Enable self-hosting on Synology NAS

[StefanOltmann]

I'd like to self host ente on my Synology DS920+ withing the Container Manager and noticed here several problems.

First you can't have a container use the official 5432 port. This must be remapped to something else to not collide with the internal Postgres of Synology DSM:

  postgres:
    image: postgres:15
    ports:
      - 5433:5433
    environment:
      POSTGRES_USER: pguser
      POSTGRES_PASSWORD: pgpass
      POSTGRES_DB: ente_db
      PGPORT: 5433
    # Wait for postgres to be accept connections before starting museum.
    healthcheck:
      test:
        [
          "CMD",
          "pg_isready",
          "-q",
          "-d",
          "ente_db",
          "-U",
          "pguser",
          "-p",
          "5433"
        ]
      start_period: 40s
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - internal

After that I noticed I can't change the password "pgpass" for Postgres or museum won't start up.

And lastly Synology doesn't have a proper volume support. It would be great to change that in a way that all data is actually written to the "data" mount point.

I managed to start my instance, but the "data" folder is empty.

Would be great if you could make this working smooth with Synology NAS.

[thisislawatts]

hey @StefanOltmann. Thanks for raising this, I have a Synology device on order.

Regarding: First you can't have a container use the official 5432 port. This must be remapped to something else to not collide with the internal Postgres of Synology DSM

Have you looked into overriding the port using an environment variable?

# Environment variables
# ---------------------
#
# All configuration options can be overridden via environment variables. The
# environment variable should have the prefix "ENTE_", and any nesting should be
# replaced by underscores.
#
# For example, the nested string "db.user" in the config file can alternatively
# be specified (or be overridden) by setting an environment variable named
# ENTE_DB_USER.

source: https://github.com/ente-io/ente/blob/main/server/configurations/local.yaml#L18-L27

[StefanOltmann]

It worked with the PGPORT: 5433 I shared.

My suggestion is changing the default port, so it will run on Synology out of the box.

[StefanOltmann]

I really don't get why it's so hard to self host Ente.

My intention was to set it up again in a clean way and document that for others, but the system doesn't work.

What I wanted to change here is:

• Using a custom Postgres port, because the default one is already used.
• Use local folders instead of volumes, because volumes don't work that great on Synology.
• Use better passwords than just test and testtest (even if the services are not reachable)

The empty folders exist and I can start up the system and register, but it won't upload files.
There is no error message, it just stucks.

minio-provision spams mc: <ERROR> Unable to initialize new alias from the provided credentials.

---

compose.yml:

services:
  museum:
    image: ghcr.io/ente-io/server
    ports:
      - 8080:8080 # API
      - 2112:2112 # Prometheus metrics
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      # Pass-in the config to connect to the DB and MinIO
      ENTE_CREDENTIALS_FILE: /credentials.yaml
    volumes:
      - /volume1/docker/ente-io/credentials.yaml:/credentials.yaml:ro
      - /volume1/docker/ente-io/custom-logs:/var/logs:rw
      # - /volume1/docker/ente-io/museum.yaml:/museum.yaml:ro
    networks:
      - internal

  # Resolve "localhost:3200" in the museum container to the minio container.
  socat:
    image: alpine/socat
    network_mode: service:museum
    depends_on:
      - museum
    command: "TCP-LISTEN:3200,fork,reuseaddr TCP:minio:3200"

  postgres:
    image: postgres:15
    # Don't use the default port as this is already internally used on a Synology NAS.
    ports:
      - 5433:5433
    environment:
      POSTGRES_USER: ente
      POSTGRES_PASSWORD: fF5zqfidJn3CCBi
      POSTGRES_DB: ente_db
      PGPORT: 5433
    # Wait for postgres to be accept connections before starting museum.
    healthcheck:
      test:
        [
          "CMD",
          "pg_isready",
          "-q",
          "-d",
          "ente_db",
          "-U",
          "ente",
          "-p",
          "5433"
        ]
      start_period: 40s
    volumes:
      - /volume1/docker/ente-io/postgres-data:/var/lib/postgresql/data:rw
    networks:
      - internal

  minio:
    image: minio/minio
    # Use different ports than the minio defaults to avoid conflicting
    # with the ports used by Prometheus.
    ports:
      - 3200:3200 # API
      - 3201:3201 # Console
    environment:
      MINIO_ROOT_USER: ente
      MINIO_ROOT_PASSWORD: WSsc7d7s2MW8vYG
    command: server /data --address ":3200" --console-address ":3201"
    volumes:
      - /volume1/docker/ente-io/minio-data:/data:rw
    networks:
      - internal

  minio-provision:
    image: minio/mc
    depends_on:
      - minio
    volumes:
      - /volume1/docker/ente-io/minio-provision.sh:/minio-provision.sh:ro
      - /volume1/docker/ente-io/minio-data:/data:rw
    networks:
      - internal
    entrypoint: sh /minio-provision.sh

networks:
  internal:

credentials.yml:

db:
    host: postgres
    port: 5433
    name: ente_db
    user: ente
    password: fF5zqfidJn3CCBi

s3:
    are_local_buckets: true
    b2-eu-cen:
        key: ente
        secret: WSsc7d7s2MW8vYG
        endpoint: localhost:3200
        region: eu-central-2
        bucket: b2-eu-cen
    wasabi-eu-central-2-v3:
        key: ente
        secret: WSsc7d7s2MW8vYG
        endpoint: localhost:3200
        region: eu-central-2
        bucket: wasabi-eu-central-2-v3
        compliance: false
    scw-eu-fr-v3:
        key: ente
        secret: WSsc7d7s2MW8vYG
        endpoint: localhost:3200
        region: eu-central-2
        bucket: scw-eu-fr-v3

minio-provision.sh:

#!/bin/sh

# Script used to prepare the minio instance that runs as part of the development
# Docker compose cluster.

while ! mc config host add h0 http://minio:3200 ente WSsc7d7s2MW8vYG
do
   echo "waiting for minio..."
   sleep 0.5
done

cd /data

mc mb -p b2-eu-cen
mc mb -p wasabi-eu-central-2-v3
mc mb -p scw-eu-fr-v3

[mngshm]

The issue is with uploads, checkout https://help.ente.io/self-hosting/guides/configuring-s3.

1. Should always be fine, till you configure the postgres config properly in museum.yaml
2. I am not sure about this because we never said We support "Synology NAS", hence I've never tried getting ente to work on it.
3. Again this is never a big change.

What do you mean by Empty Folders ? Are they the empty folders in in MinIO UI you're seeing or is it somewhere else ?

The minio spam error should be ignorable. The reason why it fails is, minIO mc tool has this feature to alias your instance/bucket
to a alias name to ease up the process (regardless mc never felt simple to me). It fails to create an alias for the instance you have. Here, the commands

mc mb -p b2-eu-cen
mc mb -p wasabi-eu-central-2-v3
mc mb -p scw-eu-fr-v3

keep on failing. Most likely the credentials are wrong for the bucket in your config or dockerfile. I can't assure because on a normal setup these haven't failed for me (other than once, when I manually fixed it). Check all the credential related to minIO you've modified or changed. You can try fixing this manually as well by entering into the container and setting the appropriate alias manually. Checkout.

If museum doesn't have logs, javascript isn't going to hold it back :). You can always check whats happening in XHR logs.

[StefanOltmann]

@mngshm

Most likely the credentials are wrong for the bucket in your config or dockerfile

Oh, yes, that was it. I didn't get that this key and secret are the same as MINIO_ROOT_USER and MINIO_ROOT_PASSWORD. It's hard to tell, if everything is just test.

I suggest for clarity to change it in the template to miniouser and miniopass similar to pguser and pgpass to avoid confusion.

[StefanOltmann]

The minio-provision now has the expected logs and quits:

mc: <ERROR> Unable to initialize new alias from the provided credentials. Server not initialized yet, please try again.
waiting for minio...
Added `h0` successfully.
Bucket created successfully `b2-eu-cen`.
Bucket created successfully `wasabi-eu-central-2-v3`.
Bucket created successfully `scw-eu-fr-v3`.

But it still fails to upload.

I posted all my configuration above (now updated):
Do you spot anything that looks wrong to you and would explain the issue?

[mngshm]

Server not initialized yet, please try again.

Prime suspect. try doing a healthcheck on the minio endpoint. curl http://<host>:<minio server port>/minio/health/live -I. If the connect returns a 200 Status OK. Then minio should be working and the above error message doesn't make sense xD.

In the MinIO part of the config. I don't see the use_path_style_urls. I doubt this is anywhere a cause of problem, but yeah just a general thought which I'm putting out loud.

also share the minio container logs.

[StefanOltmann]

Oh... okay... it must not be localhost.

The template should really say <YOUR-WIFI-IP> so it's clear that this needs to be changed.

[mngshm]

Disagree with this. I feel this is mostly standardized, if you check any other self hosted application out there no one is asking you to access the web app or application over something other the localhost or domain.

No one writing the documentation or configuration wants to make a blatant guess of what network/host the user hosts the application on. Hence, we also do not want to complicate things more by specifying the host/network to access Ente over.

[StefanOltmann]

Yeah, but a placeholder like <YOUR-WIFI-IP> would have made it clear that there is something that needs to be changed. localhost:3200 could be as well have been the correct configuration if only museum (running on the same server) would need to access it and not also the client.

[StefanOltmann]

It still does not work for me. I'll try in a few months again.

[Shusek]

At what stage did you get stuck? I think I'm having the same issue as you—one of the steps doesn't seem to work properly, even though the logs don't indicate any errors. The difference is that I'm running it in Coolify.

[nank1ro]

Hey @Shusek were you able to run it successfully on coolify? In case could you share your config please?

[Shusek]

Yes, I will try to post it as a pull request or in the discussions on the weekend (inside coolify). The sample configuration shouldn't be as difficult as it currently is by the way.

[toxl]

Hi @StefanOltmann,
I am trying the same on a Synology DS224+ and I am not able to get it to work at all. Meanwhile any success for you?

[StefanOltmann]

I made it work once, but wasn’t able to set it up again.

[toxl]

Hi @StefanOltmann,

meanwhile I have it up and running but sill some errors in the container logs.

my "docker" folder is "/ente-io" and it contains the following manually generated folder:

• /custom-logs
• /data
• /minio-data
• /postgres-data

as well as the two yaml-files

• credentials.yaml
• museum.yaml

Note: This all needs to be there before compose.yaml is executed.

The docker compose file "compose.yaml" contains:

# compose.yaml (specifically to build latest ente via docker in synology container manager for DSM 7.2.2)

services:
  museum:
    image: ghcr.io/ente-io/server
    container_name: ente-museum
    restart: unless-stopped
    ports:
      - 8080:8080 # API
      #  - 2112:2112 # Prometheus metrics (comment in for status monitoring of server)
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      # Pass-in the config to connect to the DB and MinIO
      ENTE_CREDENTIALS_FILE: /credentials.yaml
      # ENTE_CLI_SECRETS_PATH: /cli-data/secret.txt
      # ENTE_CLI_CONFIG_PATH: /cli-data/
      # - PUID=1000
      # - PGID=1000
      # - TZ=DE
    volumes:
      - /volume1/docker/ente-io/credentials.yaml:/credentials.yaml:ro
      - /volume1/docker/ente-io/custom-logs:/var/logs
      - /volume1/docker/ente-io/museum.yaml:/museum.yaml:ro
      - /volume1/docker/ente-io/data:/data:ro
    networks:
      - ente


  # Resolve "localhost:3200" in the museum container to the minio container.
  socat:
    image: alpine/socat
    container_name: ente-socat
    restart: unless-stopped
    network_mode: service:museum
    depends_on: [museum]
    command: "TCP-LISTEN:3200,fork,reuseaddr TCP:minio:3200"

  web:
    image: ghcr.io/ente-io/web
    container_name: ente-web
    restart: unless-stopped
    # Uncomment what you need to tweak.
    ports:
      - 3000:3000 # Photos web app
      # - 3001:3001 # Accounts
      - 3002:3002 # Public albums
      # - 3003:3003 # Auth
      # - 3004:3004 # Cast
    # environment:
    #   ENTE_API_ORIGIN: http://localhost:8080
    #   ENTE_ALBUMS_ORIGIN: https://localhost:3002
    networks:
      - ente

  postgres:
    image: postgres:15  # :16 seems to be also working (but did not test it since ente scripts use all :15) 
    container_name: ente-postgres
    restart: unless-stopped
    ports:
      - 5433:5433 # default port: 5432 # changed since Synology NAS already internally used this port (use/check same in museum.yaml!)
    environment:
      POSTGRES_USER: pguser
      POSTGRES_PASSWORD: _my_secret_pguser_password_
      POSTGRES_DB: ente_db
      PGPORT: 5433 #default port: 5432
    # Wait for postgres to accept connections before starting museum.
    healthcheck:
      # Also do this with correct custom port option "-p xxxx"
      test: pg_isready -q -d ente_db -U pguser -p 5433
      start_period: 40s
      # start_interval: 1s  # start_interval property needs docker compose >=v2.30.0+ which synology does not yet provide. 
                            # Synology DSM v7.2.2. comes with Docker Engine v24.0.2 which runs "Docker Compose" v2.18.1
    volumes:
      #- postgres-data:/var/lib/postgresql/data
      - /volume1/docker/ente-io/postgres-data:/var/lib/postgresql/data
    networks:
      - ente


  minio:
    image: minio/minio
    container_name: ente-minio
    restart: unless-stopped
    ports:
      - 3200:3200 # MinIO API
      - 3201:3201 # MinIO Console
    environment:
      # MINIO_SERVER_URL: "http://minio.example.com/"
      # MINIO_BROWSER_REDIRECT_URL: "http://minio.example.com/console/"
      MINIO_ROOT_USER: minio_user_ente
      MINIO_ROOT_PASSWORD: _my_secret_minio_user_ente_password_
    command: server /data --address ":3200" --console-address ":3201"
    volumes:
      #- minio-data:/data
      - /volume1/docker/ente-io/minio-data:/data
      
    # post_start: # post_start property needs docker compose >=v2.30.0+ which synology does not provided. DSM v7.2.2. is at Docker Engine v24.0.2 which comes with compose v2.18.1
    #             # issue and workaround see here: https://help.ente.io/self-hosting/troubleshooting/docker
    #
    #post_start:
    #   - command: |
    #       sh -c '
    #       #!/bin/sh

    #      while ! mc config host add h0 http://minio:3200 minio_user_ente _my_secret_minio_user_ente_password_ 2>/dev/null
    #      do
    #        echo "Waiting for minio..."
    #        sleep 0.5
    #      done

    #      cd /data

    #      mc mb -p b2-eu-cen
    #      mc mb -p wasabi-eu-central-2-v3
    #      mc mb -p scw-eu-fr-v3
    #      '

    ###### once post_start is supported by synology comment above in and below out #######
    entrypoint: |
      sh -c '
      #!/bin/sh

      while ! mc config host add h0 http://minio:3200 minio_user_ente _my_secret_minio_user_ente_password_ 2>/dev/null
      do
        echo "waiting for minio..."
        sleep 0.5
      done

      cd /data

      mc mb -p b2-eu-cen
      mc mb -p wasabi-eu-central-2-v3
      mc mb -p scw-eu-fr-v3
      '
    ######################################################################################
    networks:
      - ente

networks:
  ente:
    # external: true

volumes:
  postgres-data:
  minio-data:

The " credentials.yaml" contains:

# credentials.yaml 
  # copy file with this content into setup folder where the compose.yaml will be
key:
      encryption: eGJKOFoyZ2FwMjN0ZzFnN0RqZlNydHVk # this key needs to be base64 and max(?) 32 char long and should be randomly populated via bash command: tr -dc A-Za-z0-9 </dev/urandom | base64 | head -c 32; echo
      hash: OTd4U1lWc3EzMWFSYzBEd0hSa1ZCb1VuYUlReDhsNnh2WGRJR3dIQ0tBTHJ2Y0dl # this hash needs to be base64 and max(?) 64 char long and should be randomly populated via bash command: tr -dc A-Za-z0-9 </dev/urandom | base64 | head -c 64; echo

jwt:
      secret: VkJJNTkzbk01QkRKVnFRYW9iclBFcUpS # this secret needs to be base64 and max (?) 32 chars long and should be randomly populated via bash command: tr -dc A-Za-z0-9 </dev/urandom | base64 | head -c 32; echo

db:
      host: postgres
      port: 5433 #default port: 5432
      # take identical postgres DB credential as in compose.yaml
        # POSTGRES_USER: pguser
        # POSTGRES_PASSWORD: _my_secret_pguser_password_
        # POSTGRES_DB: ente_db
      name: ente_db
      user: pguser
      password: _my_secret_pguser_password_

s3:
      are_local_buckets: true
      # use identical minio credentials as in compose.yaml
         #  MINIO_ROOT_USER: minio_user_ente
         #  MINIO_ROOT_PASSWORD: _my_secret_minio_user_ente_password_
      b2-eu-cen:
         key: minio_user_ente
         secret: _my_secret_minio_user_ente_password_
         endpoint: localhost:3200
         region: eu-central-2
         bucket: b2-eu-cen
      wasabi-eu-central-2-v3:
         key: minio_user_ente
         secret: _my_secret_minio_user_ente_password_
         endpoint: localhost:3200
         region: eu-central-2
         bucket: wasabi-eu-central-2-v3
         compliance: false
      scw-eu-fr-v3:
         key: minio_user_ente
         secret: _my_secret_minio_user_ente_password_
         endpoint: localhost:3200
         region: eu-central-2
         bucket: scw-eu-fr-v3

And "museum.yaml" contains:

# museum.yaml 
  # copy file with this content into setup folder where the compose.yaml will be
key:
      encryption: eGJKOFoyZ2FwMjN0ZzFnN0RqZlNydHVk # this key needs to be base64 and max(?) 32 char long and should be randomly populated via bash command: tr -dc A-Za-z0-9 </dev/urandom | base64 | head -c 32; echo
      hash: OTd4U1lWc3EzMWFSYzBEd0hSa1ZCb1VuYUlReDhsNnh2WGRJR3dIQ0tBTHJ2Y0dl # this hash needs to be base64 and max(?) 64 char long and should be randomly populated via bash command: tr -dc A-Za-z0-9 </dev/urandom | base64 | head -c 64; echo

jwt:
      secret: VkJJNTkzbk01QkRKVnFRYW9iclBFcUpS # this secret needs to be base64 and max (?) 32 chars long and should be randomly populated via bash command: tr -dc A-Za-z0-9 </dev/urandom | base64 | head -c 32; echo

db:
      host: postgres
      port: 5433 #default port: 5432
      # take identical postgres DB credential as in compose.yaml
        # POSTGRES_USER: pguser
        # POSTGRES_PASSWORD: _my_secret_pguser_password_
        # POSTGRES_DB: ente_db
      name: ente_db
      user: pguser
      password: _my_secret_pguser_password_

s3:
      are_local_buckets: true
      # use identical minio credentials as in compose.yaml
         #  MINIO_ROOT_USER: minio_user_ente
         #  MINIO_ROOT_PASSWORD: _my_secret_minio_user_ente_password_
      b2-eu-cen:
         key: minio_user_ente
         secret: _my_secret_minio_user_ente_password_
         endpoint: localhost:3200
         region: eu-central-2
         bucket: b2-eu-cen
      wasabi-eu-central-2-v3:
         key: minio_user_ente
         secret: _my_secret_minio_user_ente_password_
         endpoint: localhost:3200
         region: eu-central-2
         bucket: wasabi-eu-central-2-v3
         compliance: false
      scw-eu-fr-v3:
         key: minio_user_ente
         secret: _my_secret_minio_user_ente_password_
         endpoint: localhost:3200
         region: eu-central-2
         bucket: scw-eu-fr-v3

****NOTE:

1. credentials.yaml and museum.yaml are right now exactly identical since there are several variation variations floating around out there and I am not sure what is needed and required per each file at the moment - we will figure it out on the way)

2. I have started off, using the one-line-script provided by ente in this help post https://help.ente.io/self-hosting/. This link opens the bash script directly https://raw.githubusercontent.com/ente-io/ente/main/server/quickstart.sh

3. I have mixed and matched this with various sources including your compose.yaml above and content shared at the following sources: Tutorial - Deploy Ente.io as selfhosted instance #3778 // https://help.ente.io/self-hosting/troubleshooting/docker // Add example traefik-docker-compose.yaml #3663 // https://github.com/ente-io/ente/blob/main/server/compose.yaml

4. Resolved

   I am still seeing one issue in the log of the minio container where it returns two times per second: `2025/05/09 00:59:51,stdout,waiting for minio...` and it is also consuming some ~8% of CPU which seems to be a lot for being in idle and not accessed

   It is exactly doing what it told to do in the "compose.yaml" - so nothing to fix!

5. In the log of the museum container those two warnings might need some attention later too: [GIN-debug] [WARNING] You trusted all proxies, this is NOT safe. We recommend you to set a value. AND [GIN-debug] [WARNING] Running in "debug" mode. Switch to "release" mode in production.

The good news for today is, that I can access a local ente instance on http://:3000

I will try resolving the issue within minio.
Maybe someone here has some advice to get the minio issue tackled.

[mngshm]

WARNINGS are mostly safe to ignore.The warning regarding trusting proxies is largely ignorable if you're running a home network only setup.

[Themk2]

hi @toxl ,

Any update on the errors you had?

I'm literally a novice when it comes to linux coding and even worse trying to get that to integrate into Container Manager on Synology!

Also - where your credentials and museum files have encryption key, hash and secret - what do we do here? As I take it they're YOURs and we should have our own?

Thanks

[toxl]

@mngshm ,

Thanks for the reply, non the less, it would be useful to amend the example such that just the required ports are open. Is there any description on how to close all others properly?

[toxl]

@Themk2,

There are no errors, only warnings - so for testing the example should be good to go.

If you read the comments around the museum credentials you will notice that I have added the required command line example that enables all incld. newbies (like me and you) to generate the needed secrets and passwords securely.

I hope I do not have to state that you should do so (unless for a first local test) and in turne I will certainly not run any of my productive instances with those credentials ;-)

My aim is to get the above example + howto to level where everything is set and outlined such that it could be run in productive mode and open to the wild wild web!

Any contribution or support is much welcome here!

[Dob4115]

@toxl , thanks for your description. I

• created the folder structure
• created credential and museum yaml files (generating new keys)
• entered the compose file into portainer and ran it

and was able to see the login screen.

But I am getting a red box error around confirm password that says "something went wrong". My minio log just repeats "waiting for minio". You said you were having minio issues, did you ever resolve them? Were you able to create an account?