If I specify https:// as the protocol in the site URL config option and don't have a valid certificate installed, I expect a default certificate to be available so that HTTPS can always be enabled.
In order for this to work and not to break existing installations that use an external HTTPS reverse proxy, the environment variable PHOTOPRISM_DEFAULT_TLS needs to be set to true. PhotoPrism will then default to a self-signed certificate if the site URL starts with https:// and no other certificate is available.
The default certificate has the filename /etc/ssl/certs/photoprism.cert and the corresponding private key is /etc/ssl/private/photoprism.key. These files are automatically created when the Docker container starts for the first time and PHOTOPRISM_INIT includes "https" or the PHOTOPRISM_DEFAULT_TLS variable is set to "true".
Note that these default filenames cannot be configured at the moment. However, you can specify custom filenames with PHOTOPRISM_TLS_CERT and PHOTOPRISM_TLS_KEY. Since PHOTOPRISM_DEFAULT_TLS defaults to "false", I currently don't see a need to let users configure the default filenames as well.
If I specify
https://as the protocol in the site URL config option and don't have a valid certificate installed, I expect a default certificate to be available so that HTTPS can always be enabled.In order for this to work and not to break existing installations that use an external HTTPS reverse proxy, the environment variable
PHOTOPRISM_DEFAULT_TLSneeds to be set totrue. PhotoPrism will then default to a self-signed certificate if the site URL starts withhttps://and no other certificate is available.The default certificate has the filename
/etc/ssl/certs/photoprism.certand the corresponding private key is/etc/ssl/private/photoprism.key. These files are automatically created when the Docker container starts for the first time andPHOTOPRISM_INITincludes "https" or thePHOTOPRISM_DEFAULT_TLSvariable is set to "true".Note that these default filenames cannot be configured at the moment. However, you can specify custom filenames with
PHOTOPRISM_TLS_CERTandPHOTOPRISM_TLS_KEY. SincePHOTOPRISM_DEFAULT_TLSdefaults to "false", I currently don't see a need to let users configure the default filenames as well.