Ente部署记录

1
services:
2
  museum:
3
    image: ghcr.io/ente-io/server
4
    ports:
5
      - 8080:8080 # API(此处为museum的暴露端口)
6
    depends_on:
7
      postgres:
8
        condition: service_healthy
9
    volumes:
10
      - ./museum.yaml:/museum.yaml:ro
11
      - ./data:/data:ro
12
    healthcheck:
13
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:8080/ping"]
14
# 此处的test在容器内,因此就算使用域名也不用更改
15
      interval: 60s
16
      timeout: 5s
17
      retries: 3
18
      start_period: 120s
19

20
# Resolve "localhost:3200" in the museum container to the minio container.
21
# socat是内部协商的进程,可以不理
22
  socat:
23
    image: alpine/socat
24
    network_mode: service:museum
25
    depends_on: [museum]
26
    command: "TCP-LISTEN:3200,fork,reuseaddr TCP:minio:3200"
27

28
  web:
29
    image: ghcr.io/ente-io/web
30
    # Uncomment what you need to tweak.
31
    ports:
32
      - 3000:3000 # Photos web app
33
      # - 3001:3001 # Accounts(museum通行密钥服务)
34
      - 3002:3002 # Public albums
35
      # - 3003:3003 # Auth(另外的TOTP自行托管服务,不过还是得勤备份,不然服务没了,就完了)
36
      # - 3004:3004 # Cast(Photo的其他设备的投屏服务)
37
      # - 3005:3005 # Share(Locker服务)
38
      # - 3006:3006 # Embed(在其他页面嵌入代码用的服务)
39
      # - 3008:3008 # Paste(这个暂时没搞懂)
40
    # Modify these values to your custom subdomains, if using any
41
    environment:
42
      ENTE_API_ORIGIN: https://ente-museum.example.xxx #你的域名
43
      ENTE_ALBUMS_ORIGIN: https://ente-albums.example.xxx #你的域名
44
      ENTE_PHOTOS_ORIGIN: https://ente-photo.example.xxx #你的域名
45

46
  postgres:
47
    image: postgres:15
48
    environment:
49
      POSTGRES_USER: pguser
50
      POSTGRES_PASSWORD: gZ48MlyM17A7Wsip3qG7hjd/VfR1
51
      POSTGRES_DB: ente_db
52
    healthcheck:
53
      test: pg_isready -q -d ente_db -U pguser
54
      start_period: 40s
55
      start_interval: 1s
56
    volumes:
57
      - postgres-data:/var/lib/postgresql/data
58

59
  minio:
60
    image: minio/minio
61
    ports:
62
      - 3200:3200 # MinIO API
63
      # Uncomment to enable MinIO Web UI
64
      # - 3201:3201 #这里可开可不可,开进MinIo里可以看看被加密的文件,就没什么用了,不过要开的话,得把MinIO API启动后才能登录进去
65
    environment:
66
      MINIO_ROOT_USER: minio-user-Q9nyRF8a
67
      MINIO_ROOT_PASSWORD: L+ditvZHvCKI/CjNLGzSwMlR4yTl
68
    command: server /data --address ":3200" --console-address ":3201"
69
    volumes:
70
      - minio-data:/data
71
    post_start:
72
      - command: |
73
          sh -c '
74
          #!/bin/sh
75

76
          while ! mc alias set h0 http://minio:3200 minio-user-Q9nyRF8a L+ditvZHvCKI/CjNLGzSwMlR4yTl 2>/dev/null
77
          do
78
            echo "Waiting for minio..."
79
            sleep 0.5
80
          done
81

82
          cd /data
83

84
          mc mb -p b2-eu-cen
85
          mc mb -p wasabi-eu-central-2-v3
86
          mc mb -p scw-eu-fr-v3
87
          '
88

89
volumes:
90
  postgres-data:
91
  minio-data:

1
db:
2
      host: postgres
3
      port: 5432
4
      name: ente_db
5
      user: pguser
6
      password: gZ48MlyM17A7Wsip3qG7hjd/VfR1
7

8
s3:
9
      # Top-level configuration for buckets, you can override by specifying these configuration in the desired bucket.
10
      # Set this to false if using external object storage bucket or bucket with SSL
11
      are_local_buckets: true # 这里如果要使用公网要把这里关了
12
      # Set this to false if using subdomain-style URL. This is set to true for ensuring compatibility with MinIO when SSL is enabled.
13
      use_path_style_urls: true
14
      b2-eu-cen:
15
         # Uncomment the below configuration to override the top-level configuration
16
         # are_local_buckets: true
17
         # use_path_style_urls: true
18
         key: minio-user-Q9nyRF8a
19
         secret: L+ditvZHvCKI/CjNLGzSwMlR4yTl
20
         endpoint: https://ente-minoapi.example.xxx # 这里修改为自己的minoio的api域名
21
         region: eu-central-2
22
         bucket: b2-eu-cen
23
      wasabi-eu-central-2-v3:
24
         # are_local_buckets: true
25
         # use_path_style_urls: true
26
         key: minio-user-Q9nyRF8a
27
         secret: L+ditvZHvCKI/CjNLGzSwMlR4yTl
28
         endpoint: https://ente-minoapi.example.xxx # 这里修改为自己的minoio的api域名
29
         region: eu-central-2
30
         bucket: wasabi-eu-central-2-v3
31
         compliance: false
32
      scw-eu-fr-v3:
33
         # are_local_buckets: true
34
         # use_path_style_urls: true
35
         key: minio-user-Q9nyRF8a
36
         secret: L+ditvZHvCKI/CjNLGzSwMlR4yTl
37
         endpoint: https://ente-minoapi.example.xxx # 这里修改为自己的minoio的api域名
38
         region: eu-central-2
39
         bucket: scw-eu-fr-v3
40

41
# Specify the base endpoints for various web apps
42
apps:
43
    # If you're running a self hosted instance and wish to serve public links,
44
    # set this to the URL where your albums web app is running.
45
    # 这里有需要的就改成自己的域名就行了
46
    public-albums: https://ente-albums.example.xxx
47
    cast: http://localhost:3004
48
    # Public locker (share) app
49
    public-locker: https://localhost:3005
50
    # Public paste app
51
    public-paste: http://localhost:3008
52
    # Embed app for embedded album sharing
53
    embed-albums: http://localhost:3006
54
    # Set this to the URL where your accounts web app is running, primarily used for
55
    # passkey based 2FA.
56
    accounts: http://localhost:3001
57

58
key:
59
      encryption: YFYXhtFNdiP5TCeqgHgssTedPzhErPVb8HBW11w1YyM=
60
      hash: KybAIMxdy2tiyr8+0nodoA8h5oSHWccyYzeTrugYJDUFYubl9iAadwPDEpjMxnY/7Hg/E0dOC1apy4WYJa8oIw==
61

62
jwt:
63
      secret: hI_yIzLFeHRIlivavcTcKUXJ99PXRVwXUrFENGsIA5o=
64

65
# 一下为而外设置,因服务而改变
66
webauthn: # 这里是如果开启通行密钥后的设置
67
    rpid: ente-accounts.example.com # 你的通行密钥验证会对ente-accounts.example.com以及他的子域名标记为通行密钥的识别域名
68
    rporigins:
69
        - "https://ente-accounts.example.com" # 这里你的通信密钥服务会对这里面的域名豁免,并且需要完全匹配,防止中间人攻击
70
#internal:
71
#    admins: # 这里是你的管理员账号的ID
72
#        - hidden
73
#    disable-registration: true # 这里是禁止新用户注册