PhotoPrism with Docker Compose

What PhotoPrism needs

Only figures PhotoPrism's own documentation publishes, each linked to the page it is on. Where the project gives no number, this page does not invent one.

On top of this, Caddy (the reverse proxy in the file) is a single small container. PhotoPrism itself runs as 2 containers: photoprism, photoprism-mariadb.

docker-compose.yml

This is exactly what the builder writes for PhotoPrism alone on example.org: the official definition with its published ports removed and Caddy added in front. Every ${VARIABLE} is defined in the .env below.

# docker-compose.yml built at dankhost.com for: PhotoPrism
# Each app block is its official compose definition. Only the names were prefixed with
# the app slug (services, containers, volumes, bind folders, .env variables) so any set of
# apps can share one file; other differences are listed under "Changed:" in each block.
# Only Caddy publishes ports. Secrets live in .env next to this file.

services:
  # ---- Caddy: the one reverse proxy, HTTPS certificates from Let's Encrypt ----
  # Source: https://caddyserver.com/docs/running (checked 2026-09-23)
  # Source: https://github.com/dani-garcia/vaultwarden/wiki/Using-Docker-Compose (checked 2026-09-23)
  # Caddyfile goes in ./caddy/Caddyfile. Fixed address 172.30.0.2 so apps can trust it exactly.
  caddy:
    image: "caddy:2"
    container_name: "caddy"
    restart: "unless-stopped"
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    volumes:
      - "./caddy:/etc/caddy"
      - "caddy-data:/data"
      - "caddy-config:/config"
    networks:
      proxy:
        ipv4_address: "172.30.0.2"

  # ---- PhotoPrism (gallery.example.org) ----
  # Source: https://docs.photoprism.app/getting-started/docker-compose/ (checked 2026-09-23)
  # Source: https://dl.photoprism.app/docker/compose.yaml (checked 2026-09-23)
  # Source: https://docs.photoprism.app/getting-started/proxies/caddy-2/ (checked 2026-09-23)
  # Changed: Removed the documented '2342:2342' port; Caddy reaches photoprism:2342 on the proxy network.
  #          PHOTOPRISM_DISABLE_TLS is "true" and PHOTOPRISM_SITE_URL is your https address, as PhotoPrism's Caddy page says (Caddy terminates HTTPS); added PHOTOPRISM_TRUSTED_PROXY, set to Caddy's fixed address, from the same page.
  #          The four documented 'insecure' passwords (admin, database user in both services, database root) are replaced by generated ones.
  #          The documented originals folder ~/Pictures becomes ./photoprism/originals; point it at your photos by editing that line.
  #          The optional ollama, open-webui and watchtower services, which the file only starts under compose profiles, are left out, and so are OLLAMA_BASE_URL and OLLAMA_API_KEY, which only point at them. Numeric values are written as strings, which Compose treats the same.
  photoprism:
    image: "photoprism/photoprism:latest"
    container_name: "photoprism"
    stop_grace_period: "15s"
    depends_on:
      - "photoprism-mariadb"
    security_opt:
      - "seccomp:unconfined"
      - "apparmor:unconfined"
    environment:
      PHOTOPRISM_ADMIN_USER: "admin"
      PHOTOPRISM_ADMIN_PASSWORD: "${PHOTOPRISM_ADMIN_PASSWORD}"
      PHOTOPRISM_AUTH_MODE: "password"
      PHOTOPRISM_DISABLE_TLS: "true"
      PHOTOPRISM_DEFAULT_TLS: "true"
      PHOTOPRISM_TRUSTED_PROXY: "172.30.0.2"
      PHOTOPRISM_DEFAULT_LOCALE: "en"
      PHOTOPRISM_PLACES_LOCALE: "local"
      PHOTOPRISM_SITE_URL: "https://gallery.example.org/"
      PHOTOPRISM_SITE_NAME: ""
      PHOTOPRISM_SITE_TITLE: "PhotoPrism"
      PHOTOPRISM_SITE_CAPTION: "AI-Powered Photos App"
      PHOTOPRISM_SITE_DESCRIPTION: ""
      PHOTOPRISM_SITE_AUTHOR: ""
      PHOTOPRISM_LOG_LEVEL: "info"
      PHOTOPRISM_READONLY: "false"
      PHOTOPRISM_EXPERIMENTAL: "false"
      PHOTOPRISM_DISABLE_CHOWN: "false"
      PHOTOPRISM_DISABLE_WEBDAV: "false"
      PHOTOPRISM_DISABLE_MCP: "false"
      PHOTOPRISM_DISABLE_SETTINGS: "false"
      PHOTOPRISM_DISABLE_TENSORFLOW: "false"
      PHOTOPRISM_DISABLE_FACES: "false"
      PHOTOPRISM_DISABLE_CLASSIFICATION: "false"
      PHOTOPRISM_DISABLE_VECTORS: "false"
      PHOTOPRISM_DISABLE_RAW: "false"
      PHOTOPRISM_RAW_PRESETS: "false"
      PHOTOPRISM_SIDECAR_YAML: "true"
      PHOTOPRISM_BACKUP_ALBUMS: "true"
      PHOTOPRISM_BACKUP_DATABASE: "true"
      PHOTOPRISM_BACKUP_SCHEDULE: "daily"
      PHOTOPRISM_INDEX_SCHEDULE: ""
      PHOTOPRISM_AUTO_INDEX: "300"
      PHOTOPRISM_AUTO_IMPORT: "-1"
      PHOTOPRISM_DETECT_NSFW: "false"
      PHOTOPRISM_UPLOAD_NSFW: "true"
      PHOTOPRISM_XMP_FACES: "true"
      PHOTOPRISM_UPLOAD_ALLOW: ""
      PHOTOPRISM_UPLOAD_ARCHIVES: "true"
      PHOTOPRISM_UPLOAD_LIMIT: "5000"
      PHOTOPRISM_ORIGINALS_LIMIT: "5000"
      PHOTOPRISM_HTTP_COMPRESSION: "zstd,gzip"
      PHOTOPRISM_DATABASE_DRIVER: "mysql"
      PHOTOPRISM_DATABASE_SERVER: "mariadb:3306"
      PHOTOPRISM_DATABASE_NAME: "photoprism"
      PHOTOPRISM_DATABASE_USER: "photoprism"
      PHOTOPRISM_DATABASE_PASSWORD: "${PHOTOPRISM_DB_PASSWORD}"
      PHOTOPRISM_INIT: "https tensorflow"
      PHOTOPRISM_VISION_API: "false"
      PHOTOPRISM_VISION_URI: ""
      PHOTOPRISM_VISION_KEY: ""
    working_dir: "/photoprism"
    volumes:
      - "./photoprism/originals:/photoprism/originals"
      - "./photoprism/storage:/photoprism/storage"
    networks:
      proxy: {}
      photoprism-backend: {}
  photoprism-mariadb:
    image: "mariadb:12.3"
    container_name: "photoprism-mariadb"
    restart: "unless-stopped"
    stop_grace_period: "15s"
    security_opt:
      - "seccomp:unconfined"
      - "apparmor:unconfined"
    command: "--innodb-buffer-pool-size=512M --transaction-isolation=READ-COMMITTED --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci --max-connections=512 --innodb-rollback-on-timeout=OFF --innodb-lock-wait-timeout=120"
    volumes:
      - "./photoprism/database:/var/lib/mysql"
    environment:
      MARIADB_AUTO_UPGRADE: "1"
      MARIADB_INITDB_SKIP_TZINFO: "1"
      MARIADB_DATABASE: "photoprism"
      MARIADB_USER: "photoprism"
      MARIADB_PASSWORD: "${PHOTOPRISM_DB_PASSWORD}"
      MARIADB_ROOT_PASSWORD: "${PHOTOPRISM_DB_ROOT_PASSWORD}"
    networks:
      photoprism-backend:
        aliases:
          - "mariadb"

networks:
  # Pinned so the trusted-proxy address given to each app (172.30.0.2) is exact.
  # If "docker compose up" reports "Pool overlaps", change 172.30.0 here, in Caddy's
  # ipv4_address and in every trusted-proxy value to a free 172.x.0 range.
  proxy:
    ipam:
      config:
        - subnet: "172.30.0.0/24"
          ip_range: "172.30.0.128/25"
          gateway: "172.30.0.1"
  photoprism-backend:
    internal: true

volumes:
  caddy-data:
  caddy-config:

Caddyfile save as caddy/Caddyfile

Caddy gets and renews the HTTPS certificate for gallery.example.org by itself once the DNS record points at your server and ports 80 and 443 reach it.

# Caddyfile built at dankhost.com. Save it as ./caddy/Caddyfile next to docker-compose.yml.
# Caddy gets and renews a Let's Encrypt certificate for each name below by itself,
# once the DNS records point at this server and ports 80 and 443 reach it.

# PhotoPrism
gallery.example.org {
	encode zstd gzip
	reverse_proxy photoprism:2342 {
		flush_interval -1
	}
}

.env

The secrets are left blank here on purpose: a password printed on a public page is the same for everyone who copies it. The builder fills them with random letters and digits made in your browser.

# .env for PhotoPrism, from dankhost.com/app/photoprism/. Fill the blank secrets before starting.
# Keep this file private (chmod 600).

# PhotoPrism
# 24 random letters and digits: the builder fills this in your browser
PHOTOPRISM_ADMIN_PASSWORD=
# 32 random letters and digits: the builder fills this in your browser
PHOTOPRISM_DB_PASSWORD=
# 32 random letters and digits: the builder fills this in your browser
PHOTOPRISM_DB_ROOT_PASSWORD=

Changes from the official file

Besides prefixing every service, container, volume, folder and variable with photoprism (so any set of apps can share one file), these are all the differences from what the project documents:

• Removed the documented '2342:2342' port; Caddy reaches photoprism:2342 on the proxy network.
• PHOTOPRISM_DISABLE_TLS is "true" and PHOTOPRISM_SITE_URL is your https address, as PhotoPrism's Caddy page says (Caddy terminates HTTPS); added PHOTOPRISM_TRUSTED_PROXY, set to Caddy's fixed address, from the same page.
• The four documented 'insecure' passwords (admin, database user in both services, database root) are replaced by generated ones.
• The documented originals folder ~/Pictures becomes ./photoprism/originals; point it at your photos by editing that line.
• The optional ollama, open-webui and watchtower services, which the file only starts under compose profiles, are left out, and so are OLLAMA_BASE_URL and OLLAMA_API_KEY, which only point at them. Numeric values are written as strings, which Compose treats the same.

Notes for PhotoPrism behind the proxy

• Log in as 'admin' with PHOTOPRISM_ADMIN_PASSWORD from .env. PhotoPrism uses it only on the first start; change it later in the app.
• The Caddyfile's 'encode zstd gzip' and 'flush_interval -1' (stream uploads) are from PhotoPrism's Caddy example.
• PhotoPrism has no restart policy in the documented file (MariaDB has one), so after a reboot run 'docker compose up -d' again or add restart: unless-stopped to the photoprism service.
• Indexing is heavy: the first scan of a large library can take hours and needs the RAM and swap in the requirements above.

Back it up

PhotoPrism: a backup needs at least the originals folder and a copy of the index database; the storage folder too, so thumbnails, sidecar files and configuration need not be rebuilt. Its backup command dumps the MariaDB database into storage/backup/mysql/.

Below is the BACKUP.md the builder writes next to the compose file above: which of its folders and volumes hold data, the dump command the project documents, rewritten for this file's service names, what to copy with which container stopped, and a restore check. Pick more apps in the builder and it covers them all in one file.

# BACKUP.md built at dankhost.com for: PhotoPrism

What to copy from the docker-compose.yml built with this file, the database dump each project documents (rewritten for the service names in that file), what to copy with which container stopped, and how to check the result. Run every command in the folder that holds docker-compose.yml.

The folders are owned by the containers' users: put sudo in front of tar if it says "Permission denied". Named volumes live under /var/lib/docker/volumes, not next to the compose file, so they are copied through a throwaway ubuntu container (Docker's documented --volumes-from method). tar makes a full copy each run; for large folders an incremental tool (restic, borg, rsync) saves time and space.

Never run "docker compose down -v" on this file: it deletes the named volumes of every app in it.

## Before you start

    BACKUP=/mnt/backup/selfhost   # change this: a disk or machine other than this server's system disk
    mkdir -p "$BACKUP"

## Every time: the three stack files

    tar czf "$BACKUP/stack-files.tar.gz" docker-compose.yml .env caddy

.env holds the database passwords and secret keys the apps were set up with; keep this archive as private as the data.

## Caddy (the reverse proxy)

Caddy's docs: 'The data directory must not be treated as a cache.' It holds the TLS certificates and their private keys; without it Caddy has to ask Let's Encrypt for every certificate again.

- caddy-data (named volume, /data in caddy)
  BACK UP: TLS certificates, private keys, OCSP staples.
- caddy-config (named volume, /config in caddy)
  SKIP: the last active configuration, kept for 'caddy run --resume', which this setup does not use: it starts from the Caddyfile.
- ./caddy (/etc/caddy in caddy)
  IN stack-files.tar.gz: the Caddyfile, copied with the stack files above.

Copy (Caddy keeps serving while you copy):

    docker run --rm --volumes-from caddy -v "$BACKUP":/backup ubuntu tar cvf /backup/caddy-data.tar /data

Restore check:

    tar tf "$BACKUP/caddy-data.tar" > /dev/null && echo OK
    docker run --rm --volumes-from caddy -v "$BACKUP":/backup ubuntu bash -c "cd /data && tar xvf /backup/caddy-data.tar --strip 1"

Sources:
- Caddy docs: Conventions, Data directory: https://caddyserver.com/docs/conventions#data-directory (checked 2026-09-24)
- Docker docs: Volumes, Back up, restore, or migrate data volumes: https://docs.docker.com/engine/storage/volumes/#back-up-restore-or-migrate-data-volumes (checked 2026-09-24)

## PhotoPrism

PhotoPrism: a backup needs at least the originals folder and a copy of the index database; the storage folder too, so thumbnails, sidecar files and configuration need not be rebuilt. Its backup command dumps the MariaDB database into storage/backup/mysql/.

What this compose mounts:
- ./photoprism/originals (/photoprism/originals in photoprism)
  BACK UP: your photos and videos, unmodified.
- ./photoprism/storage (/photoprism/storage in photoprism)
  BACK UP: configuration, cache, thumbnails, sidecar files and backup/ with the SQL dumps.
- ./photoprism/database (/var/lib/mysql in photoprism-mariadb)
  COVERED BY THE COMMAND BELOW: MariaDB data files; copy them only with the database stopped.

1. Database dump for photoprism-mariadb (runs in photoprism):

    docker compose exec -T photoprism photoprism backup -i -f

   The documented Docker Compose command. It writes ./photoprism/storage/backup/mysql/<date>.sql (-f overwrites today's), which travels in the storage copy below. This compose also keeps PhotoPrism's daily scheduled dumps on (PHOTOPRISM_BACKUP_DATABASE), three kept by default.

2. Copy (PhotoPrism keeps running):
   PhotoPrism says to run its backup command and then copy originals and storage with any file backup tool; it does not ask you to stop it.

    tar czf "$BACKUP/photoprism-originals.tar.gz" ./photoprism/originals
    tar czf "$BACKUP/photoprism-storage.tar.gz" ./photoprism/storage

Restore check:

    ls -l ./photoprism/storage/backup/mysql/   # today's <date>.sql, not empty
    tar tzf "$BACKUP/photoprism-originals.tar.gz" > /dev/null && echo OK
    tar tzf "$BACKUP/photoprism-storage.tar.gz" > /dev/null && echo OK

Put a copy back (with PhotoPrism stopped):

    tar xzf "$BACKUP/photoprism-originals.tar.gz"   # recreates ./photoprism/originals; move the old folder aside first
    tar xzf "$BACKUP/photoprism-storage.tar.gz"   # recreates ./photoprism/storage; move the old folder aside first

Put ./photoprism/originals and ./photoprism/storage back first, then restore the index from the newest dump:

    docker compose exec -T photoprism photoprism restore -i -f

Restoring also brings back the user accounts and passwords stored in the index.

Sources:
- PhotoPrism docs: Creating Backups: https://docs.photoprism.app/user-guide/backups/ (checked 2026-09-24)
- PhotoPrism docs: Restoring Backups: https://docs.photoprism.app/user-guide/backups/restore/ (checked 2026-09-24)

Sources

Every page below was fetched on the date shown.

• PhotoPrism README checked 2026-09-23 (what it does)
• PhotoPrism docs: Getting Started (System Requirements) checked 2026-09-23 (hardware requirements)
• PhotoPrism docs: Setup Using Docker Compose checked 2026-09-23 (compose definition and proxy settings)
• PhotoPrism: compose.yaml (the file the setup guide downloads) checked 2026-09-23 (compose definition and proxy settings)
• PhotoPrism docs: Using Caddy 2 as Reverse Proxy (DISABLE_TLS, TRUSTED_PROXY, Caddyfile) checked 2026-09-23 (compose definition and proxy settings)
• Caddy docs: Keep Caddy running (Docker Compose section) checked 2026-09-23 (Caddy)
• Vaultwarden wiki: Caddy with HTTP challenge (uses the caddy:2 image) checked 2026-09-23 (Caddy)
• PhotoPrism docs: Creating Backups checked 2026-09-24 (backup plan)
• PhotoPrism docs: Restoring Backups checked 2026-09-24 (backup plan)
• Caddy docs: Conventions, Data directory checked 2026-09-24 (backup plan)
• Docker docs: Volumes, Back up, restore, or migrate data volumes checked 2026-09-24 (backup plan)

Add PhotoPrism to the builder All twenty apps