Install my certificate on PhotoPrism

[AlexanderPanshin]

Greetings comrades, I need your help.
I want to install my certificate on PhotoPrism.
The essence of the problem is this: I have my own server, I have a lot of services running on it, a web server, open fire and the like.
The domain is parked to the server swap.mysuperpain.com Certificates have been received through cerbot and are on the way
/etc/letsencrypt/live/swap.mysuperpain.com/
there are 4 files there

cert.pem
chain.pem
fullchain.pem
privkey.pem

The instructions say:

To use your own certificates, you can add a custom TLS certificate and private key to the storage/config/certificates folder with the filenames www.example.com.crt and www.example.com.key, replacing www.example.com with the actual server domain.

To do this, I convert my pem certificates to crt and key
Commands:
openssl x509 -outform der -in fullchain.pem -out swap.mysuperpain.com.crt openssl rsa -outform der -in privkey.pem -out swap.mysuperpain.com.key
I install PhotoPrism via docker compose here is the configuration file of the following:

version: '3.5'


services:
photoprism:
image: photoprism/photoprism:latest
stop_grace_period: 10s
depends_on:
- mariadb
security_opt:
- seccomp:unconfined
- apparmor:unconfined
ports:
- "2342:2342"
environment:
PHOTOPRISM_ADMIN_USER: "admin" # admin login username
PHOTOPRISM_ADMIN_PASSWORD: "insecure" # initial admin password (8-72 characters)
PHOTOPRISM_AUTH_MODE: "password" # authentication mode (public, password)
PHOTOPRISM_SITE_URL: "https://swap.mysuperpain.com:2342/" # server URL in the format "http(s)://domain.name(:port)/(path)"
PHOTOPRISM_HTTPS=true:
PHOTOPRISM_TLS_CERT: "swap.mysuperpain.com.crt"
PHOTOPRISM_TLS_KEY: "swap.mysuperpain.com.key"
PHOTOPRISM_INIT: "https"
PHOTOPRISM_DISABLE_TLS: "false" # disables HTTPS/TLS even if the site URL starts with https:// and a certificate is available
PHOTOPRISM_DEFAULT_TLS: "true" # defaults to a self-signed HTTPS/TLS certificate if no other certificate is available
PHOTOPRISM_ORIGINALS_LIMIT: 5000 # file size limit for originals in MB (increase for high-res video)
PHOTOPRISM_HTTP_COMPRESSION: "gzip" # improves transfer speed and bandwidth utilization (none or gzip)
PHOTOPRISM_LOG_LEVEL: "info" # log level: trace, debug, info, warning, error, fatal, or panic
PHOTOPRISM_READONLY: "false" # do not modify originals directory (reduced functionality)
PHOTOPRISM_EXPERIMENTAL: "false" # enables experimental features
PHOTOPRISM_DISABLE_CHOWN: "false" # disables updating storage permissions via chmod and chown on startup
PHOTOPRISM_DISABLE_WEBDAV: "false" # disables built-in WebDAV server
PHOTOPRISM_DISABLE_SETTINGS: "false" # disables settings UI and API
PHOTOPRISM_DISABLE_TENSORFLOW: "false" # disables all features depending on TensorFlow
PHOTOPRISM_DISABLE_FACES: "false" # disables face detection and recognition (requires TensorFlow)
PHOTOPRISM_DISABLE_CLASSIFICATION: "false" # disables image classification (requires TensorFlow)
PHOTOPRISM_DISABLE_VECTORS: "false" # disables vector graphics support
PHOTOPRISM_DISABLE_RAW: "false" # disables indexing and conversion of RAW images
PHOTOPRISM_RAW_PRESETS: "false" # enables applying user presets when converting RAW images (reduces performance)
PHOTOPRISM_JPEG_QUALITY: 85 # a higher value increases the quality and file size of JPEG images and thumbnails (25-100)
PHOTOPRISM_DETECT_NSFW: "false" # automatically flags photos as private that MAY be offensive (requires TensorFlow)
PHOTOPRISM_UPLOAD_NSFW: "true" # allows uploads that MAY be offensive (no effect without TensorFlow)
PHOTOPRISM_DATABASE_DRIVER: "mysql" # use MariaDB 10.5+ or MySQL 8+ instead of SQLite for improved performance
PHOTOPRISM_DATABASE_SERVER: "mariadb:3306" # MariaDB or MySQL database server (hostname:port)
PHOTOPRISM_DATABASE_NAME: "photoprism" # MariaDB or MySQL database schema name
PHOTOPRISM_DATABASE_USER: "test" # MariaDB or MySQL database user name
PHOTOPRISM_DATABASE_PASSWORD: "test1234" # MariaDB or MySQL database user password
PHOTOPRISM_SITE_CAPTION: "AI-Powered Photos App"
PHOTOPRISM_SITE_DESCRIPTION: "" # meta site description
PHOTOPRISM_SITE_AUTHOR: "" # meta site author
working_dir: "/photoprism" # do not change or remove
volumes:
- "/srv/dev-disk-by-uuid-7/photoprisma/photo:/photoprism/originals" # Original media files (DO NOT REMOVE)
- "/srv/dev-disk-by-uuid-7/photoprisma/import:/photoprism/import" # *Optional* base folder from which files can be imported to originals
- "/srv/dev-disk-by-uuid-7/photoprisma/data:/photoprism/storage" # *Writable* storage folder for cache, database, and sidecar files (DO NOT REMOVE)

mariadb:
image: mariadb:11
restart: unless-stopped
stop_grace_period: 5s
security_opt: # see https://github.com/MariaDB/mariadb-docker/issues/434#issuecomment-1136151239
- seccomp:unconfined
- apparmor:unconfined
command: --innodb-buffer-pool-size=512M --transaction-isolation=READ-COMMITTED --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci --max-connections=512 --innodb-rollback-on-timeout=OFF --innodb-lock-wait-timeout=120
volumes:
- "./database:/var/lib/mysql" # DO NOT REMOVE
environment:
MARIADB_AUTO_UPGRADE: "1"
MARIADB_INITDB_SKIP_TZINFO: "1"
MARIADB_DATABASE: "photoprism"
MARIADB_USER: "test"
MARIADB_PASSWORD: "test1234"
MARIADB_ROOT_PASSWORD: "test1234"

watchtower:
restart: unless-stopped
image: containrrr/watchtower
profiles: ["update"]
environment:
WATCHTOWER_CLEANUP: "true"
WATCHTOWER_POLL_INTERVAL: 7200 # checks for updates every two hours
volumes:
- "/var/run/docker.sock:/var/run/docker.sock"
- "~/.docker/config.json:/config.json" # optional, for authentication if you have a Docker Hub account

I copy the certificates to

/srv/dev-disk-by-uuid-7/photoprisma/data/storage/config/certificates/

so there are 2 files there

swap.mysuperpain.com.crt and swap.mysuperpain.com.key

but then the default PhotoPrism certificate is loaded, and not mine, of course, this is not what I wanted.

I tried changing the name of certificates in the folder /srv/dev-disk-by-uuid-7/photoprisma/data/storage/config/certificates/ and configurations to

swap.mysuperpain.com:2342.crt
swap.mysuperpain.com:2342.key
or
site.crt
site.key

I had a thought, I specified the full path to the pem certificate in the configuration file

PHOTOPRISM_HTTPS_CERT="/etc/letsencrypt/live/swap.mysuperpain.com/fullchain.pem"
PHOTOPRISM_HTTPS_KEY="/etc/letsencrypt/live/swap.mysuperpain.com/privkey.pem"

But the result is always the same. I get not my own certificate, but the default PhotoPrism certificate. Please tell me where I make a mistake.

[lastzero]

Certificate and key should both be in pem format. We can't use pem as file extension for both, so we use crt for the certificate and key for the private key - following the conversation that the Lego CLI command uses.

[lastzero]

If the files are in the certificates folder, don't specify a path with it, just the filenames.

[lastzero]

And make sure to check the logs, in trace mode if needed as described in our documentation.

[AlexanderPanshin]

Now there are two files in the folder, here is the output

root@swap:/srv/dev-disk-by-uuid-7/photoprisma/data/storage/config/certificates# ls
swap.mysuperpain.com.crt swap.mysuperpain.com.key

in the configuration file

PHOTOPRISM_HTTPS_CERT="swap.mysuperpain.com.crt"
PHOTOPRISM_HTTPS_KEY="swap.mysuperpain.com.key"

I reboot the service, but the default PhotoPrism certificate is loaded as before.
I think maybe I didn't convert the certificates correctly.

openssl x509 -outform der -in fullchain.pem -out swap.mysuperpain.com.crt
openssl rsa -outform der -in privkey.pem -out swap.mysuperpain.com.key

I also tried using cert.pem instead of fullchain .pem but the result is the same.
Could you please provide a link to the documentation on trace mode?

[lastzero]

You mounted data to storage, so in that case the path is data/config/certificates. I would recommend using the same base path names on the host as in the container since that makes it easier for you to follow the documentation.

[AlexanderPanshin]

Thanks for the answer lastzero. Your advice helped me.
Firstly. I changed the path to
With
- "/srv/dev-disk-by-uuid-7/photoprisma/data:/photoprism/storage"
on
- "/srv/dev-disk-by-uuid-7/photoprisma/storage:/photoprism/storage"
in settings

PHOTOPRISM_HTTPS_CERT="swap.mysuperpain.com.crt"
PHOTOPRISM_HTTPS_KEY="swap.mysuperpain.com.key"

The page stopped loading completely. But this was already progress.
Then I uploaded it to the folder
/srv/dev-disk-by-uuid-7/photoprisma/storage/config/certificates/
files fullchain.pem and privkey.pem from the letsencrypt folder
/etc/letsencrypt/live/swap.mysuperpain.com/
and changed it in the settings

PHOTOPRISM_TLS_CERT: "fullchain.pem"
PHOTOPRISM_TLS_KEY: "privkey.pem"

The words in the instructions are somewhat misleading
To use your own certificates, you can add a custom TLS certificate and private key to the storage/config/certificates folder with the filenames www.example.com.crt and www.example.com.key, replacing www.example.com with the actual server domain.
it seems that you need to convert certificates into key and crt, in fact you can use pem