Config: Add support for listening on Unix sockets

[tushev]

Hello,

PhotoPrism currently supports only HTTP port communication.

It would be nice to have UNIX socket support as well, because sockets:

1. eliminate latency from network stack => faster
2. are subject to file system permissions => better access control
3. will never lead to problems such as docker+ufw port exposure flaw

I've created a makeshift implementation of this using custom Dockerfile and socat.

While I'm currently happy with it, it would be nice to have this implemented natively, without the need of custom Dockerfiles.
Something like:

PHOTOPRISM_HTTP_MODE: 'socket'
PHOTOPRISM_HTTP_SOCKET_PATH: '/var/run/photoprism/photoprism.sock'

Finally, /var/run/photoprism should be made available on the host (or another container) via bind mount (or volume).

Unfortunately, I'm not familiar with Go so I cannot implement this myself and create a pull request.

---

Below are details of my implementation. I've modified docker-compose.yaml to use a custom Dockerfile. I also added env variables.

The implementation is based on socat, which creates a connection between socket file inside container and PhotoPrism on port 2342 (inside container as well). Then the directory with the socket file is being exposed outside as Docker bind mount.

Finally, I've pointed my nginx reverse proxy to newly created socket file with
proxy_pass http://unix:/home/photoprism/.socket/photoprism.sock
instead of proxy_pass http://127.0.0.1:2342.

This solves (2) and (3). However, there's still some network stack communication inside container - between socat and PhotoPrism.
(1) can be solved only by implementing HTTP UNIX socket listener natively in Go.

docker-compose.yaml:

services:
  photoprism:
    build:
      context: ./images
      dockerfile: Dockerfile-photoprism-socket
      args:
        SOCKET_UID:   '${SOCKET_UID}'
        SOCKET_GID:   '${SOCKET_GID}'
    ...
    environment:
      ...
      SOCKET_UID:   '${SOCKET_UID}'
      SOCKET_GID:   '${SOCKET_GID}'   
      SOCKET_MODE:  '${SOCKET_MODE}'
    volumes:
      ...
      - ${PUBLIC_SOCKETDIR}:/var/run/photoprism-socket
      - dbsocket:/var/run/mysqld/

images/Dockerfile-photoprism-socket

FROM photoprism/photoprism:latest
# Install prerequestives
RUN apt-get update && \
	apt-get install -y socat	
# Add socket user & group from host system to container (if they does not exist)
ARG SOCKET_UID  
ARG SOCKET_GID
RUN (getent group  $SOCKET_GID || addgroup --gid $SOCKET_GID --system www-socket ) && \
	(getent passwd $SOCKET_UID || adduser  --uid $SOCKET_UID --system --disabled-login --disabled-password --gid $SOCKET_GID www-socket )
# Custom entrypoint that enables socat
COPY photoprism-socket-entrypoint /usr/local/bin/
ENTRYPOINT ["photoprism-socket-entrypoint"]
CMD ["/opt/photoprism/bin/photoprism", "start"]

images/photoprism-socket-entrypoint

#!/bin/sh
set -e
# echo Starting socat...
socat UNIX-LISTEN:/var/run/photoprism-socket/photoprism.sock,mode=$SOCKET_MODE,user=$SOCKET_UID,group=$SOCKET_GID,fork,su=$SOCKET_UID,reuseaddr,unlink-early TCP:127.0.0.1:2342 &
# echo Starting PhotoPrism...
set -- /scripts/entrypoint.sh "$@"
exec "$@"

.env

SOCKET_UID		 = 33
SOCKET_GID		 = 33
SOCKET_MODE		 = 600
PUBLIC_SOCKETDIR = ../.socket

nginx.vhost.conf:

server {
	server_name	photoprism.home.arpa;
	listen      	443 ssl http2;	
	access_log off;	
	error_log  /var/log/nginx/photo.error.nginx.log;		
    	client_max_body_size 4G;	
	
	location / {
        	proxy_set_header X-Forwarded-Proto $scheme;
        	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        	proxy_set_header Host $host;
		
        	proxy_pass http://unix:/home/photoprism/.socket/photoprism.sock;

		proxy_buffering off;
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection "upgrade";
	}
}