fix(service): route Ente public album links and fix Ente startup

- Add an albums service for public links, with its own domain
- Pull images from ghcr.io/ente (ghcr.io/ente-io denies pulls)
- Generate a URL-safe JWT secret, so Museum can decode it
- With S3: use the routed MINIO_SERVER_URL as the S3 endpoint, allow
  all CORS origins, and drop the SMTP defaults

Closes #7405

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

templates/compose/ente-photos-with-s3.yaml

@@ -7,7 +7,7 @@
 
 services:
   museum:
-    image: 'ghcr.io/ente-io/server:613c6a96390d7a624cf30b946955705d632423cc' # Released at 2025-09-14T22:16:37-07:00
+    image: 'ghcr.io/ente/server:613c6a96390d7a624cf30b946955705d632423cc' # Released at 2025-09-14T22:16:37-07:00
     environment:
       - SERVICE_URL_MUSEUM_8080
       - ENTE_DB_HOST=postgres
@@ -16,25 +16,28 @@ services:
       - 'ENTE_DB_USER=${SERVICE_USER_POSTGRES}'
       - 'ENTE_DB_PASSWORD=${SERVICE_PASSWORD_POSTGRES}'
       - 'ENTE_HTTP_USE_TLS=${ENTE_HTTP_USE_TLS:-false}'
+      - 'ENTE_APPS_PUBLIC_ALBUMS=${SERVICE_URL_ALBUMS}'
       - ENTE_S3_ARE_LOCAL_BUCKETS=false
       - ENTE_S3_USE_PATH_STYLE_URLS=true
       - 'ENTE_S3_B2_EU_CEN_KEY=${SERVICE_USER_MINIO}'
       - 'ENTE_S3_B2_EU_CEN_SECRET=${SERVICE_PASSWORD_MINIO}'
-      - 'ENTE_S3_B2_EU_CEN_ENDPOINT=${SERVICE_FQDN_MINIO_9000}'
+      # Browsers upload to and download from this URL directly. Coolify routes MINIO_SERVER_URL to MinIO port 9000.
+      - 'ENTE_S3_B2_EU_CEN_ENDPOINT=${MINIO_SERVER_URL}'
       - ENTE_S3_B2_EU_CEN_REGION=eu-central-2
       - ENTE_S3_B2_EU_CEN_BUCKET=b2-eu-cen
       - 'ENTE_KEY_ENCRYPTION=${SERVICE_REALBASE64_ENCRYPTION}'
       - 'ENTE_KEY_HASH=${SERVICE_REALBASE64_64_HASH}'
-      - 'ENTE_JWT_SECRET=${SERVICE_REALBASE64_JWT}'
+      # Museum decodes this as URL-safe base64; letters and digits are valid, + and / are not.
+      - 'ENTE_JWT_SECRET=${SERVICE_PASSWORD_64_JWT}'
       - 'ENTE_INTERNAL_ADMIN=${ENTE_INTERNAL_ADMIN:-1580559962386438}'
       - 'ENTE_INTERNAL_DISABLE_REGISTRATION=${ENTE_INTERNAL_DISABLE_REGISTRATION:-false}'
-      - 'ENTE_SMTP_HOST=${ENTE_SMTP_HOST:-smtp.gmail.com}'
-      - 'ENTE_SMTP_PORT=${ENTE_SMTP_PORT:-587}'
+      - 'ENTE_SMTP_HOST=${ENTE_SMTP_HOST}'
+      - 'ENTE_SMTP_PORT=${ENTE_SMTP_PORT}'
       - 'ENTE_SMTP_USERNAME=${ENTE_SMTP_USERNAME}'
       - 'ENTE_SMTP_PASSWORD=${ENTE_SMTP_PASSWORD}'
       - 'ENTE_SMTP_EMAIL=${ENTE_SMTP_EMAIL}'
       - 'ENTE_SMTP_SENDER_NAME=${ENTE_SMTP_SENDER_NAME}'
-      - 'ENTE_SMTP_ENCRYPTION=${ENTE_SMTP_ENCRYPTION:-tls}'
+      - 'ENTE_SMTP_ENCRYPTION=${ENTE_SMTP_ENCRYPTION}'
     volumes:
       - 'museum-data:/data'
       - 'museum-config:/config'
@@ -54,10 +57,11 @@ services:
       retries: 3
 
   web:
-    image: 'ghcr.io/ente-io/web:ca03165f5e7f2a50105e6e40019c17ae6cdd934f' # Released at 2025-10-08T00:57:05-07:00
+    image: 'ghcr.io/ente/web:ca03165f5e7f2a50105e6e40019c17ae6cdd934f' # Released at 2025-10-08T00:57:05-07:00
     environment:
       - SERVICE_URL_WEB_3000
       - 'ENTE_API_ORIGIN=${SERVICE_URL_MUSEUM}'
+      - 'ENTE_ALBUMS_ORIGIN=${SERVICE_URL_ALBUMS}'
     healthcheck:
       test:
         - CMD
@@ -69,6 +73,25 @@ services:
       retries: 3
       start_period: 10s
 
+  # Same image as web; serves the public album links on port 3002.
+  albums:
+    image: 'ghcr.io/ente/web:ca03165f5e7f2a50105e6e40019c17ae6cdd934f' # Released at 2025-10-08T00:57:05-07:00
+    environment:
+      - SERVICE_URL_ALBUMS_3002
+      - 'ENTE_API_ORIGIN=${SERVICE_URL_MUSEUM}'
+      - 'ENTE_ALBUMS_ORIGIN=${SERVICE_URL_ALBUMS}'
+      - 'ENTE_PHOTOS_ORIGIN=${SERVICE_URL_WEB}'
+    healthcheck:
+      test:
+        - CMD
+        - curl
+        - '--fail'
+        - 'http://localhost:3002'
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
   postgres:
     image: 'postgres:15-alpine'
     environment:
@@ -111,16 +134,16 @@ services:
     environment:
       - 'MINIO_ROOT_USER=${SERVICE_USER_MINIO}'
       - 'MINIO_ROOT_PASSWORD=${SERVICE_PASSWORD_MINIO}'
-      - 'MINIO_CORS_URLS=$SERVICE_URL_MUSEUM,$SERVICE_URL_WEB'
+    # Ente redirects file downloads from Museum to MinIO, and the browser then sends "Origin: null".
+    # So allow all origins, like Ente's own setup; files are end-to-end encrypted and URLs are presigned.
     entrypoint: |-
       /bin/sh -c "
-        echo \"MINIO_CORS_URLS: \$${MINIO_CORS_URLS}\";
         sleep 5;
         until mc alias set minio http://minio:9000 \$${MINIO_ROOT_USER} \$${MINIO_ROOT_PASSWORD}; do
           echo 'Waiting for MinIO...';
           sleep 2;
         done;
-        mc admin config set minio api cors_allow_origin='$MINIO_CORS_URLS' || true;
+        mc admin config set minio api cors_allow_origin='*' || true;
         mc mb minio/b2-eu-cen --ignore-existing;
         mc mb minio/wasabi-eu-central-2-v3 --ignore-existing;
         mc mb minio/scw-eu-fr-v3 --ignore-existing;

templates/compose/ente-photos.yaml

@@ -7,13 +7,13 @@
 
 services:
   museum:
-    image: ghcr.io/ente-io/server:latest
+    image: ghcr.io/ente/server:latest
     environment:
       - SERVICE_URL_MUSEUM_8080
 
       - ENTE_HTTP_USE_TLS=${ENTE_HTTP_USE_TLS:-false}
 
-      - ENTE_APPS_PUBLIC_ALBUMS=${SERVICE_URL_WEB_3002}
+      - ENTE_APPS_PUBLIC_ALBUMS=${SERVICE_URL_ALBUMS}
       - ENTE_APPS_CAST=${SERVICE_URL_WEB_3004}
       - ENTE_APPS_ACCOUNTS=${SERVICE_URL_WEB_3001}
       - ENTE_PHOTOS_ORIGIN=${SERVICE_URL_WEB}
@@ -27,7 +27,8 @@ services:
       - ENTE_KEY_ENCRYPTION=${SERVICE_REALBASE64_ENCRYPTION}
       - ENTE_KEY_HASH=${SERVICE_REALBASE64_64_HASH}
 
-      - ENTE_JWT_SECRET=${SERVICE_REALBASE64_JWT}
+      # Museum decodes this as URL-safe base64; letters and digits are valid, + and / are not.
+      - ENTE_JWT_SECRET=${SERVICE_PASSWORD_64_JWT}
 
       - ENTE_INTERNAL_ADMIN=${ENTE_INTERNAL_ADMIN:-1580559962386438}
       - ENTE_INTERNAL_DISABLE_REGISTRATION=${ENTE_INTERNAL_DISABLE_REGISTRATION:-false}
@@ -61,11 +62,11 @@ services:
       retries: 10
 
   web:
-    image: ghcr.io/ente-io/web
+    image: ghcr.io/ente/web
     environment:
       - SERVICE_URL_WEB_3000
       - ENTE_API_ORIGIN=${SERVICE_URL_MUSEUM}
-      - ENTE_ALBUMS_ORIGIN=${SERVICE_URL_WEB_3002}
+      - ENTE_ALBUMS_ORIGIN=${SERVICE_URL_ALBUMS}
 
     healthcheck:
       test: ["CMD", "curl", "--fail", "http://127.0.0.1:3000"]
@@ -73,6 +74,20 @@ services:
       timeout: 5s
       retries: 10
 
+  # Same image as web; serves the public album links on port 3002.
+  albums:
+    image: ghcr.io/ente/web
+    environment:
+      - SERVICE_URL_ALBUMS_3002
+      - ENTE_API_ORIGIN=${SERVICE_URL_MUSEUM}
+      - ENTE_ALBUMS_ORIGIN=${SERVICE_URL_ALBUMS}
+      - ENTE_PHOTOS_ORIGIN=${SERVICE_URL_WEB}
+    healthcheck:
+      test: ["CMD", "curl", "--fail", "http://127.0.0.1:3002"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
   postgres:
     image: postgres:15
     environment: