How to run the app on Ubuntu server 20.04

[edison23]

This question is basically an ask to supplement the documentation of PhotoView which is very brief, let's say. I have no experience with Docker apps so that's probably the reason I'm lost.

My problem: I installed docker.io and docker-compose and went thru the Getting started - Setup with Docker in the Readme. No errors encountered but when I finished and navigated to the directory whither I placed PhotoView, I got only the default Apache directory listing. It doesn't seem to be a problem of permissions as Apache never gave me the usual 403 error it throws in these situations.

Could you please help me figure out what I'm missing? Thank you.

I'm running Ubuntu server 20.04 on 64bit machine:
Linux aperture 5.4.0-51-generic #56-Ubuntu SMP Mon Oct 5 14:28:49 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

Here are commands that got me to the aforementioned state:

1. $ sudo apt install docker.io to install docker
2. $ sudo systemctl enable --now docker.service to enable docker service and start it
3. $ sudo usermod -aG docker edison23 to add myself to the docker group (I logged out and back in after that)
4. $ docker run hello-world to try if docker works, everything seems fine
5. $ sudo apt install docker-compose to install docker-compose
6. $ git clone of this repo into a directory under root of my website
7. copied docker-compose.example.yml to docker-compose.yml and updated it to match DB, user and psw I created in MySQL, and the path I placed PhotoView to (directory pv right under root of my domain) which is directory exampleorg in this slightly file below).
8. $ docker-compose up -d to start PhotoView. Everything seemed fine, no error occured. But when I navigate to https://example.org/pv, all I see is directory listing of the directory.

And here's my docker-compose.yml (stripped of sensitive info like passwords, Mapbox token, or domain, of course):

version: "3"

services:
  db:
    image: mariadb:10.5
    restart: always
    environment:
      - MYSQL_DATABASE=photoview
      - MYSQL_USER=USER-FOR-PHOTOVIEW
      - MYSQL_PASSWORD=PSW-FOR-THE-USER
      - MYSQL_RANDOM_ROOT_PASSWORD=1
    volumes:
      - db_data:/var/lib/mysql

  photoview:
    image: viktorstrate/photoview:1
    restart: always
    ports:
      - "8000:80"
    depends_on:
      - db

    environment:
      - MYSQL_URL=photoview:photo-secret@tcp(db)/photoview
      - API_LISTEN_IP=photoview
      - API_LISTEN_PORT=80
      - PHOTO_CACHE=/app/cache

      # Change This: The publicly exposed url
      # For example if the server is available from the domain example.com,
      # change this value to http://example.com/
      - PUBLIC_ENDPOINT=https://example.org/pv/

      # Optional: To enable map related features, you need to create a mapbox token.
      # A token can be generated for free here https://account.mapbox.com/access-tokens/
      # It's a good idea to limit the scope of the token to your own domain, to prevent others from using it.
      - MAPBOX_TOKEN=loremipsumdolorsitamet

    volumes:
      - api_cache:/app/cache

      # Change this to the directory where your photos are located on your server.
      # If the photos are located at `/home/user/photos`, then change this value
      # to the following: `/home/user/photos:/photos:ro`.
      # You can mount multiple paths, if your photos are spread across multiple directories.
      #- ./photos_path:/photos:ro
      - /mydrive/www/exampleorg/mobilephotos:/mobilephotos:ro

volumes:
  db_data:
  api_cache:

Thanks for your help

[viktorstrate]

Hi @edison23
Thank you for your interest in the project, and the detailed explaination.

Photoview doesn't use Apache at all, so you probably hit another server.

Your configuration looks ok, it should be accessible from localhost:8000.
I see that you use your own domain, and wan't to access Photoview from /pv, can you explain how you have configured that? You would have to use a reverse proxy to do so, maybe Apache is used for that, if so could you post your configuration for that?

[edison23]

Hi @viktorstrate ,
thanks for your reply. Yes, I am very interested in Photoview as a replacement for Google Photos that are going to start counting all images towards Google Drive quota.

My setup: I have a computer behind a router with port forwarding set up, that router has static IP and that computer behind it is my server (and the whole setup is pretty far away from me, physically).

My goal: have Photoview accessible either

• via https://example.org/somepath or
• via https://example.org:48165
  where example.org is my domain and that number is some random port I choose).

Thru today, I wrote here a long post explaining all the stuff I've tried to achieve either of the above (and that failed to produce a functioning setup). Then I thought, hey, stupid, what about this totally obvious setup:

• port forwarding set on the router the server is behind (set to 4242->4242, I like the number)
• the docker-compose.yml left at defaults except for domain, ports, and path to photo folders:

  photoview:
    image: viktorstrate/photoview:1
    restart: always
    ports:
      - "4242:80"
    depends_on:
      - db
...
      - PUBLIC_ENDPOINT=http://example.org:4242/
...
      - /mydrive/www/exampleorg/mobilephotos:/mobilephotos:ro

Then I run the docker-compose up -d, go to the address http://example.org:4242. Aaaand it works as expected! (It's awesome, as far as I can tell now :) )
So my thanks to you for telling me the setup is good which led me to trying it out on local which then led me to correct setup.

My main question now is: would you happen to have some tutorial on how to set this up with HTTPS? Because I kinda don't feel like exposing all of my photos to my ISPs and whoever else with HTTP and I have no idea how to set SSL up with docker (I have it enforced with Apache but that doesn't apply to Docker, obviously).

My second (much less important) question is: how important is to change the MariaDB credentials in the docker-compose.yml? Where is it used and where are the data stored? (I didn't have to actually set up any DB myself, the app did everything on its own, which is nice, but I have no idea where is the data stored (and what data are actually stored).

Thank you very much for you time, help, and generally development of this app.

Also, I hope this "debugging" will serve someone else in the same situation.

[viktorstrate]

1. Setup SSL

You can use a reverse proxy to get HTTPS up and running, I will recommend Caddy as it's probably the simplest and it configures HTTPS automatically.

You can use it to redirect multiple services from the same port number based on rules like subdomains, using a caddyfile.
It can also serve files, so you might not need Apache.

Example caddyfile

photoview.example.org {
	reverse_proxy localhost:4242
}

example.org {
	root * /www/example.com
	file_server
}

Remember to update the PUBLIC_ENDPOINT to start with https, otherwise you'll get some errors.

2. Database

Docker Compose is a small helper to Docker itself, that makes it easy to start up multiple Docker containers together configured using the docker-compose.yml file.
The database can only be accessed by Photoview, because you only expose the port used to access Photoview.
Using the default credentials is not really a security concern.

[edison23]

Thanks, I'll look into setting up Caddy with Docker on Ubuntu when I have more time.

As for the database: "not really a security concern" sounds like it might be a security concern in some situations. Could you please give me a hint where the database actually is so I can look at the data stored in it?

Again, thanks for your help, I'll probably get back to you with more questions after I figure out the Caddy stuff. And happy New Year, by the way :)

[viktorstrate]

Happy New Year 🎉

The database stores information about:

• The users, with hashed passwords.
• What albums and media that has been scanned and where it is located, but not the actual media it self.
• Generated URL shares
• Settings

You can connect to the database using the following command, given MYSQL_DATABASE=photoview and MYSQL_PASSWORD=photo-secret.

$ docker-compose exec db mysql -uphotoview -pphoto-secret

I say "not really a security concern" because the database cannot be accessed from outside the server, atleast using the default configuration, so if the database gets compromized it's because somthing else already has been compromized, if that is the host machine itself then the credentials could just be read from the docker-compose.yml file anyways.

[edison23]

So, I'm again a bit lost. I tried configuring Caddy as you proposed above but I get an error that the port 443 is already in use. I suppose the problem is using Caddy together with Apache (BTW, in separate locations, I put Photoview into a directory outside the Apache's reach). The whole issue seems to be that I want to use custom port (4242) and also SSL - is that even possible?

I played with various ports but it doesn't really matter - as long as I don't put any port to the 1st line, I get the port 443 already in use error, if I put some random port number to the 1st line, I get the same error, only about port 80.
Aso, later on I've concatenated the two blocks in Caddy file into one because it didn't make sense to me why would I configure it for the root of my website which is served by Apache. Also no.2: I've adjusted the file according to what I found about running Caddy with HTTPS over a custom port (and I failed).

Here's my Caddyfile:

photoview.example.org:4242 {
        tls /etc/caddy/certs/cert1.pem /etc/caddy/certs/privkey1.pem
        reverse_proxy localhost:4242
        root * /mydrive/somedirOutsideApacheReach/photoview
        file_server
}

After I change the Caddyfile, I run $ sudo systemctl reload-or-restart caddy.service, then $ sudo systemctl status caddy.service with this output:

● caddy.service - Caddy
     Loaded: loaded (/lib/systemd/system/caddy.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Sat 2021-01-02 10:28:49 UTC; 14s ago
       Docs: https://caddyserver.com/docs/
    Process: 2160484 ExecStart=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile (code=exited, status=1/FAILURE)
   Main PID: 2160484 (code=exited, status=1/FAILURE)

Jan 02 10:28:49 myserver caddy[2160484]: USER=caddy
Jan 02 10:28:49 myserver caddy[2160484]: INVOCATION_ID=0e4bdc3f0e79414db90dea4a47a0b499
Jan 02 10:28:49 myserver caddy[2160484]: JOURNAL_STREAM=9:53664649
Jan 02 10:28:49 myserver caddy[2160484]: {"level":"info","ts":1609583329.794095,"msg":"using provided configuration","config_file":"/etc/caddy/Caddyfile","config_adapter":""}
Jan 02 10:28:49 myserver caddy[2160484]: {"level":"info","ts":1609583329.7959642,"logger":"admin","msg":"admin endpoint started","address":"tcp/localhost:2019","enforce_origin":false,"origins":["localhost:2019","[::1]:2019","127.0.0.1:2019"]}
Jan 02 10:28:49 myserver caddy[2160484]: {"level":"info","ts":1609583329.7966084,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc0003e11f0"}
Jan 02 10:28:49 myserver caddy[2160484]: {"level":"info","ts":1609583329.7973166,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
Jan 02 10:28:49 myserver caddy[2160484]: run: loading initial config: loading new config: http app module: start: tcp: listening on :80: listen tcp :80: bind: address already in use
Jan 02 10:28:49 myserver systemd[1]: caddy.service: Main process exited, code=exited, status=1/FAILURE
Jan 02 10:28:49 myserver systemd[1]: caddy.service: Failed with result 'exit-code'.

Caddy doesn't seem to be anyhow reflecting the config (although I know it does reflect it since it was throwing syntaxt errors and such before).

I guess I'm missing something basic but I didn't manage to find what it is by doing a few Google queries. I'm grateful for your help.

[viktorstrate]

I have little experience using Caddy so I don't know of a solution to your exact problem.

As far as I can read, for Caddy to automatically configure SSL, you must use port 443, though it is possible to configure certificates manually for a custom port.

I don't know what you are using Apache for, but I would probably ditch either Apache or Caddy and only have a single server to manage port 80 and 443.
If caddy can't replace Apache for you, I would recommend you use Apache for the reverse proxy and SSL configurations, though I think it will be a lot more complicated and manual, as you would have to deal with SSL certificates yourself, and Apache configurations are also a little complicated in my experience.

See these guides:
Reverse proxy with Apache
Secure Apache with Let's Encrypt

[edison23]

Thanks for the opinion, I also had the feeling I should be using only one webserver because of (among other issues) the clash of port management, I just hoped for some easy solution. Anyway, thanks for the links and all the help, I'll post here once I get to some working solution. Until then, I'll have to live without the encryption.

[edison23]

So, in the end, I've implemented the solution without PhotoView. I had already running Piwigo on my server and Syncthing on both the server and my Android phone. I set up synchronization of the camera folder between the phone and a directory on the server. From time to time, I synchronize the filesystem contents with the Piwigo database and I have an up-to-date album in Piwigo with the photos from the phone. It proved as much easier and more convenient solution than to meddle with other webservers (Caddie) on a machine already running one (Apache) -- the set up of ports to have HTTPS with Caddie or the reverse proxy solution seems very cumbersome to me.