From c5fc801fd365a673ebbc6412d086cd8d755a7134 Mon Sep 17 00:00:00 2001
From: Florent Guiotte <florent.guiotte@irisa.fr>
Date: Sun, 4 Jan 2026 12:23:34 +0100
Subject: [PATCH] WIP setup ente and garage

---
 bind9/guiotte.db                              |  35 ++--
 ddclient/ddclient.conf                        | Bin 1202 -> 1438 bytes
 docker-compose.yml                            |  25 +--
 swag/nginx/nginx.conf                         |   8 +
 .../proxy-confs/ente-server.subdomain.conf    |  22 +++
 .../nginx/proxy-confs/ente-web.subdomain.conf | 153 ++++++++++++++++++
 swag/nginx/proxy-confs/garage.subdomain.conf  |  49 ++++++
 swag/nginx/proxy-confs/lychee.subdomain.conf  |   2 +-
 8 files changed, 265 insertions(+), 29 deletions(-)
 create mode 100644 swag/nginx/proxy-confs/ente-server.subdomain.conf
 create mode 100644 swag/nginx/proxy-confs/ente-web.subdomain.conf
 create mode 100644 swag/nginx/proxy-confs/garage.subdomain.conf

diff --git a/bind9/guiotte.db b/bind9/guiotte.db
index 6d596e9..fc4d9bd 100644
--- a/bind9/guiotte.db
+++ b/bind9/guiotte.db
@@ -12,21 +12,24 @@ $TTL  604800
 @  IN  NS  dm.guiotte.fr.
 
 ; OVH
-guiotte.fr.        IN  A       37.59.61.141
-*.guiotte.fr.      IN  CNAME   guiotte.fr.
+guiotte.fr.            IN  A       37.59.61.141
+*.guiotte.fr.          IN  CNAME   guiotte.fr.
 
 ; LAN
-dm.guiotte.fr.     IN  A       192.168.1.2
-money.guiotte.fr.  IN  CNAME   dm.guiotte.fr.
-photos.guiotte.fr. IN  CNAME   dm.guiotte.fr.
-dl.guiotte.fr.     IN  CNAME   dm.guiotte.fr.
-kdoc.guiotte.fr.   IN  CNAME   dm.guiotte.fr.
-sync.guiotte.fr.   IN  CNAME   dm.guiotte.fr.
-pad.guiotte.fr.    IN  CNAME   dm.guiotte.fr.
-home.guiotte.fr.   IN  CNAME   dm.guiotte.fr.
-zotero.guiotte.fr. IN  CNAME   dm.guiotte.fr.
-git.guiotte.fr.    IN  CNAME   dm.guiotte.fr.
-db.guiotte.fr.     IN  CNAME   dm.guiotte.fr.
-flix.guiotte.fr.   IN  CNAME   dm.guiotte.fr.
-task.guiotte.fr.   IN  CNAME   dm.guiotte.fr.
-todo.guiotte.fr.   IN  CNAME   dm.guiotte.fr.
+dm.guiotte.fr.         IN  A       192.168.1.2
+money.guiotte.fr.      IN  CNAME   dm.guiotte.fr.
+dl.guiotte.fr.         IN  CNAME   dm.guiotte.fr.
+kdoc.guiotte.fr.       IN  CNAME   dm.guiotte.fr.
+sync.guiotte.fr.       IN  CNAME   dm.guiotte.fr.
+pad.guiotte.fr.        IN  CNAME   dm.guiotte.fr.
+home.guiotte.fr.       IN  CNAME   dm.guiotte.fr.
+zotero.guiotte.fr.     IN  CNAME   dm.guiotte.fr.
+git.guiotte.fr.        IN  CNAME   dm.guiotte.fr.
+db.guiotte.fr.         IN  CNAME   dm.guiotte.fr.
+flix.guiotte.fr.       IN  CNAME   dm.guiotte.fr.
+task.guiotte.fr.       IN  CNAME   dm.guiotte.fr.
+todo.guiotte.fr.       IN  CNAME   dm.guiotte.fr.
+pics.guiotte.fr.       IN  CNAME   dm.guiotte.fr.
+photos.guiotte.fr.     IN  CNAME   dm.guiotte.fr.
+ente.guiotte.fr.       IN  CNAME   dm.guiotte.fr.
+s3.guiotte.fr.         IN  CNAME   dm.guiotte.fr.
diff --git a/ddclient/ddclient.conf b/ddclient/ddclient.conf
index 319e1061d29ef3bba931b3736640385dc80a699b..69a0f23237e37dee27a9d5f7a78ae9c744f1da47 100644
GIT binary patch
literal 1438
zcmV;P1!4LCM@dveQdv+`0EZ@yO%YuZoT_FOgISc=r7{zr!BOk@I{~Yv<v<1@?w^^w
zOLhv838OqvZR=g6-*aN4a)U@2TSbCTqRL49=dyf0X^8?mm!rWLSRKzg)!`45m5Jnu
z(e%nC38z?S994*dgQw7y9nfGCJzxh^aiedsz!$!exP*Gf<N&|CYs06Jh@pBED2j2k
zYub1reHc-|fse|u;EYH+i+e^pWKKbLb;-{wT-U?$<w3=3(^pjMFO;|8tpK~-INo<?
zn7M@nyLeF0U0&aQm}PMDhKjEuyznDRALLJ&KrZzhR%=V<yS#tGYaKkG@=S#~oS2x=
zpK;%S@Rvz(;C!^`p4l}oQEXT-yz<v9y>{fmVdT~BBi<;2gkTLBi1D10MMh4H__Pl4
z<n<v+Zo|T9y|E#?j+WhBteT>#tEUf!hh=y_FAEsKd89Tk8;qxL0pUh3M?T(~z`xK*
z{JE*FtF1hGCk83qdSgV4t16910Nr&jyti)S&qBPnr7o+<@j+;P;T>dAD+s+f-NWp@
z1W5)D8fF8{JVJYj#N@&dm^vjV`sy=H$MQP^*r>3Xqyf6vei&R5p4G8lAeUeJDxJQ5
zDcUQ*of*jkjzhRNUzvnYtB%I1tx-v`T!Y&ZfpA9>pU;L5N8EBg)dbrX1y~!=EnZ^?
zkdd`rg|!{o$sb5U{8R$8)YrBp%Yk>Wa^YXy3f+dB?<v;c0?$C#2yhA}-ncLmUbI!#
z0kSjhD~+S~w|v5Rt@L({_!p36)1vUev<iakv)IugC_ovRA?0#4n6EVTM-feL#mxU$
zYL(d2$3r|WN(>HL@vF;v-78xT)f-#78f(|l&89QiDPHk(<MxFOxMbh(_$L&;x}}TC
zS0Q%}bN!-NI3;HgvL-Cn7mD4(&Vamt?u{yoC&h^=MRduw-G7`OYk19dX?);m5>Cg?
z^k&D_(28N3%Gt8j(1GNIDn$V0-ScPF3u)q;;2#i_JFDCZN_0#nRnfs|7zdFUj{>`=
zZ7jG;6krR~&{)16V-N8enPZ@|A9YmcCAn6c1vIN;70IUe&SJz%(VC&9Blk6Ii6(St
zY&-Byg6@i6FT(-+f4LYm4=%ygmJn{b^Rmk$WY%5T(^!Y9>&yg=H9zASDg3#McVE?q
zQ@QL3V<zDcL332q!_+@h{BqDo8Z>rri=AFwP=}uS=IIOI&}5Wuphp587QkYk$lr$#
zog|x-fnt-xDYfzhAYSD8484duXDl&Rv?As759JKR`227f^mFY=M!+(&2}Iul--Yb?
zIrbfhw4}|-xw<*%RdZZUKg2vZ>V!W1Hy0J%pd4_$n3Q2smTe;x*b5M9)Nq)K>6l8j
z@+w(%J*PTtA5@^}wi=L7oGetF0B&a)&>-zlQR{$Rt!Lx%TDFEg#;@>fgIItFs#lHh
z`@i@DT}XTsX1-$ah+s_<{&FCkVYR^V&pWu^MTIY;Z;?`Ks35$u+~Ae~k}Qqru^O8O
z{AFfRP2gkOE%quWWOEMImjuLFFid)9sxx(q;Ey)RZeuoQWV+qhIe)!zkmA25Ttus8
z2s=0n6$ymGZLT-|9AVS}GWjs&%Q=v&(-}}K7%6tfnKC0&Ea@YwU6G%LO^&o@8YyoC
zVLkSDOcNMQ<eP6-hMx|OMk9&X@A+o`vWsJ`HlZ_(9v9<}A-iYo;*m)U#ODlQ@7S~f
zm?-kqv$Lt|M!23SUM6|l-?KSU#)Q&BGN!DWTz3JhVMbJyXE7)ng4l3!FL9xopg2d$
zcFkkgJ204N6<VD}!ge4psTHgU&~}P4mt(+lgDt=v79tq8BfJJolAX$9nn;KZ(-z+(
sBJn4G=cQK7N}yv4zDy|dcRho?i5J^1R^rd*{2H5mvMV%?<Q^#%;)7zt*Z=?k

literal 1202
zcmV;j1Wo$@M@dveQdv+`0227qQP=Dz5C?5MC9Vvdp#fo&)o;xpEW!v25u>eL)2>a6
zt-UNfT>-9y_5@;Zu1>%Z3;;~ON~G{@|7%}BW3t-^j|b<-psf1yReHSlq!XgHku>pB
z7k+nbt3M|))i5o9>kyEaP2P$rI;lh`Bd?kBy-_2q-~-FuEtf^24>Pm(r|jlO=ck`@
zIncRD1rmqED}&I+qw8?5{$P8oJxMLfnCqY*b*@_%6oo*LaIo?J-c(WOpdTaYrOcUm
zv>^2vL>^*p;U4ZXD@abR))xoqIWV5mo@UAced~}*M&;oZ;YI?f>}d<x_OU=>r)E9>
z1(<+=Rh&nnr?xnITrELKs|8%z4JYG6j8-zWKGTnk89V$9;o28m0RP@1ko<8-35Kof
zp5V+rY)5L2R%79$4b>JK#%%92_?NREk_QA{ftgODD1lp68K<av8E`@hw2x9SOIBB-
zn(pHYu)+e1)g}7G4YuIytm+x#om@u(o83O?(iLw*C%f&mcM#}uu(GC~E-uC|cA+{I
zjR^V};F=MCHD&TE<Dy%870+9<%TY*g2gRP8Fie*+&rWITDINhr?Gp?l4?h%Lk5rAM
z54)vq50-_Qp7;WGjdqr)WWM8Z2=;M#a<%xHsv?t?Qn>~>zhVFi$@z=dq-WXRno9?;
z{ONByZqQ&wVHE)smW5K=il|L&r~BZe>Y4U)4>xX_2g1c`zOXhC?JdSqDEf7`2%3|3
zB(7|@KTzH8?Gzp|O<?cK?OH=1>(TIJIc{2t8an7Jm0r~^=h|4FO;dU@LdXbqsFh}w
zbLO9JeA4(%_1YASy+;sfs!BObRZB`tQg1)gT2^#pj7rJ|ZL{LtGW#o^ENE+_xtSix
zXbv>ap(&@i?h73h_gBZ|xt>eR0jF0H6lIra9AW4$!m_IftQ-6Qw`k`l9E_R>I~ICz
z-rd7S@Luj8K~uIr;x5(KC5o2j*~KB=eqhXn>R*MDs*YwEsb9QK^~5tP`xh1@ZyeCr
z#Lp9ao@IM?7#lGEXe6E5<_s!&xzZwCia?ry7GM7=P@EX2gi=vPjODNwWclEktHx^M
z`mKCBnFp+pY-qQ2$LS$Hh>24cm*Bsa#1^Eitw=0slLD7V1q%L%RsYwrSPVA?$du<4
z9F@(a=edA_JL^{3I$RVuOs(c;FfY0xIqViH$-DKjQM_Ln*v2_alE}>+&`LUc`x$4t
z+T(oX>avJ!Uj}yw=fd1x>v91<h-cv(<SmqlkU47~p?$tlogI|Yj3Hd;eW4OV+bi<{
z74V7r#Bcy|kLN1#zHeEOUK_t!IU*&ZVc5S9<QGYsqCeAoa6xeqr-dyI>~MJOW#MUJ
zD&_siJ*2^exP^~fB`yEyT3=Z$L?p#~hoy{mZNvzcxYjPlcemhQ8f(~W3*J9@N|BLS
zp9je*d9qdbD_!RMXe6!t>L0oW_9|IIMG-v7gMQQTjhB?H8J{wvIM5M?Bc%wn=3zaG
zTdvXQa)?5h>7M*l)AUiqzH&Hnccw{mX;F}KpG^MnYsvAS*XS73u;--fnn?p9gIktg
QF;40*F@DF}fMG!a<vNN?$N&HU

diff --git a/docker-compose.yml b/docker-compose.yml
index 5133299..ee0c93b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -181,7 +181,7 @@ services:
       DB_USERNAME: lychee
       DB_DATABASE: lychee
       DB_PORT: 3306
-      APP_URL: https://photos.guiotte.fr
+      APP_URL: https://pics.guiotte.fr
       TRUSTED_PROXIES: 172.22.0.0/24
     secrets:
       - lychee-db-pw
@@ -484,8 +484,8 @@ services:
     image: ghcr.io/ente-io/server
     container_name: ente-server
     restart: unless-stopped
-    ports:
-      - 8080:8080 # API
+    #ports:
+    #  - 8080:8080 # API
     depends_on:
       ente-db:
         condition: service_healthy
@@ -494,13 +494,15 @@ services:
       ENTE_DB_HOST: ente-db
       ENTE_DB_NAME: ente_db
       ENTE_DB_USER: pguser
-      ENTE_S3_B2_EU_CEN_ENDPOINT: garage:3900
+      ENTE_S3_ARE_LOCAL_BUCKETS: false
+      ENTE_S3_USE_PATH_STYLE_URLS: true
+      ENTE_S3_B2_EU_CEN_ENDPOINT: https://s3.guiotte.fr
       ENTE_S3_B2_EU_CEN_REGION: garage
       ENTE_S3_B2_EU_CEN_BUCKET: ente
-      ENTE_APPS_PUBLIC_ALBUMS: http://dm:3002
-      ENTE_APPS_CAST: http://dm:3004
-      ENTE_APPS_EMBED_ALBUMS: http://dm:3005
-      ENTE_APPS_ACCOUNTS: http://dm:3001
+      ENTE_APPS_PUBLIC_ALBUMS: https://albums.photos.guiotte.fr
+      ENTE_APPS_CAST: https://cast.photos.guiotte.fr
+      ENTE_APPS_EMBED_ALBUMS: https://embed.photos.guiotte.fr
+      ENTE_APPS_ACCOUNTS: https://accounts.photos.guiotte.fr
     secrets:
       - ente-db-pw
       - ente-s3-key
@@ -521,7 +523,6 @@ services:
       retries: 3
       start_period: 120s
 
-
   ente-web:
     image: ghcr.io/ente-io/web
     container_name: ente-web
@@ -538,9 +539,9 @@ services:
     # Modify these values to your custom subdomains, if using any
     environment:
       <<: *common-environment
-      ENTE_API_ORIGIN: http://localhost:8080
-      ENTE_ALBUMS_ORIGIN: https://dm:3002
-      ENTE_PHOTOS_ORIGIN: http://dm:3000
+      ENTE_API_ORIGIN: https://ente.guiotte.fr
+      ENTE_ALBUMS_ORIGIN: https://albums.photos.guiotte.fr
+      ENTE_PHOTOS_ORIGIN: https://photos.guiotte.fr/
 
 
 volumes:
diff --git a/swag/nginx/nginx.conf b/swag/nginx/nginx.conf
index 5f59482..f1130a8 100644
--- a/swag/nginx/nginx.conf
+++ b/swag/nginx/nginx.conf
@@ -75,6 +75,14 @@ http {
     # Includes virtual hosts configs.
     include /etc/nginx/http.d/*.conf;
     include /config/nginx/site-confs/*.conf;
+
+    # For garage CORS
+    map $http_origin $cors_origin {
+        default "";
+        "https://photos.guiotte.fr" $http_origin;
+        "https://ente.guiotte.fr" $http_origin;
+    }
+
 }
 
 daemon off;
diff --git a/swag/nginx/proxy-confs/ente-server.subdomain.conf b/swag/nginx/proxy-confs/ente-server.subdomain.conf
new file mode 100644
index 0000000..c7789b1
--- /dev/null
+++ b/swag/nginx/proxy-confs/ente-server.subdomain.conf
@@ -0,0 +1,22 @@
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name ente.*;
+
+    include /config/nginx/ssl.conf;
+
+    client_max_body_size 0;
+
+    location / {
+
+        include /config/nginx/proxy.conf;
+        include /config/nginx/resolver.conf;
+        set $upstream_app ente-server;
+        set $upstream_port 8080;
+        set $upstream_proto http;
+        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+
+    }
+}
+
diff --git a/swag/nginx/proxy-confs/ente-web.subdomain.conf b/swag/nginx/proxy-confs/ente-web.subdomain.conf
new file mode 100644
index 0000000..990c068
--- /dev/null
+++ b/swag/nginx/proxy-confs/ente-web.subdomain.conf
@@ -0,0 +1,153 @@
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name photos.*;
+
+    include /config/nginx/ssl.conf;
+
+    client_max_body_size 0;
+
+    location / {
+
+        include /config/nginx/proxy.conf;
+        include /config/nginx/resolver.conf;
+        set $upstream_app ente-web;
+        set $upstream_port 3000;
+        set $upstream_proto http;
+        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name accounts.photos.*;
+
+    include /config/nginx/ssl.conf;
+
+    client_max_body_size 0;
+
+    location / {
+
+        include /config/nginx/proxy.conf;
+        include /config/nginx/resolver.conf;
+        set $upstream_app ente-web;
+        set $upstream_port 3001;
+        set $upstream_proto http;
+        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name public.photos.*;
+
+    include /config/nginx/ssl.conf;
+
+    client_max_body_size 0;
+
+    location / {
+
+        include /config/nginx/proxy.conf;
+        include /config/nginx/resolver.conf;
+        set $upstream_app ente-web;
+        set $upstream_port 3002;
+        set $upstream_proto http;
+        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name auth.photos.*;
+
+    include /config/nginx/ssl.conf;
+
+    client_max_body_size 0;
+
+    location / {
+
+        include /config/nginx/proxy.conf;
+        include /config/nginx/resolver.conf;
+        set $upstream_app ente-web;
+        set $upstream_port 3003;
+        set $upstream_proto http;
+        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name cast.photos.*;
+
+    include /config/nginx/ssl.conf;
+
+    client_max_body_size 0;
+
+    location / {
+
+        include /config/nginx/proxy.conf;
+        include /config/nginx/resolver.conf;
+        set $upstream_app ente-web;
+        set $upstream_port 3004;
+        set $upstream_proto http;
+        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name share.photos.*;
+
+    include /config/nginx/ssl.conf;
+
+    client_max_body_size 0;
+
+    location / {
+
+        include /config/nginx/proxy.conf;
+        include /config/nginx/resolver.conf;
+        set $upstream_app ente-web;
+        set $upstream_port 3005;
+        set $upstream_proto http;
+        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name embed.photos.*;
+
+    include /config/nginx/ssl.conf;
+
+    client_max_body_size 0;
+
+    location / {
+
+        include /config/nginx/proxy.conf;
+        include /config/nginx/resolver.conf;
+        set $upstream_app ente-web;
+        set $upstream_port 3006;
+        set $upstream_proto http;
+        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+
+    }
+}
diff --git a/swag/nginx/proxy-confs/garage.subdomain.conf b/swag/nginx/proxy-confs/garage.subdomain.conf
new file mode 100644
index 0000000..c0dd43f
--- /dev/null
+++ b/swag/nginx/proxy-confs/garage.subdomain.conf
@@ -0,0 +1,49 @@
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name s3.*;
+
+    include /config/nginx/ssl.conf;
+
+    client_max_body_size 0;
+
+    location / {
+        include /config/nginx/proxy.conf;
+        include /config/nginx/resolver.conf;
+
+        set $upstream_app garage;
+        set $upstream_port 3900;
+        set $upstream_proto http;
+
+        # --- Handle CORS preflight ---
+        if ($request_method = OPTIONS) {
+            add_header 'Access-Control-Allow-Origin' "*" always;
+            add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS, HEAD' always;
+            add_header 'Access-Control-Allow-Headers' '*' always;
+            add_header 'Access-Control-Allow-Credentials' 'true' always;
+            add_header 'Access-Control-Max-Age' 3000;
+            add_header 'Content-Length' 0;
+            add_header 'Content-Type' 'text/plain charset=UTF-8';
+            return 204;
+        }
+
+        # --- Proxy normal requests ---
+        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+
+        # Prevent backend from sending conflicting CORS headers (optional)
+        proxy_hide_header Access-Control-Allow-Origin;
+        proxy_hide_header Access-Control-Allow-Credentials;
+        proxy_hide_header Access-Control-Allow-Headers;
+        proxy_hide_header Access-Control-Allow-Methods;
+        proxy_hide_header Access-Control-Expose-Headers;
+
+        # --- Add CORS headers for actual responses ---
+        add_header 'Access-Control-Allow-Origin' "*" always;
+        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS, HEAD' always;
+        add_header 'Access-Control-Allow-Headers' '*' always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Access-Control-Expose-Headers' 'Etag' always;#
+    }
+}
+
diff --git a/swag/nginx/proxy-confs/lychee.subdomain.conf b/swag/nginx/proxy-confs/lychee.subdomain.conf
index 2f9afea..b604eb0 100644
--- a/swag/nginx/proxy-confs/lychee.subdomain.conf
+++ b/swag/nginx/proxy-confs/lychee.subdomain.conf
@@ -6,7 +6,7 @@ server {
     listen 443 ssl http2;
     listen [::]:443 ssl http2;
 
-    server_name photos.*;
+    server_name pics.*;
 
     include /config/nginx/ssl.conf;