ente-cloudron/POSTINSTALL.md

Your Ente installation is almost ready!

Required: External Object Storage

Before using Ente, configure an S3-compatible object storage provider:

1. Open the Cloudron dashboard and select your Ente app.
2. Launch the file explorer.
3. Open /app/data/config/s3.env and provide values for all required keys.
4. Save the file and restart the app from the Cloudron dashboard.
5. (Required for cast/slideshow) Configure your S3 bucket’s CORS policy to allow the Ente domains you serve from Cloudron (e.g. https://ente.due.ren, https://accounts.due.ren, https://cast.due.ren, etc.). Without CORS, browsers will block the signed URLs that power the cast slideshow.
   • Backblaze B2 tip: B2 ships with “native” CORS rules that block S3-style updates. Install the Backblaze CLI pip install 'b2<4', then:

     # Authorise once (replace with your key ID/secret)
     b2 authorize-account <KEY_ID> <APP_KEY>
     
     # Clear any native rules
     b2 bucket update --cors-rules '[]' ente-due-ren allPublic
     
     # Apply the S3-compatible rule (adjust origins as needed)
     cat >cors.json <<'EOF'
     [
       {
         "corsRuleName": "ente-web",
         "allowedOrigins": [
           "https://ente.due.ren",
           "https://accounts.due.ren",
           "https://auth.due.ren",
           "https://albums.due.ren",
           "https://cast.due.ren",
           "https://family.due.ren"
         ],
         "allowedHeaders": ["*"],
         "allowedOperations": [
           "s3_get_object",
           "s3_head_object",
           "b2_download_file_by_name",
           "b2_download_file_by_id"
         ],
         "exposeHeaders": ["ETag","Content-Length","Content-Type"],
         "maxAgeSeconds": 86400
       }
     ]
     EOF
     b2 bucket update --cors-rules "$(<cors.json)" ente-due-ren allPublic
     

     Verify with curl -I -H 'Origin: https://ente.due.ren' <signed-url>; you should see Access-Control-Allow-Origin.

Supported variables:

• S3_ENDPOINT (e.g. https://<account>.r2.cloudflarestorage.com)
• S3_REGION
• S3_BUCKET
• S3_ACCESS_KEY
• S3_SECRET_KEY
• S3_PREFIX (optional path prefix)

Required: Secondary Hostnames

The installer now asks for dedicated hostnames for the Auth/Accounts/Cast/Albums/Family web apps (via Cloudron httpPorts). If you manage DNS outside of Cloudron, create CNAME/A records such as accounts.<app-domain>, auth.<app-domain>, etc., pointing at the primary app domain. With Cloudron-managed DNS the records are created automatically.

Administration

• Use the bundled CLI from the Cloudron web terminal (CLI state lives in /app/data/cli-data). On a new deployment initialise it once (this seeds the CLI config, whitelists an admin email, and resets the CLI DB):

  # from the Cloudron terminal, logged in as root
  cat <<'EOF' >/cli-data/config.yaml
  

endpoint: api: https:///api log: http: false EOF mkdir -p /cli-data/export chown cloudron:cloudron /cli-data /cli-data/config.yaml /cli-data/export cat <<'EOF' >/app/data/config/museum.override.yaml internal: super-admins: - admin@example.com EOF rm -f /cli-data/ente-cli.db chown cloudron:cloudron /app/data/config/museum.override.yaml

cloudron restart --app

store your account (enter the OTP emailed to you)

sudo -u cloudron ente account add

inspect available commands

sudo -u cloudron ente --help

Once the account is added you can follow the upstream admin docs for tasks like whitelisting and quota adjustments.
See the upstream admin guides for further context: [user administration](https://ente.io/help/self-hosting/administration/users) and [CLI reference](https://ente.io/help/self-hosting/administration/cli).

- To persist custom Museum settings (for example, seeding super-admin email addresses), create `/app/data/config/museum.override.yaml`. The file is appended to `museum/configurations/local.yaml` on each startup.
```yaml
internal:
  super-admins:
    - admin@example.com