1. Installation

Source: Ente Docker Installation

If you don't have enough resources you can again install Ente in your DockerVM. However, if you do, then I would recommend to make a dedicated VM for your precious personal media, especially when it will also include media from your friends and family. But yeah, regardless the installation will be the same if you will use docker. Now, if you use Dockhand and create a new VM specifically for personal media then you should create another dockhand instance for that. Yes you can

1. So the first thing we will do is download all the files we need s.t we can then copy paste them in Dockhand. For this enter your VM and copy paste the following in the folder where Dockhand has access to. 

git clone https://github.com/ente/ente
cd ente/server/config

2. Perfect, so now you are in the config file which contains the compose file, environment variables and the museum file. This is basically where the magic happens. So to make them effective we need to change there names as follows

# Inside the cloned repository's directory (usually `ente`)
cd server/config
cp example.env .env
cp example.yaml museum.yaml

3. Perfect now, we will start editing first the .env file. At this moment of writing that is only specifying the postgres credential

services:
  museum:
    build:
      context: ..
    ports:
      - 8080:8080 # Museum/API
    depends_on:
      postgres:
        condition: service_healthy
    env_file:
      - .env
    volumes:
      - ./museum.yaml:/museum.yaml:ro
      - ./data:/data:ro

  # Resolve "localhost:3200" in the museum container to the minio container.
  socat:
    image: alpine/socat
    network_mode: service:museum
    depends_on: [museum]
    command: "TCP-LISTEN:3200,fork,reuseaddr TCP:minio:3200"

  postgres:
    image: postgres:15-trixie
    env_file:
      - .env
    # Wait for postgres to accept connections before starting museum.
    healthcheck:
      test: pg_isready -q -d ${POSTGRES_DB} -U ${POSTGRES_USER}
      start_period: 30s
      start_interval: 1s
    volumes:
      - postgres-data:/var/lib/postgresql/data

  minio:
    image: minio/minio
    ports:
      - 3200:3200 # MinIO API
      # - 3201:3201 # MinIO Console (uncomment to access externally)
    env_file:
      - .env
    command: server /data --address ":3200" --console-address ":3201"
    volumes:
      - minio-data:/data
    post_start:
      - command: |
          sh -c '
          #!/bin/sh

          while ! mc alias set h0 http://minio:3200 ${MINIO_ROOT_USER} ${MINIO_ROOT_PASSWORD} 2>/dev/null
          do
            echo "Waiting for minio..."
            sleep 0.5
          done

          cd /data

          mc mb -p b2-eu-cen
          mc mb -p wasabi-eu-central-2-v3
          mc mb -p scw-eu-fr-v3
          '

  ente-web:
    build:
      context: ../..
      dockerfile: web/Dockerfile
    ports:
    ports:
      - 3000:3000 # Photos web app
      - 3001:3001 # Accounts
      - 3002:3002 # Public albums
      - 3003:3003 # Auth
      - 3004:3004 # Cast
      - 3005:3005 # Share
      - 3006:3006 # Embed
      - 3008:3008
      - 3009:3009 
      - 3010:3010 # Memories
    # Modify these values to your custom subdomains, if using any
    environment:
      - NODE_ENV=development
    env_file:
      - .env

volumes:
  postgres-data:
  minio-data:

4. 

Make sure to enter the correct values for the database and object storage.

You should consider generating values for JWT and encryption keys for emails if you intend to use for long-term needs.

You can do by running the following command inside ente/server, assuming you cloned the repository to ente:

# Copy this file to museum.yaml in the same directory in which this file is present

# This section is meant for configuration of database.
# Museum uses these values and credentials for connecting
# to the database.
# Set a strong password and if using PostgreSQL Docker container
# provided in Docker Compose file, ensure db.password is same
# as POSTGRES_PASSWORD
# Similarly ensure db.user and db.name are same as POSTGRES_USER and
# POSTGRES_DB respectively
db:
    host: postgres
    port: 5432
    name: ente_db
    user: pguser
    password: <password>

# This section is for configuring storage buckets. Omit this section if
# you only intend to use Ente Auth
s3:
    # Change this to false if enabling SSL
    are_local_buckets: true
    # Only path-style URL works if disabling are_local_buckets with MinIO
    use_path_style_urls: true
    b2-eu-cen:
      # Uncomment the below configuration to override the top-level configuration 
      # are_local_buckets: true
      # use_path_style_urls: true
      key: <key>
      secret: <secret>
      endpoint: localhost:3200
      region: eu-central-2
      bucket: b2-eu-cen
    wasabi-eu-central-2-v3:
      # are_local_buckets: true
      # use_path_style_urls: true
      key: <key>
      secret: <secret>
      endpoint: localhost:3200
      region: eu-central-2
      bucket: wasabi-eu-central-2-v3
      compliance: false
    scw-eu-fr-v3:
      # are_local_buckets: true
      # use_path_style_urls: true
      key: <key>
      secret: <secret>
      endpoint: localhost:3200
      region: eu-central-2
      bucket: scw-eu-fr-v3

# Specify the base endpoints for various web apps
apps:
    # If you're running a self hosted instance and wish to serve public links,
    # set this to the URL where your albums web app is running.
    public-albums: http://localhost:3002
    # If you're running a self hosted instance and wish to serve public links
    # for locker, set this to the URL where your share web app is running.
    public-locker: http://localhost:3005
    # If you're running a self hosted instance and wish to serve Ente Paste,
    # set this to the URL where your paste web app is running.
    public-paste: http://localhost:3008
    # If you're running a self hosted instance and wish to serve public memory
    # shares, set this to the URL where your memories web app is running.
    public-memories: http://localhost:3010
    cast: http://localhost:3004
    embed-albums: http://localhost:3006
    # Set this to the URL where your accounts web app is running, primarily used for
    # passkey based 2FA.
    accounts: http://localhost:3001
    # Set this to the URL where your legacy recovery web app is running.
    legacy: http://localhost:3011

# Key used for encrypting customer emails before storing them in DB
#
# To make it easy to get started, some randomly generated (but fixed) values are
# provided here. But if you're really going to be using museum, please generate
# new keys. You can use `go run tools/gen-random-keys/main.go` for that.
#
# Replace values in key and JWT for security
key:
    encryption: yvmG/RnzKrbCb9L3mgsmoxXr9H7i2Z4qlbT0mL3ln4w=
    hash: KXYiG07wC7GIgvCSdg+WmyWdXDAn6XKYJtp/wkEU7x573+byBRAYtpTP0wwvi8i/4l37uicX1dVTUzwH3sLZyw==
# JWT secrets
jwt:
    secret: i2DecQmfGreG6q1vBj5tCokhlN41gcfS2cjOs9Po-u8=

5. So what do we need to adjust in the museum.yaml file ? Well we need to make sure that we provide the correct URL's for the different apps that ente is providing. My recommendation today is to use one domain name and in front of it place the name of the app. Also since this app will be publicly accessible I would host the application on Cloudflare DNS. In this way you can use their proxy to prevent you from DDOS attacks and what not. Okey so as of writing you should create the following domain names and replace the http://localhost:port with your domain name. Don't forget to change HTTP ---> HTTPS !!!

Now, to make this working you need to have your reverse proxy working of course. If you use OPNsense as your router with Caddy then it will be fairly simple to do this. Just go to Caddy and add all the domain names pointing to the IP address of the VM you are hosting on and to the right port ;)

In order to run the cluster, you will have to provide environment variable values. Copy the configuration files for modification by the following command inside server/config directory of the repository. This allows you to modify configuration without having to face hassle while pulling in latest changes

# Copy this file to museum.yaml in the same directory in which this file is present

# This section is meant for configuration of database.
# Museum uses these values and credentials for connecting
# to the database.
# Set a strong password and if using PostgreSQL Docker container
# provided in Docker Compose file, ensure db.password is same
# as POSTGRES_PASSWORD
# Similarly ensure db.user and db.name are same as POSTGRES_USER and
# POSTGRES_DB respectively
db:
    host: postgres
    port: 5432
    name: ente_db
    user: pguser
    password: <password>

# This section is for configuring storage buckets. Omit this section if
# you only intend to use Ente Auth
s3:
    # Change this to false if enabling SSL
    are_local_buckets: true
    # Only path-style URL works if disabling are_local_buckets with MinIO
    use_path_style_urls: true
    b2-eu-cen:
      # Uncomment the below configuration to override the top-level configuration 
      # are_local_buckets: true
      # use_path_style_urls: true
      key: <key>
      secret: <secret>
      endpoint: localhost:3200
      region: eu-central-2
      bucket: b2-eu-cen
    wasabi-eu-central-2-v3:
      # are_local_buckets: true
      # use_path_style_urls: true
      key: <key>
      secret: <secret>
      endpoint: localhost:3200
      region: eu-central-2
      bucket: wasabi-eu-central-2-v3
      compliance: false
    scw-eu-fr-v3:
      # are_local_buckets: true
      # use_path_style_urls: true
      key: <key>
      secret: <secret>
      endpoint: localhost:3200
      region: eu-central-2
      bucket: scw-eu-fr-v3

# Specify the base endpoints for various web apps
apps:
    # If you're running a self hosted instance and wish to serve public links,
    # set this to the URL where your albums web app is running.
    public-albums: https://albums.rfeyn.org
    # If you're running a self hosted instance and wish to serve public links
    # for locker, set this to the URL where your share web app is running.
    public-locker: https://locker.rfeyn.org
    # If you're running a self hosted instance and wish to serve Ente Paste,
    # set this to the URL where your paste web app is running.
    public-paste: https://paste.rfeyn.org
    # If you're running a self hosted instance and wish to serve public memory
    # shares, set this to the URL where your memories web app is running.
    public-memories: https://memories.rfeyn.org
    cast: https://cast.rfeyn.org
    embed-albums: https://embed.rfeyn.org
    # Set this to the URL where your accounts web app is running, primarily used for
    # passkey based 2FA.
    accounts: https://accounts.rfeyn.org
    # Set this to the URL where your legacy recovery web app is running.
    legacy: https://legacy.rfeyn.org


# Key used for encrypting customer emails before storing them in DB
#
# To make it easy to get started, some randomly generated (but fixed) values are
# provided here. But if you're really going to be using museum, please generate
# new keys. You can use `go run tools/gen-random-keys/main.go` for that.
#
# Replace values in key and JWT for security
key:
    encryption: yvmG/RnzKrbCb9L3mgsmoxXr9H7i2Z4qlbT0mL3ln4w=
    hash: KXYiG07wC7GIgvCSdg+WmyWdXDAn6XKYJtp/wkEU7x573+byBRAYtpTP0wwvi8i/4l37uicX1dVTUzwH3sLZyw==
# JWT secrets
jwt:
    secret: i2DecQmfGreG6q1vBj5tCokhlN41gcfS2cjOs9Po-u8=