cce1d876c3
The compose file was using PHOTOPRISM_OIDC_ISSUER_URL / _CLIENT_ID / _CLIENT_SECRET / _PROVIDER_NAME / _REDIRECT_URI, but PhotoPrism's CLI flags are --oidc-uri / --oidc-client / --oidc-secret / --oidc-provider — so the env vars it parses are PHOTOPRISM_OIDC_URI / _CLIENT / _SECRET / _PROVIDER. With the old names PhotoPrism silently ignored them, OIDC stayed dormant, and `photoprism show config` reported blank oidc-uri / oidc-client even though everything else looked configured. Confirmed on the M0 LXC: renaming the env vars makes the Authentik "Sign in" button appear on /library/login, /api/v1/oidc/login emits a proper 302 to the IdP authorize endpoint, and the callback creates the OIDC user + session in the DB. The user-facing `.env.photoprism` keys are unchanged (OIDC_PROVIDER_NAME, OIDC_ISSUER_URL, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET); the compose file just maps them to the correct PHOTOPRISM_* targets. OIDC_REDIRECT_URI is removed because PhotoPrism derives the redirect from PHOTOPRISM_SITE_URL.
74 lines
3.2 KiB
Plaintext
74 lines
3.2 KiB
Plaintext
# PhotoPrism stack — example environment file.
|
||
#
|
||
# Copy to `.env.photoprism` and adjust. The compose file is invoked with
|
||
# `--env-file .env.photoprism` so this never collides with the legacy
|
||
# `.env` used by the mule-image stack.
|
||
#
|
||
# docker compose --env-file .env.photoprism -f docker-compose.photoprism.yml up -d
|
||
|
||
|
||
# ── REQUIRED ─────────────────────────────────────────────────────────────────
|
||
|
||
# Host path to your photo library. PhotoPrism reads this in place and
|
||
# (post-M2) writes EXIF backwrites next to originals. Same path the legacy
|
||
# mule-image backend used.
|
||
PHOTO_DIRS=/mnt/library/homecloud/admin/files/
|
||
|
||
# Bootstrap admin password. The first PhotoPrism boot creates an `admin`
|
||
# account with this password. Rotate after first login from the UI.
|
||
PP_ADMIN_PASSWORD=please-change-me
|
||
|
||
# MariaDB passwords. Generate with `openssl rand -hex 24`.
|
||
PP_DB_PASSWORD=please-change-me
|
||
PP_DB_ROOT_PASSWORD=please-change-me
|
||
|
||
|
||
# ── OPTIONAL ─────────────────────────────────────────────────────────────────
|
||
|
||
# Host port for direct PhotoPrism UI access during M0–M3. Moves behind a
|
||
# Caddy reverse proxy at M4; keep this open through then for debugging.
|
||
PP_PORT=2342
|
||
|
||
# Site URL — used for share links, OIDC redirect URI, and reverse-proxy aware
|
||
# URL generation. Set to the public hostname once the proxy is in front.
|
||
PP_SITE_URL=http://localhost:2342/
|
||
|
||
# Auth mode — "password" for username/password (default), "public" for an
|
||
# unauthenticated kiosk mode (don't use this on a multi-user library).
|
||
PP_AUTH_MODE=password
|
||
|
||
# Library mount mode. M0 = "ro" (safe initial validation). Flip to "rw" at M2
|
||
# when the right-sidebar enables EXIF backwrite. Set in lockstep with
|
||
# PP_READONLY below.
|
||
PP_ORIGINALS_MODE=ro
|
||
PP_READONLY=true
|
||
|
||
# UID/GID inside the PhotoPrism container. Set these to the host UID/GID that
|
||
# owns ${PHOTO_DIRS}. `id -u` and `id -g`.
|
||
PP_UID=1000
|
||
PP_GID=1000
|
||
|
||
|
||
# ── OIDC SSO (Authentik or equivalent) ───────────────────────────────────────
|
||
# Leave blank to keep OIDC dormant. Fill in to enable the "Sign in with OIDC"
|
||
# button on the login page; OIDC_REGISTER=true auto-creates accounts at role
|
||
# `user` (override to `admin` to grant full access on first SSO login).
|
||
#
|
||
# The compose file reads these and maps them to PhotoPrism's actual env-var
|
||
# names (PHOTOPRISM_OIDC_URI / _CLIENT / _SECRET / _PROVIDER) — see the
|
||
# comment in docker-compose.photoprism.yml. The PhotoPrism callback URI is
|
||
# auto-derived from PP_SITE_URL; do not set it manually.
|
||
|
||
# OIDC_PROVIDER_NAME=Authentik
|
||
# OIDC_ISSUER_URL=https://auth.example.com/application/o/photoprism/
|
||
# OIDC_CLIENT_ID=...
|
||
# OIDC_CLIENT_SECRET=...
|
||
# OIDC_SCOPES=openid profile email
|
||
# OIDC_REGISTER=true
|
||
# OIDC_ROLE=user
|
||
|
||
|
||
# ── LOGGING ──────────────────────────────────────────────────────────────────
|
||
|
||
PP_LOG_LEVEL=info
|