `.env` used by the mule-image stack.
#
#   docker compose --env-file .env.photoprism -f docker-compose.photoprism.yml up -d


# ── REQUIRED ─────────────────────────────────────────────────────────────────

# Host path to your photo library. PhotoPrism reads this in place and
# (post-M2) writes EXIF backwrites next to originals. Same path the legacy
# mule-image backend used.
PHOTO_DIRS=/mnt/library/homecloud/admin/files/

# Bootstrap admin password. The first PhotoPrism boot creates an `admin`
# account with this password. Rotate after first login from the UI.
PP_ADMIN_PASSWORD=please-change-me

# MariaDB passwords. Generate with `openssl rand -hex 24`.
PP_DB_PASSWORD=please-change-me
PP_DB_ROOT_PASSWORD=please-change-me


# ── OPTIONAL ─────────────────────────────────────────────────────────────────

# Host port for direct PhotoPrism UI access during M0–M3. Moves behind a
# Caddy reverse proxy at M4; keep this open through then for debugging.
PP_PORT=2342

# Site URL — used for share links, OIDC redirect URI, and reverse-proxy aware
# URL generation. Set to the public hostname once the proxy is in front.
PP_SITE_URL=http://localhost:2342/

# Auth mode — "password" for username/password (default), "public" for an
# unauthenticated kiosk mode (don't use this on a multi-user library).
PP_AUTH_MODE=password

# Library mount mode. M0 = "ro" (safe initial validation). Flip to "rw" at M2
# when the right-sidebar enables EXIF backwrite. Set in lockstep with
# PP_READONLY below.
PP_ORIGINALS_MODE=ro
PP_READONLY=true

# UID/GID inside the PhotoPrism container. Set these to the host UID/GID that
# owns ${PHOTO_DIRS}. `id -u` and `id -g`.
PP_UID=1000
PP_GID=1000


# ── OIDC SSO (Authentik or equivalent) ───────────────────────────────────────
# Leave blank to keep OIDC dormant. Fill in to enable the "Sign in with OIDC"
# button on the login page; per plan, OIDC_REGISTER=true auto-creates
# accounts at role `user`.

# OIDC_PROVIDER_NAME=Authentik
# OIDC_ISSUER_URL=https://auth.example.com/application/o/photoprism/
# OIDC_CLIENT_ID=...
# OIDC_CLIENT_SECRET=...
# OIDC_REDIRECT_URI=http://localhost:2342/api/v1/oidc/redirect
# OIDC_SCOPES=openid profile email
# OIDC_REGISTER=true
# OIDC_ROLE=user


# ── LOGGING ──────────────────────────────────────────────────────────────────

PP_LOG_LEVEL=info