Few questions related to selfhosting

[EdyTheCow]

Hello,

I've been tinkering and writing a detailed documentation on how to self-host Ente server using Traefik as a reverse proxy. So far I have successfully deployed Ente server using docker container and deployed Ente photos web on Cloudflare pages. However, I wanted to get some more info on a few things.

1. I chose the route of only using variables in .env to configure everything docker compose and Ente server related since you are able to override all of the configuration entries. I am wondering how would you override this particular setting? (https://github.com/ente-io/ente/blob/main/server/configurations/local.yaml#L102) since "hot_storage" already has underscore, would this still work "ENTE_S3_HOT_STORAGE_PRIMARY"?

2. What does "ENVIRONMENT=production" actually do? Does it only select production.yml configuration or is there more to it?

3. Since I am running Ente server under Traefik reverse proxy, would there be any issues running Ente server on 8080? The outside world sees Ente server running on 443 using proper certificates. Wondering if there's any internal limitations or checks that would cause any issues if use-tls is set to false in the configuration?

4. What do I set as region when using Backblaze B2? Is there a particular format or do I leave that empty?

[mnvr]

So far I have successfully deployed Ente server using docker container and deployed Ente photos web on Cloudflare pages.

Nice!

1. since "hot_storage" already has underscore, would this still work "ENTE_S3_HOT_STORAGE_PRIMARY"?

Yes

2. "ENVIRONMENT=production" ... Does it only select production.yml configuration or is there more to it?

Right, it essentially selects configurations/{ENVIRONMENT}.yaml, in this case production.yaml. However, it also means that the configuration is no longer "local", and in various places in the code we have some special cases that get disabled when we're running in a non-local configuration. You can search for the string "local" and the IsLocalEnvironment function in the code to see the exact changes this would cause.

Note that it's not specific to the string "production". The string "production" itself is arbitrary, and only specifies the name of the YAML file under configurations/ to load. The side effects are there only because it is any string that is not exactly "local" (if environment is not defined, then too it is taken to be "local").

3. would there be any issues running Ente server on 8080?

No. The server doesn't care which port it runs on, it should run fine on 8080 (or any arbitrary port too). You'll just need to make sure that you ask it to use the port you want, and it'll be happy to listen there.

4. What do I set as region when using Backblaze B2? Is there a particular format or do I leave that empty?

From what I remember, the region should be the same as the region in the S3-compat endpoint provided by B2, but maybe B2 doesn't care as long as the endpoint is correct. Backblaze's docs might have more up to date info.

[EdyTheCow]

Thank you for all the answers @mnvr !

Since I am not really able to find any specific information about B2's regions usage, I am guessing I am just supposed to use the region provided in the endpoint itself? For example: us-east-005 as region?

When I set ENVIRONMENT=production, museum seems to fail as soon as I start it.

Error from Docker container

museum-1    | panic: dial tcp 192.168.0.2:0: connect: connection refused
museum-1    |
museum-1    | goroutine 1 [running]:
museum-1    | main.setupDatabase()
museum-1    |   /etc/ente/cmd/museum/main.go:763 +0x36c
museum-1    | main.main()
museum-1    |   /etc/ente/cmd/museum/main.go:111 +0x3b2
museum-1 exited with code 2

Logs from museum.log

{"file":"main.go:91","func":"main","level":"info","msg":"Booting up production server with commit #7be2c66fb69517eb1a2f67b0d94cc72817687df9","time":"2024-04-20T17:28:04Z"}
{"file":"main.go:753","func":"setupDatabase","level":"info","msg":"Setting up db","time":"2024-04-20T17:28:04Z"}
{"file":"main.go:760","func":"setupDatabase","level":"info","msg":"Connected to DB","time":"2024-04-20T17:28:04Z"}

Any clue as to why it is failing to start? It starts without any issues when it's set to local. I've also tried to delete database and let it generate from scratch since it mentions setupDatabase, but exact same result.

[EdyTheCow]

Apologies for so many replies. So I went down the rabbit hole of trying to get it working using ENVIRONMENT=production. I fixed issues with database (earlier errors). But then it had a list of requirements:

• Needed to provide rporigins for webauthn
• Had to create a few JSON files (black-friday.json, in.json, us.json and pst-service-account.json)

So I did all of that, but the latest error is complaining about invalid JWT for pst-service-account.json

{"file":"playstore.go:47","func":"NewPlayStoreController","level":"fatal","msg":" --- at /etc/ente/pkg/controller/playstore.go:80 (newPlayStoreClient) ---\nCaused by: google: read JWT from JSON credentials: 'type' field is \"\" (expected \"service_account\")","time":"2024-04-20T18:32:14Z"}

So at this point I am wondering if I can run this in ENVIRONMENT=local and consider it a "production" environment or would I be exposed to any security related threats?

[mnvr]

That's fine. There aren't any security related threats per se as long as you use TLS everywhere.

• Since you're anyways terminating TLS on Traefik, that end is sorted.

• So if you use the local configuration, you can specify additional configuration overrides to enable TLS to your DB (Using db.sslmode). Also double check that you're not disabling TLS for the S3 connections (TLS is on by default for s3 connections, but it is disabled in the starter docker compose file using this, so just double check)

[EdyTheCow]

Thank you for responding to all of my questions! I'll make sure to share my own guide / documentation for running Ente using Traefik once I have everything fully working.

[wjbeckett]

@EdyTheCow Would be cool to see your writeup on this especially the CF Pages deployment for the Web App.

[EdyTheCow]

@wjbeckett I just pushed my documentation to https://github.com/EdyTheCow/ente-selfhost keep in mind this is still very much work in progress. However, Ente photos deployment to Cloudflare pages section is finished which replicates Ente's production deployment.

[WladyX]

Not sure if this is the right place to ask :) But I have yet to find it it is possible/how we can disable self registration on a self-hosted instance.
Thank you!

[mnvr]

It is not possible out of the box. But you can just comment out the relevant endpoints in main.go and deploy (after you've created your account) so that no-one can create theirs.

[WladyX]

Blocking the endpoints from the reverse proxy or just do not setup mail so they do not get OTP would also work I guess.
Thank you @mnvr !