VPS operator runbook

Run Aperture beside an existing Immich server.

The sidecar reads nginx access logs, resolves each shared-link archive download through Immich, and writes a public receipt for every mapped photographer.

1. Environment

Runtime settings live outside git in a root-owned environment file. The FeeRouter key stays absent until the payer wallet is funded.

APERTURE_BASE_PATH=/aperture
APERTURE_IMMICH_API_BASE_URL=http://127.0.0.1:2283/api
APERTURE_ACCESS_LOG=/var/log/nginx/access.log
APERTURE_LICENSE_FEE_ATOMIC_USDC=2500
APERTURE_FEE_ROUTER_ENABLED=0
APERTURE_EXIF_ENABLED=1
APERTURE_IMMICH_LIBRARY_ROOT=/opt/immich/library

2. Services

npm cinpm run buildsudo cp deploy/systemd/aperture.service /etc/systemd/system/aperture.servicesudo cp deploy/systemd/aperture-watcher.service /etc/systemd/system/aperture-watcher.servicesudo systemctl daemon-reloadsudo systemctl enable --now aperture aperture-watcher

Tollgate mount

Aperture is served at `https://tollgate.gudman.xyz/aperture`. Tollgate also exposes `/immich/api/download/archive` so public archive downloads hit nginx and the watcher records the billable resolve.

Aperture