Can't Connect Photoprism through Reverse Proxy

[wingstyle]

I asked this through Asustor support but have not received any response. So I am trying here on the forum.

I have PhotoPrism installed and want to access it outside my local intranet, mainly to share albums with family. I have created a Reverse Proxy for it, but can't get PhotoPrism to open using the Reverse Proxy. When I "test connection" while setting up the Reverse Proxy it will open PhotoPrism. When I enter the proxy address (https://myid.myasustor.com:proxy port/photoprism path) into my browser I get the photoprism logo and their "Photoprism needs your support" link. There is nothing else on the page.

Also, photoprism will not open if I am at my ADM page using "https://myid.myasustor.com:port number" (has Lets encrypt certificate). I get a secure connection failed error when trying to open photoprism. If I open my ADM page with the http://ip address (example: http://172.0.0.12"), I get the warning: potential security risk page. I can click advanced and accept the risk, since I am on my internal network, and ADM page opens. Photoprism will open from this page and work fine.

To make sure I was doing the reverse proxy correctly, I also set up one temporarily for Portainer. That works fine. I can access outside my local network. I get the login page and can log in and use Portainer.

[sksbir]

hello
same for me : photoprism (or reverse proxy, I don't know) don't support custom path.
but it works with path = / ( path setting in reverse proxy)

but secure access with https is not the only one problem with photoprism : I didn't found a way to create users in PhotoPrism to share partial views of content.

That's why I'm currently working on a personal project : combining photoprism and photogallery : export albums from photoprism and import them in photogallery to be able to share them with several people, that is share the work done by photoprism. eg : album created with all photos of a person former identified with face recognition feature...

[Nazar78]

As mentioned by sksbir, PhotoPrism doesn't support base URL, also stated in their GitHub. If you're to take a look at the sources, PhotoPrism serves all its assets from the root "/" meaning any subpaths setup in reverse proxy will be sent directly to the backend that doesn't recognize the path.

So in this case if you have few sites to serve, your current option is only to use another domain/subdomains or port forward listening ports in the reverse proxy.

That being said, it doesn't mean you can't do something about it. Reverse proxy like Nginx supports content rewrite called "ngx_http_sub_module" but due to its complexity Asustor of course won't support this. It requires you to manually set it up then rewrite the outgoing content base URL from i.e. /hello.jpg to /foobar/hello.jpg then direct incoming requests from /foobar/(.+) to /$1 so that PhotoPrism recognize them. I don't use PhotoPrism but I've done this to reverse proxy the Asustor's portal.

[wingstyle]

I was getting Firefox can’t establish a connection to the server at localhost:2342 using the reverse proxy. I posted on the photoprism forum and they replied: It's the default URL, if you are using a different host name, please update the site URL in the configuration (docker-compose.yml) and restart. AND, You should be able to set service variables somewhere in the Portainer UI. Set PHOTOPRISM_SITE_URL to the name or IP Address of your server including http:// or https://. I was able to change this using portainer to: https://myid.myasustor.com:reverse proxy port assigned by me/photoprism path assigned by me in RP. After this change is when I get the photoprism logo page. You are talking above my knowledge Nazar78, is this where you are saying photoprism serves all its assets from the root "/"...doesn't recognize the path?

Sksbir, Photoprism has a share album feature. If you select an album (lower right corner of album) and then click the "+" (lower right corner of page), you can choose the share icon. From there you can set up the expire date etc. If I could get the RP working, this would serve my needs.

[sksbir]

hi @wingstyle
exact, I missed the share feature.
regarding reverse proxy, you must first succeed to access photoprism main page.
eg you create a reverse proxy.outside path is https://MYURL:MYPORT, inside is nas internal ip, and internal port for photoprism 32771,and protocol is http. you MUST map '/' here.

with this, you should be able to access main page of photoprism by requesting https://MYURL:MYPORT, and of course you must map this port to your NAS if you want to get access from outside your lan.
this is how it's currently working for me, and I didn't change anything in container property
but I have just test to access a share, rebuilding the url 'by hand' and get the same result ga you

once this is done, that's here that you must set this url ( https://MYURL:MYPORT) has parameter in container to get shares using this has root path instead of 'localhost'.

[Nazar78]

@wingstyle

I was explaining about base URL which PhotoPrism only supports root URI meaning you can't use e.g. http(s)://my-id myasustor.com:port/photoprism in the reverse proxy. It needs to be root URI so set the path to only "/". To bypass this limitation you need some unofficial mods not supported by Asustor as mentioned in my previous post.

Actually when I tested I didn't even have to change anything in docker, everything is default, just setup the reverse proxy with the path as "/" then allow the particular port to pass in my router's IPv6 based firewall (also tested the normal IPv4 port forward) and it works so you shouldn't get that localhost error. Can we have some screenshots of your setups and error?

[wingstyle]

Hi Sksbir,
I did create RP https://myurl:myport and internal ip with photoprism 32771 (http). It does work in RP when "I test connection" (internal ip and 32771). But if I put the RP https://myurl:myport/photoprism/path, I get a page with just the photoprism logo. I attached a jpg of the page.

Capture.JPG (53.79 KiB) Viewed 3498 times

[wingstyle]

Hi Nazar78,

I understand photoprism doesn't support secure https://, that is why I am using the RP. The proxy I set up using Asustor RP is https://myid.myasustor.com:port/photoprism. I used http://myip:32771 for the reverse proxy domain. I am not getting an error now. Just can't get past the photoprism screen.

I attached an image in my reply to Sksbir.

[sksbir]

Hi Sksbir,
I did create RP https://myurl:myport and internal ip with photoprism 32771 (http). It does work in RP when "I test connection" (internal ip and 32771). But if I put the RP https://myurl:myport/photoprism/path, I get a page with just the photoprism logo. I attached a jpg of the page.

Capture.JPG

hi
you cannot access photoprism with https://myurl:myport/photoprism/path, but only with https://myurl:myport
we explained that you cannot define path like. /photoprism/path' this works only without path, that is '/'
you didn't paid attention to that : you MUST map '/' here

[wingstyle]

Hi Sksbir,
Sorry, I did see that but thought you were referring to the path on the first page when setting up the RP, on the proxy page. I was following the Asustor College directions and set up a RP for the NAS and adding a rule for photoprism. I removed those and set one up a new one just for photoprism and it seems to be working now.

Thank you both for your help and patients.