#  USING LET'S ENCRYPT HTTPS
#  -------------------------------------------------------------------------
#
#  If your server has a public domain name, please disable the self-signed
#  certificate and enable domain based routing in compose.yaml and
#  traefik.yaml (see inline instructions in !! UPPERCASE !!)
#
#    ssh root@<YOUR SERVER IP>
#    cd /opt/photoprism
#    nano compose.yaml
#    nano traefik.yaml
#    docker compose stop
#    docker compose up -d
#
#  You should now be able to access your instance without security warnings.
#  -------------------------------------------------------------------------

# set to DEBUG to enable debug mode
log:
  level: INFO

# disable telemetry
global:
  sendAnonymousUsage: false

# allow to proxy services with self-signed certificates
serversTransport:
  insecureSkipVerify: true
  # !! REMOVE when using Let's Encrypt HTTPS !!
  rootCAs:
    - "/certs/ca.crt"

# open ports and protocols (HTTP will be redirected to HTTPS)
entryPoints:
  web:
    address: ":80"
    http:
      # Set every option explicitly: Traefik changed these defaults within the v3.6 patch
      # series, so relying on them means the behaviour can change under you.
      # See https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#encoded-characters
      encodedCharacters:
        allowEncodedSlash: true
        allowEncodedPercent: true
        allowEncodedHash: true
        allowEncodedQuestionMark: true
        allowEncodedSemicolon: true
        allowEncodedBackSlash: true
        allowEncodedNullCharacter: true
      redirections:
        entryPoint:
          to: websecure
          scheme: https
    transport:
      respondingTimeouts:
        readTimeout: "3h"
        writeTimeout: "0s"
        idleTimeout: "3m"
  websecure:
    address: ":443"
    http:
      # Set every option explicitly: Traefik changed these defaults within the v3.6 patch
      # series, so relying on them means the behaviour can change under you.
      # See https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#encoded-characters
      encodedCharacters:
        allowEncodedSlash: true
        allowEncodedPercent: true
        allowEncodedHash: true
        allowEncodedQuestionMark: true
        allowEncodedSemicolon: true
        allowEncodedBackSlash: true
        allowEncodedNullCharacter: true
    transport:
      respondingTimeouts:
        readTimeout: "3h"
        writeTimeout: "0s"
        idleTimeout: "3m"

# auto tls / https
certificatesResolvers:
  myresolver:
    # See https://doc.traefik.io/traefik/https/acme/
    acme:
      # !! REPLACE "info@yourdomain.com" with your actual email address for Let's Encrypt HTTPS !!
      email: info@yourdomain.com
      storage: /data/letsencrypt.json
      httpChallenge:
        entryPoint: web

# config providers
providers:
  # !! REMOVE file provider when using Let's Encrypt HTTPS !!
  file:
    filename: "/certs/config.yml"
    watch: true
  # always keep this
  docker:
    exposedByDefault: false
    watch: true

# disable dashboard and api
api:
  insecure: false
  dashboard: false