Config: Add options to set Unix socket mode, gid

[ledlamp]

#2337 #3595 2bf5008 c82a4b2

There should be config options to set the mode and gid of the socket file when listening on unix socket.

The default mode is 775, so it would be useful to configure this to 777 so that anything can connect to it (equivalent to TCP/IP). Maybe this should be the default mode.

Or it would be useful to set the socket gid to the web server (reverse proxy) gid to allow the web server to connect without giving it access to photoprism files.

My Photos folder is mode 750 so Photoprism has read-only access via group. If I add web server to photoprism group then it will be able to access all my private photos. So I need to set socket gid to web server gid.

Without these options I cannot use unix socket without manually changing the mode or gid after photoprism starts. The default mode is 775, the photoprism server and web server are in different users/groups, and the web server doesn't run as root, so the web server can't connect.

[ledlamp]

This is more like a bug report because the unix socket feature cannot be used without this unless you are running photoprism with the same uid or gid as the reverse proxy or the reverse proxy is running as root, neither of which should be the case.

[lastzero]

Have you tested that the config options we provide for this, in particular umask, don't work? If so, how did you test it?

https://docs.photoprism.app/getting-started/config-options/#docker-image

Please also let us know why using a regular TCP port won't work for your use case. Thank you!

[ledlamp]

If PHOTOPRISM_UMASK is set to 0000 then unix socket will (presumably) be 777 but all files created by photoprism will also be 666, I don't want that.

Like I said I can't set PHOTOPRISM_GID to web server group because then web server can read all my private photos. PHOTOPRISM_UID and PHOTOPRISM_GID are set to match photoprism's own user and group on host.

I disable networking in photoprism containers for security and less complication with networking setup so only unix socket works. I like to use unix socket because it is more efficient and easier to secure. I have a lot of containers and stuff that need to be isolated.

[lastzero]

@ledlamp These changes are can be tested with our preview build and allow you to force the re-creation of existing Unix domain sockets and to set permissions for sockets after they have been created:

• https://docs.photoprism.app/release-notes/#development-preview
• https://docs.photoprism.app/getting-started/updates/#development-preview

For this, the command flag - or PHOTOPRISM_HTTP_HOST env variable - value must be formatted as follows:

--http-host="unix:/var/run/photoprism.sock?force=true&mode=660"

Happy testing! 🌈

[ledlamp]

I will have to rethink my main setup to test this. I have docker using userns-remap, and then I'm running photoprism with userns_mode: "host", so all the image uid/gid are wrong. Despite that, it worked fine with the last release, but now it doesn't.

It's not something you need to support, but maybe it is interesting to know.

[lastzero]

Yeah, that doesn't seem like a standard configuration. Where does the user ID 165536 come from? 🤔

The simple bash entrypoint script we had before was probably pretty permissive, so I wouldn't be entirely surprised if e.g. UID/GID cheats that might have worked before don't work anymore. It's also not something that regular (home) users are likely to run into if they follow our documentation...

[ledlamp]

165536 is the base id of dockremap in my /etc/sub{uid,gid}.

forget this part where I thought docker restart policy was disabled and wondered why it was restarting

BTW. I just realized. Option to set gid is not needed, you can use setgid bit on parent directory! (chmod g+s)

Pretty cool

[lastzero]

Before I made these changes, the server would not automatically shut down if it couldn't open the port/socket. This is the main reason why it didn't restart. The restarts now could be caused by a glitch in the new "cmd.sh" bash script, our Dockerfile, the s6-overlay, or the docker / podman configuration. Please let me know when you figured it out (and ideally know how to fix it)! 🙏