PhotoPrism на VPS: self-hosted AI фотоархив без Google Photos

Краткий ответ: PhotoPrism — AI-powered photo management: face recognition, geo, albums. На VPS 4 GB+: Docker Compose + SSL. Complement Immich.

Google Photos — privacy concerns, iCloud — Apple lock-in. PhotoPrism на вашем VPS — RAW support, AI tags, no cloud upload.

---

PhotoPrism vs Immich vs Google Photos vs Piwigo

Критерий	PhotoPrism	SaaS Leader	Alternative OSS	Enterprise
Self-hosted	Да	Нет	Да	Нет
Цена	Free (VPS)	$10+/user	Free	$$$
RAM на VPS	1–4 GB	N/A	1 GB	N/A
API	REST	Pro	REST	Pro
Приватность	Полная	Cloud	Полная	Vendor

PhotoPrism — оптимальный self-hosted выбор для фотоархива на VPS.

---

Архитектура production stack

Users / Agents
        ↓ HTTPS
   Nginx + Let's Encrypt
        ↓
   PhotoPrism container (port 2342)
        ↓
   Database + volumes
        ↓
   Optional: [Authentik](/blog/authentik-sso-vps/) / [CrowdSec](/blog/crowdsec-zashchita-vps/)

Опционально: Authentik SSO, CrowdSec WAF, Tailscale private access.

---

Требования к VPS

Сценарий	RAM	CPU	Диск
Личное использование	1 GB	1 vCPU	10 GB SSD
Команда / small org	2 GB	2 vCPU	20 GB SSD
Production + HA	4 GB	2 vCPU	40 GB SSD

PhotoPrism на Docker Compose — предсказуемое потребление ресурсов. Bottleneck чаще диск при media-heavy workloads.

---

Подготовка VPS

sudo apt update && sudo apt upgrade -y
sudo apt install -y docker.io docker-compose-plugin nginx certbot
sudo usermod -aG docker $USER

DNS: A запись photos.example.com → IP VPS. Firewall: nftables — 80, 443. Email alerts — Postfix.

---

Docker Compose (production)

services:
  photoprism:
    image: photoprism/photoprism:latest
    restart: unless-stopped
    ports:
      - "127.0.0.1:2342:2342"
    environment:
      PHOTOPRISM_ADMIN_PASSWORD: CHANGE_ME
      PHOTOPRISM_DATABASE_DRIVER: mysql
      PHOTOPRISM_DATABASE_SERVER: db:3306
      PHOTOPRISM_DATABASE_NAME: photoprism
      PHOTOPRISM_DATABASE_USER: photoprism
      PHOTOPRISM_DATABASE_PASSWORD: CHANGE_ME
    volumes:
      - ./originals:/photoprism/originals
      - ./storage:/photoprism/storage
    depends_on:
      - db
  db:
    image: mariadb:11
    environment:
      MARIADB_DATABASE: photoprism
      MARIADB_USER: photoprism
      MARIADB_PASSWORD: CHANGE_ME
      MARIADB_ROOT_PASSWORD: CHANGE_ME_ROOT
    volumes:
      - dbdata:/var/lib/mysql
volumes:
  dbdata:

Первый запуск: docker compose up -d, затем https://photos.example.com.

---

Nginx reverse proxy

server {
    listen 443 ssl http2;
    server_name photos.example.com;
    ssl_certificate /etc/letsencrypt/live/photos.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/photos.example.com/privkey.pem;
    client_max_body_size 100M;
    location / {
        proxy_pass http://127.0.0.1:2342;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

SSL: Let’s Encrypt certbot. Альтернатива — Caddy с auto-HTTPS.

---

Первоначальная настройка PhotoPrism

1. docker compose up -d
2. Откройте https://photos.example.com
3. Создайте admin account
4. Configure core settings
5. Import/migrate existing data
6. Test core workflow

---

Ключевые возможности PhotoPrism

Функция	Описание
Core feature 1	Primary PhotoPrism capability
Core feature 2	Secondary workflow
Core feature 3	Integration ready

Полный контроль над фотоархива на VPS.

---

Расширенная конфигурация

Параметр	Рекомендация
Memory	2+ GB для production
Storage	SSD, monitor growth
Networking	Tailscale for admin

Документируйте конфиг в Gitea.

---

Интеграции и workflows

Интеграция	Применение
n8n	Automation
Gitea	GitOps deploy
Authentik	SSO login

Единый VPS stack с Docker Compose.

---

API и автоматизация

curl -s https://photos.example.com/api/health

Связки:

• n8n — webhook automation
• Gitea — CI/CD deploy hooks
• Uptime Kuma — health checks

---

SSO и аутентификация

Шаг	Действие
1	Authentik → OAuth2/OIDC provider
2	Configure OIDC client ID/secret в env
3	Redirect URI: https://photos.example.com/oauth/callback
4	Disable public registration

Альтернатива — Tailscale mesh-only access без публичного exposure.

---

Backup и disaster recovery

Что бэкапить	Как	Частота
photoprism data volume	tar/rsync	Daily
Database dump	pg_dump / mysqldump	Daily
docker-compose.yml + .env	git secret repo	On change

#!/bin/bash
docker compose exec -T db pg_dump -U photoprism photoprism > /backup/photoprism-$(date +%F).sql
tar czf /backup/photoprism-data-$(date +%F).tar.gz ./data

Стратегия 3-2-1: local + Restic offsite. Тест restore на staging VPS раз в квартал.

---

Security hardening

Пункт	Реализация
HTTPS only	Nginx redirect 80→443
Strong auth	OIDC / local admin
Rate limiting	Nginx limit_req
CrowdSec	Bouncer на Nginx
Updates	docker compose pull monthly
Tailscale	Private admin access

Не публикуйте PhotoPrism без аутентификации в production.

---

Мониторинг

• Uptime — Uptime Kuma ping https://photos.example.com
• Logs — docker compose logs -f photoprism
• Disk — alert при 80% usage
• DB — connection pool, slow queries
• ntfy — push alerts on downtime

---

Performance tuning

• Upgrade RAM при OOM или slow response
• PostgreSQL tuning: shared_buffers, work_mem
• Nginx gzip + cache static assets
• Redis cache layer если поддерживается
• Horizontal scale — второй VPS + load balancer (advanced)

---

Миграция с SaaS-альтернатив

Источник	Метод
Cloud SaaS	Export data → import в PhotoPrism
Self-hosted legacy	Docker volume migration
Manual	API bulk import scripts

Планируйте downtime window и verify data integrity после миграции.

---

Интеграция с экосистемой

Сервис	Связка
Docker Compose	Unified VPS stack
Authentik	SSO для всех сервисов
Immich	Media complement
Gitea	Git + CI integration
CrowdSec	Shared security layer

Единый VPS — PhotoPrism + Nginx + SSL + backup.

---

Troubleshooting

Проблема	Решение
502 Bad Gateway	Container down, docker compose ps
413 Entity Too Large	Nginx client_max_body_size
DB connection error	Check credentials, healthcheck
Login loop	X-Forwarded-Proto header
SSO redirect fail	OIDC redirect URI exact match
Slow performance	Upgrade RAM, check DB indexes
SSL certificate error	Certbot renew
OOM killed	Increase RAM or reduce workers
Import fails	Check file encoding UTF-8
API 401/403	Token scope, CORS settings

---

Связка с экосистемой Storm

• Reverse proxy — Nginx vs Caddy
• SSO — Authentik
• Защита — CrowdSec
• VPN — Tailscale
• Docker — Docker Compose patterns
• Backup — 3-2-1 rule

---

Итог

PhotoPrism на VPS — production-ready self-hosted решение для фотоархива. Setup за день, полный контроль данных.

VPS от 2 GB — StormNet Cloud. SSL — Let’s Encrypt. Backup — 3-2-1. Security — CrowdSec.