#Exposing Immich to the internet

1 messages · Page 5 of 1

analog jolt
#

What would be super cool is a little mini immich running on a vps that could allow for publicly sharing images/albums. The home immich would upload what you want to share to the mini immich. It could even have expiring links and stuff.

rose oar
analog jolt
#

@rose oarYES! thank you. I was hoping it already existed.

ornate notch
#

Good Evening, I am quite new to immich and installed it 6 days ago, I transferred all of my photos to it and want it to do that automatically even outside of my LAN, I own a domain already and would like to link it there. I am using Linux Arch server without UI. Please pin important info here on this thread so others know where to start

umbral silo
#

Chat gpt is your friend. I used it from beginning to end

#

Like a personal IT mentor

#

can even paste in logs for troubleshooting

ornate notch
#

It is the devils tool. I will refuse to work for satan, I would perfer OpenVPN but I am not sure as to how it functions.

green dome
ornate notch
#

Crickey, it can assist me through OpenVPN it seems

#

error: failed retrieving file 'easy-rsa-3.2.2-1-any.pkg.tar.zst' from cdnmirror.com : The requested URL returned error: 404

green dome
#

... what is that URL even

ornate notch
#

The one registered in the Arch wiki it seems like

green dome
#

tar.zst is a compression format not a URL

ornate notch
#

Why does it take its own mirror it was just a pacman -Syu command

umbral silo
green dome
#

No you're still wrong

#

I specifically said immich

umbral silo
#

It helped me with the compose for immich specifically and various other immich related troubleshooting

green dome
#

You can ask many questions but I've not seen it produce anything useful concerning immich config

#

@ornate notch you're much better off looking for generic reverse proxy guides for Arch

ornate notch
green dome
#

There's nothing Immich specific about accessing a local IP on a certain port

ornate notch
green dome
#

Whatever floats your boat

#

(Tailscale is not a proxy though)

ornate notch
ornate notch
green dome
green dome
ornate notch
green dome
#

If you want to acces through a domain you'll need that + a (D)DNS record for your IP address and a port forward on your router

ornate notch
#

I have done the same with my minecraft server but I followed a guide and didnt use a bought domain and without proxy. I think itll be a bit different with immich but eh

zinc merlin
#

chatgpt will always give you an answer, often it works at least partly...
unfortunately it will fill unknown information with the best info it has, sometimes simply incorrect info
some topics it knows better, some it doesn't
i use chatgpt also but not for such tasks, simpler information gathering tasks to learn how things work to then do it yourself
biggest problem is usually that you need to verify each result as it may be made up

cursive charm
#

@ornate notch Install Tailscale on your server/device, activate funnel to port 2283 and then you can have external access with a direct link to your immich installation without opening ports, complete with SSL encryption etc and no need for a custom domain
ChatGPT can help you with this as it is widely used, just mention the OS properly

ornate notch
#

I got this

Screenshot_20250618_122250_Chrome.jpg
#

With Caddy and CloudFlare and Namecheap

green dome
#

Be aware that cloudflare has a 100MB limit

#

So can't upload large files over it right now

ornate notch
#

Oh

#

Ill delete everything again then and use something else because I am literally transferring my phones files

cursive charm
#

No no

#

You can configure both and then decide what you want to keep

#

I also have cloudflare & tailscale at the same time running

#

One for sharing files and using my personal domain

#

and tailscale funnel as primary to access & upload

#

They are not concurrent so it works both ways

#

In the app you can configure many things as

1 - in which order you want to access your server as you can configure different links
2 - which link you want to use when connected to a specific network, e.g. direct IP when on home wifi

#

It's all under Settings > Networking

distant crypt
#

That being said, Cloudflare proxy also kind of sucks beyond the 100MB upload limit for privacy reasons, since it requires you to trust them blindly.

cursive charm
#

@distant crypt That's true but on the other hand, your phone is either checked by Google or Apple, your ISP also can see what you are doing. Where does it start and end

distant crypt
#

I'm just saying that this particular thing is avoidable. Cloudflare proxy does not really give you anything in a self-hosting scenario

cursive charm
#

Well in their defense, security and convenience as you don't have to open ports and their system is super easy to use, otherwise not many people would use it

#

I'm not affiliated to them or something, but yeah

distant crypt
#

Where's the issue with opening a port though if you're using a self-hosted reverse proxy

cursive charm
#

We cannot deny that they have some kind of value

#

and many people use it

distant crypt
#

They definitely have a value for enterprises; we rely on them heavily. And their DNS is also pretty nice

cursive charm
#

E.g. I'd rather not open any ports because I don't know what the risks are

distant crypt
#

So you rather trust a third party with your plain text data?

#

Plus, a port is open either way. It's just not 80/443 but some higher number TCP port that goes to the tunnel daemon

#

Really I don't understand why people are scared about opening some port that goes to nginx or traefik or whatever. What should happen?

cursive charm
#

I don't know maybe some exploit will magically appear and steal their info

#

HAckerman will come

#

😄

distant crypt
#

I mean to meaningfully do something you'd have to (1) find a pretty bad exploit in the reverse proxy and then (2) pull off a container escape. The same can happen to the tunneld container. It's just like no difference

cursive charm
#

Not everyone is so invested to know all the risk

distant crypt
#

The point of my argument is; the risks you're talking about are the same for both cloudflare tunnel and traefik, nginx, caddy, whatever

green dome
#

It's fine to say "I don't care", but it's not fine to say it's all the same 👀

limpid compass
#

Directly opening ports also makes you vulnerable to DDOS, or the random internet scans may eat up some bandwidth. A bunch of incoming traffic could make outgoing traffic impossible too. If you have a proxy in front of it, you can just cut it off there. If you are direct, much harder.

distant crypt
distant crypt
green dome
#

no

#

You can get DDOS'd just fine without opening any ports too btw

distant crypt
#

Ya

#

I bet everyone in this chat here has at least 30 ports open right now 👀

cursive charm
#

I keep my ports closed until marriage

#

😄

#

xD

limpid compass
#

My point was about mitigation. Also, you can figure out your physical location to about a few miles with just a bare residential ip

distant crypt
cursive charm
#

I got the point

#

Everything in life has a potential risk

distant crypt
green dome
#

So we have:
"Giving a corporation access to all your passwords/logins/habits/..."
vs
"Giving a potential stalker a radius of where you live"
+
"Mild inconvenience when a script kiddie decides to nuke your internet"

I know my favorite 👀

distant crypt
#

How much?

green dome
#

$5

distant crypt
#

Sold

ornate notch
#

so ill try using tailscale again but last time i used their dns i had bad experiences becaus it kept saying it doesnt have an ip addressed to it or it would refuse connection

cursive charm
#

@ornate notch Which OS are you running on?

limpid compass
#

Fail2ban or similar can also help. Not sure if there are other good OSS packages that block traffic automatically

ornate notch
#

arch

distant crypt
#

(btw)

ornate notch
#

so replace cloudflaree with tailscale or what now

#

i have very little idea of what i am doing

cursive charm
#

Write in chatGPT: Help me install tailscale funnnel on arch linux through command line to access my immich installation on my internal port 2283

#

The result will be

#

A link to your Immich installation to the login screen which you can paste in your browser & app where you can access your installation

limpid compass
#

The best way to mitigate security threats is to also accept that they will happen. And follow defense in depth practices. Making it harder to move laterally once they’re in. Ie don’t save ssh keys or other credentials on the exposed server. If you can’t spare a physical server, at least use a VM which is a bit harder to escape. Containers are insecure by default.

distant crypt
#

a bit harder to escape
If someone wastes a qemu escape on your homelab I'd be LOLing haha

limpid compass
#

True 😉 you’ll probably be alright. The main risks I think would be using weak passwords and exposing ssh

#

And don’t use windows. 😉

#

Tho I think that’s more secure these days

zinc merlin
zinc merlin
#

with access to a container i mean you would first need an exploit of e.g. immich which would then allow access to the container level

green dome
#

I definitely don't expose ssh directly 👀

zinc merlin
#

i serve everything via tls/ssl only
ok, except of wireguard

#

if i need ssh access to something, i connect to an html5 remote desktop environment in which i can start an ssh client :[

ornate notch
cursive charm
#

If you don't want any of that then you can rent a VPS somewhere and host your FOSS tunnel through Pangolin/Fossorial

ornate notch
#

i also dont want a 100mb limit

cursive charm
#

That's above my knowledge, I only use low config tools like Tailscale funnel & Cloudflare Tunnel

#

So my setup has its limitations but I can live with those

remote widget
ornate notch
#

are there any free alternatives to cloudflare that dont have some limit and still use my domain name

remote widget
ornate notch
#

oh so cloudflare is one

zinc merlin
#

if there is no need to expose any ports because there is like two people using it and its only with wireguard... fine
no need to be afraid of "just exposing" your immich install with a properly configured reverse proxy

ornate notch
#

i tried now i connected my domain with tailnet url using cloudflare

#

it does simply not work

#

i tried dig it gives positive results

#

but when i open the domain with the dns thing it doesnt work

#

if i open the tailnet url it brings me to caddy

#

my caddyfile looks like this wait

zinc merlin
#

i dont see an advantage in that solution but to each his own

#

a properly configured reverse proxy is so much simpler and can be used for all other services as well... just need to learn once about proper setup, googling cause a long way

ornate notch
#

this is it

zinc merlin
#

i dont use caddy, sorry

ornate notch
#

still reverse proxy

zinc merlin
#

yes

#

its good, what i meant to say is that i can't help much with caddy

ornate notch
#

idk what to do ill try something else ig i followed this but i cant open it at the end and caddy wants me to upload my servers files to /srv/httphttps://www.youtube.com/watch?v=Vt4PDUXB_fg&t=

YouTube
Tailscale
Remotely access and share your self-hosted services

We're going to use Tailscale and the reverse proxy Caddy to share self-hosted services on your Tailnet with friends and family.

Personal accounts are always free on Tailscale and can include up to 3 users and 100 devices. Get started today at https://tailscale.com/yt

In today's video we focus on Immich - a self-hosted photo backup tool, Audiob...

▶ Play video
zinc merlin
#

have you tried contacting the guy who made the video? if he is from tailscale, maybe in their forums?

weary dragon
ornate notch
#

ill try nginx instead now

ornate notch
#

turns out cloudflare tunnel works well

hollow estuary
#

it doesn't support large file upload FYI

thin tide
ornate notch
#

i deleted the tunnel now i tried tailscale without caddy and without my precious domain and it works on my phone now without lan connection

hollow estuary
#

Yeah tailscale is a good choice

ornate notch
#

i wish immich had a google drive alternative built into it

#

for like files that are not photos or videos

distant crypt
#

That'd be a different product :P

ornate notch
#

immich plugins

distant crypt
#

Not even

#

Just a whole different software tbh

weary dragon
cursive charm
tepid hound
zinc merlin
cursive charm
#

I need to try Seafile in a docker LXC

zinc merlin
#

I don’t sync with filebrowser at all, I use Nextcloud for my data sharing and paperless for documents

cursive charm
#

I'm looking for something lightweight, Filebrowser also has external sharing

zinc merlin
#

Yes but no sync afaik, I also use Nextcloud for calendar and contacts

weary dragon
acoustic jungle
#

I have probably the most basic setup.

I already had a digital ocean droplet that was running a small web app and a DB instance.

  • I increased the resources of the droplet
  • modified the DB instance to have pgvecto (now VectorChord after the update to 1.123
  • Installed immich and it runs behind a reverse proxy via caddy
cedar stump
fair ermine
#

Just use Pangolin its the easy waY

cinder tangle
#

Tailscale and a Cloudflared SaaS working together with google cloud console Oauth. Disabled password login on immich.

So when I want to login. I connect to Tailscale. Put in the tailscale ip:immichportnumber. And login with my google account whicht contains MFA steps

hearty bluff
#

Also having Google OAuth.
But also disable registration of new users. So that you have to whitelist a users Gmail address before he can login.

cinder tangle
gaunt ruin
#

I feel good using nginx proxy manager on digital ocean as a reverse proxy, I just need to find some sort of logging/monitoring solution for it to alert me to potential issues like resource overutilization

zinc merlin
#

what kind of resources?
nginx itself has some config for that i believe and cpu/ram you can limit on the container level

gaunt ruin
#

I’m just looking for some obvious signs of somebody hammering it trying to find a way in

#

I’ll only allow oauth login but still

digital cave
#

anyone have a nginx template for immich?

gilded nest
digital cave
digital cave
#

I got it to work for the mobile app with my url. The browser just shows the immich logo spinning.

ksnip_20250623-213840.png
north sleet
#

I want that my Images are automatically synched to my Immich Server when I am not at home. What should I use? Tailscale, Cloudflare Tunnel or something different

#

because I think that this isn't a secure way

hollow estuary
north sleet
#

But when Tailscale isn't turned on when I am not at home then it won't automatically sync when I am not opening the app

hollow estuary
#

it will stay connected

north sleet
#

will it need a lot of battery

hollow estuary
#

it is just VPN connection, I don't image it will eat the battery. I mainly use Wireguard and I've always have it on, don't notice anything regarding battery life

north sleet
north sleet
#

These are the settings that I Need Right

#

?

#

Should I use a subnet router or no exit-node

#

Because I host one

hollow estuary
#

not sure about exit node but yeah, that is the setting I mentioned in Tailscale app

swift sparrow
#

Someone may have aleady mentioned this but I just did a free Cloudflared Tunnel to my docker install. Set it up so my subdomain was public and people who have a login (Family, etc) can go to the domain, sign in and see the photos.

zinc merlin
# swift sparrow Someone may have aleady mentioned this but I just did a free Cloudflared Tunnel ...

yes, thats mentioned a lot...
its a good solution with some things you just need to know:
1.) there is an upload limit of 100MB, so you might need to upload videos once you get home
2.) the unencrypted traffic passes their servers, your data is their product 😉
3.) while there is some "protection", it is less than most think and probably doesn't protect from what most would want to be protected from
4.) it "hides" your IP from those you share the links with but that does not mean your ip is protected 😛

rancid tangle
#

Are there any settings in Immich by default that need to be changed to get reverse proxy working? I have about 10 or so items setup this exact same way as the photos above and they all work out of the gate, but Immich for some reason is not working. Using NGINX and Cloudflare.

Untitled.jpg
heavy zenith
#

Immich's Default port is 2283 not 8080, could be as simple as that.

#

@rancid tangle

rancid tangle
#

unfortunately no luck. when i check the dockers config it shows webui port of 8080

heavy zenith
#

Is it is accessable directly using the local hostname/IP and port like my screenshot?

#

I just had a look, the port in the default docker-compose is still 2283. If you want to change the port to be 8080 make sure you just set the host side and leave the container side as is, so:-

 ports:
      - '8080:2283'
rancid tangle
#

here are the docker settings I see (defaults on everything except my IP address)

chrome_x3f29g9eHw.png chrome_xoEqhPtcgS.png
gilded nest
#

you are using cf tunnels and a reverse proxy? cf is already a reverse proxy, nginx doesn't make sense here. anyway, you should check nginx logs, this is hardly an Immich issue

rancid tangle
#

CF is my host, nginx is my reverse proxy

limpid steppe
#

Hi! I am using yunohost.org. Works perfectly and includes typical security measures.

meager swift
#

I had the same issue where I exposed it to a different port which worked with a local ip but the reverse proxy could not handle it

#

Havent got a clue why

gilded nest
zinc merlin
distant crypt
zinc merlin
#

sad but probably true, lol

#

to be fair, I wouldnt know how to properly do that automated for every service and have each service working still
its either plug and play or secure :[

distant crypt
#

Oh yeah ofc not

limpid steppe
#

And also fail2ban for the SSH port… 🙂

zinc merlin
#

say what? 😄
i hope you dont actually leave ssh open 😄

#

ssh honeypot to gather IPs to ban maybe 😄

thin tide
#

I do. I do use a non standard port but i wouldnt lose sleep over using 22

zinc merlin
#

I would

#

even on a non-standard port 😛

thin tide
#

But why? SSH is one of the most tested and widely deployed protocols in the world

#

If you have it well configured and hardened I think it’s totally safe

zinc merlin
#

if you have it well configured on a hardened system it can be OK
but sometimes exploits are out there, there are some honeypots that use actual ssh servers with actual sandboxed systems out there, those are taken over sometimes
since then I dont expose ssh anymore 😛

I probably would with something as simple as a port knock pin but havent had a need to since switching to html5 access (with MFA of course) for ssh (actually a full desktop which has read-only access to most of my data and read-write to some of my data which is there as a copy (e.g. emails and an upload directory)

livid jungle
#

Has there every been a report of anyone having data issues with cloudflare tunnel on their immich install? Or is this more theoretical?

zinc merlin
#

you mean data privacy?

#

there are issues with upload limits if you meant that...
them having access to your unencrypted data is a fact, not theoretical
if they actually do access your data, that part is theoretical

ivory lark
spring siren
#

Does someone have a link to a end to end guide for setting up remote access? I'd like it to cover: setting up an NGINX docker, config my home internet router port forwarding, getting a LetsEncrypt cert, setting up the NGINX ports and config, any changes to my Immich docker, which is now accessible on the LAN only on port 2283, but no ports forwarded from the internet router. I thought I'd figure it out from this Discourse discussion... but it goes back years, thousands of comments.

#

I'm guessing I'd set up internet router port 443 forwarding to my server, server NGINX docker listening on 443, NGINX forwarding 443 to localhost (server) 2283, Immich docker listening on 2283 ? BTW does this setup preclude running any other https web site in my LAN because 443 is now dedicated to Immich?

zinc merlin
#

basically you set up your reverse proxy of your choice... thats not covered here how to do that
immich docs show examples on the immich specific config for e.g. nginx

#

your reverse proxy (e.g. nginx) would receive all requests to port 443 and would forward it according to the websites fqdn (e.g. immich to your immich and serviceB to another server)
with that setup you could host unlimited services behind your reverse proxy

#

but again, the setup of the reverse proxy itself is not explicitly covered here, you can find a few hardening tips in the history here

spring siren
spring siren
zinc merlin
#

immich would run on a non standard port, your reverse proxy would simply forward the traffic to your defined ip/port

zinc merlin
#

a reverse proxy can also be configured to e.g. allow access to certain websites only from within your LAN

spring siren
#

Thanks everyone, it went smoothly. I did the following:

  • On my domain registrar, I set up photos.mydomain.com as a CNAME to photosmydomain.duckdns.org
  • On duckdns, I set up photosmydomain
  • On my server I set up a cronjob script to update my dynamic DNS, photosmydomain, every 30 minutes (from the example on duckdns.org)
  • On my internet router I forwarded ports 80 (HTTP) and 443 (HTTPS) to my server. This means ONLY 80 and 443 can get in from the Internet.
  • On my server, I setup a docker container with Caddy (the simplest reverse proxy) listening to port 443 and forwarding to port 2283 (Immich)
  • No changes were necessary to my Immich container. It was already listening on port 2283 for any local traffic on my LAN.
  • I set up users for my family on the Immich server

It worked right the first time. I can go to photos.mydomain.com and log into my Immich!

Update: My home internet router has trouble doing NAT going out to photos.mydomain.com and back in to the LAN. So from outside I use photos.mydomain.com and from inside I use http://myserver:2283 directly bypassing the reverse-proxy and cert issues.

zinc merlin
#
  • On my server, I setup a docker container with Caddy (the simplest reverse proxy) listening to port 443 and forwarding to port 2283 (Immich)
    that is debatable 😛

either way, look into hardening your system and reverse proxy, always a good idea 🙂
and enjoy, its a lot of fun 🙂

limpid compass
fallen moth
#

ewe... it's very difficult to configure, but looks kinda neato

nova pulsar
#

how about cloudflare domain?

trim mango
#

I used the free ddns of www.noip.com,
on my local server, I setup nginx to proxy_pass to immich,
I port fw 80 and 443 to my server IP in my router,
then I configured certbot to enable TLS on the name I chose with noip.com.

#

It should be easy enough to replicate dynamic dns on any domain name as long as domain name provider has an easy to use API.
Just run a systemd timer every 5m that runs on PC with immich, checks its public IP, compares with current record, and if necessary call domain name provider to update DNS record.

zinc merlin
#

yea, there are also tools for that like ddclient if a simple curl isnt enough

small cipher
#

i jsut came off the free ddns subdomain because it is going to mess up once you want to host more like a Oauth provider or a cloud service or something ( once you get into self hosting it gets addicting Cryge ) pay a few euro/dollar a year for your own domain and will make feature subdomains much easier and it all is cleaner .

#

also you don't have to open more ports than 443 since you can seperate your services by subdomain

trim mango
distant crypt
#

DNS-01!

small cipher
distant crypt
#

because it does it over TLS I guess.
That's rather hard if you don't have a TLS cert :P

#

I'm assuming you gave caddy creds to your DNS provider?

thin tide
#

Serious question what’s the harm with opening 80?

#

You know it goes to the same backend process right 😅

distant crypt
#

(assuming you enable https redirect and don't allow people to use http for your services :P)

zinc merlin
trim mango
#

To give some perspective, I checked the websites of a few banks and they all listen to :80 (and redirect to :443).

zinc merlin
#

What data if all you get is a redirect?
I agree if the same website is available via http… but just for a redirect, I see no issue…
I don’t see a problem in not having a redirect either as modern browsers will know those sites are supposed to be accessed via https
I am just saying, a simple redirect shouldn’t be an issue and there shouldn’t be a case where a client just sends confidential unencrypted data to any port

sinful dagger
#

I use pangolin with CrowdSec to publish my services to public internet - just to answer the initial question

zinc merlin
sinful dagger
zinc merlin
#

🤷‍♂️ Shri don't really see an issue either way, I have it on in general so I leave it on. I have a single webpage that is available only inside my home network which serves http content, nothing confidential… just some ip lists

worn crater
#

Hey folks having some real what I can only presume to be knowledge issues here WRT Docker networking to get Immich exposed to the internet
Using Nginx Proxy Manager I am currently able to access my instance by URL on the local network but not via the internet
This is the only external service I have running in Docker everything else is an LXC on the local net and Nginx on the same instance is kept internal which is why I presume this is a Docker network knowledge issue
Things I've tried in combination:

  • Putting immich-server in network_mode: host (did not get to the point of being able to access locally via IP)
  • Setting IMMICH_TRUSTED_PROXIES to the local and docker IPs of Nginx
  • Setting IMMICH_HOST to that of the Docker host
    Any basics I might have missed that immediately spring to people's minds?
gilded nest
worn crater
#

Anything other than 80 and 443 I should be forwarding then? I was of the understanding that's all that was necessary for this

#

And that forwarding 2283 was a "should avoid"

zinc merlin
#

Correct, don’t forward 2283
If you get nothing but it works from inside, it’s either a DNS or port forwarding issue

crimson sandal
#

Is immich android app fine if you put an http(s) basicauth before it?

Https:// user:pass @subdomain

I just have treafik with https before it

since some ios lusers will use it i cannot make it to complicated.

But an ips won't hurt i guess

thin tide
worn crater
trim mango
zinc merlin
#

You should, yes

spring jasper
#

Can I use Tailscale to access Immich remotely while maintaining local access via localhost:2283 and 10.0.0.100:2283 ?
I once setup Tailscale on Ubuntu by installing binary files, allow remotely access to the whole Ubuntu device. But currently I don't want to Tailscale the my whole *PC *, just want it to remotely access Immich with Tailscale. Btw I'm using Docker Desktop on Windows 11 to run Immich.

gilded nest
heavy crypt
#

Anyone out there using crowdsec to secure Immich with an up-to-date whitelist rule? This (https://github.com/immich-app/immich/discussions/3243#discussioncomment-6543612) was the most recent example I could find, but it's about two years old and needs some tweaking. I came up with the rule below, but just curious if anyone smarter than me has a better version.

whitelist:
  reason: "Whitelist false positive from Immich-api"
  expression:
   - evt.Meta.http_verb == 'POST' && evt.Meta.http_status == '403' && evt.Parsed.request contains '/asset/upload'
   - evt.Meta.http_verb == 'GET' && evt.Meta.http_status == '429' && evt.Parsed.request contains '/api/asset/thumbnail/'   
   - evt.Meta.http_verb == 'GET' && evt.Meta.http_status == '200' && evt.Parsed.request contains '/api/asset/thumbnail/'   
   - evt.Meta.http_verb == 'GET' && evt.Meta.http_status == '304' && evt.Parsed.request contains '/api/asset/thumbnail/' 
   - evt.Meta.http_verb == 'GET' && evt.Meta.http_status == '429' && evt.Parsed.request contains '/photos/'
   - evt.Meta.http_verb == 'GET' && evt.Meta.http_status == '200' && evt.Parsed.request contains '/photos/'
   - evt.Meta.http_verb == 'GET' && evt.Meta.http_status == '304' && evt.Parsed.request contains '/photos/'
spring jasper
heavy crypt
#

Whoa whoa whoa let's not get crazy

quaint oak
#

Swag (ngnix+fail2ban) reverse proxy with openid using Authentik behind Opnsense firewall with crowdsec

ripe lintel
#

I am using pangolin + crowdsec + geoblocking + authentik. I am happy with my setup.

trail jungle
ornate notch
#

I can't connect to immich on my phone via grapheneos idk whose fault it is ? Tailscale or Grapheneos? Here is my resolv conf

rn_image_picker_lib_temp_6fa6afe5-ae77-4dff-9c22-231e41e56546.jpg
#

I have tailscale on my grapheneos

#

Enabled

trail jungle
unique spruceBOT
heavy crypt
trail jungle
heavy crypt
# trail jungle I don't remember in which Immich version it was, but one of the latest ones, i g...

Similar to the thumbnail block you get when scrolling through the timeline, you'll get a block from paging through photos too fast. To solve for that I copied the rules you had for /api/asset/thumbnail and replaced that with /photos. Another user on git mentioned issues with non-Immich users getting blocked when paging through a shared album too fast, and as far as I can tell that is also solved by whitelisting /photos.

trail jungle
spring jasper
stark compass
tawny sentinel
#

Hi! I just started about 3 days ago, its been so fun 🙂

My setup right now i just a raspberry pi, exposing via portforwarding on my router behind a reverse proxy (nginx) with SSL with let's encrypt. Using duckdns for a free domain to configure let's encrypt

very simple, not the most ideal.

what improvements would you recommend securitywise?

zinc merlin
#

sounds good....
security wise if you want to improve, look into hardening nginx reverse proxy, use best practices and harden your OS and docker.
https://www.cisecurity.org/ <- you can get good best practices benchmarks here for free

many also implement geoblocking and brute-force blocking, though I personally don't believe it helps that much

if you have a firewall with IDS/IPS, you can of course make use of that as well

CIS
CIS

CIS is a forward-thinking nonprofit that harnesses the power of a global IT community to safeguard public and private organizations against cyber threats.

main tartan
#

hey all
I've been running immich behind a wire guard VPN for a few months now, but I've decided that I want to expose it to the internet on one of my domains.
I've done some research, and I want to use a cloudflare tunnel to expose it, along with using their zero trust to restrict access, and also fail2ban to stop brute force attacks.
does anyone have any feedback or recommendations for a setup such as this one?
thanks

ripe lintel
#

File limit on cloudflare proxie is 100 mb that‘s why i went with pangolin (+crowdsec, geoblock and authentik). Not sure if that‘s also the case for cloudflare tunnel.

onyx falcon
zinc merlin
high spade
high spade
distant crypt
#

What does it add that's worth pinning? Isn't that just another person talking about how they did remote access?

high spade
distant crypt
#

You can also do threads here, people just don't use that 😅

high spade
#

Oh

#

Lol

#

I thought its built in view option

distant crypt
#

I don't know, I don't think that thread is as important that it's worth pinning tbh. Also, there's already soooo many information all over the place

main tartan
#

thanks for the feedback all, I think I've decided against using a cloudflare tunnel, due to the upload limits, as well as apparently they don't like video content being served through the tunnel, and I would also like to expose my jellyfin install through it

zinc merlin
#

just harden your reverse proxy and expose it :[
of course there are risks, but there always are...
harden and keep up to date is my recommendation

#

and as for that thread...
I also dont think its worth pinning, even the opening post is confusing

  1. ddns

Not great from a security stand point
security? 😕

and then there is just discussion about it...

I personally recommend two options:

  1. wireguard or the likes
    -> secure and "easy" for small setups with only few members and without sharing
    -> if this is enough for you, I do not see a reason to jump into the rabbit hole and do any more than this... dont force yourself to stay with this if your needs increase though!

  2. expose via reverse proxy
    -> harden and use best practices and you will be more secure than most

there are always corner cases but the problem is that people (including me) are a bit paranoid.
if people express their security concerns, it does not mean you will be "hacked", things need to be taken into consideration (activate brain).

tawny sentinel
#

What weighted the most on my desicion on how to expose to the internet was the clients (me and my partner).

Using VPNs adds one more thing into consideration, so that was a no-no for my specific case. She wouldn't even give it a try if she had to use another app before using immich

zinc merlin
#

exactly...
for yourself and a partner, a vpn might be sufficient...
add some grandparents that dont live close and you might think different 😄

tawny sentinel
#

sorry, i edited 😄 after rereading what i wrote, i meant something else haha

zinc merlin
#

well, to be fair... you CAN configure it so she does not need to open any app and the connection simply stays active and is used for immich only

tawny sentinel
#

true, but that means handling her phone more, i wanted it to be almost as easy to use as google photos/ios

#

install the app, log in, and go

zinc merlin
#

thats fair

#

and if you know how, i also dont see a reason not to expose it...

main tartan
#

this would be my first time exposing services, so I don't have any prior experience, and I want to make sure I'm keeping it as safe as I can, so I'm being quite cautious with what I'm doing

zinc merlin
#

well, google best practices for the reverse proxy you are using and use TLS1.2+
if you want to go the extra mile, harden your docker and OS

hollow blaze
#

I tried oauth on cloud flare and could get it working so just a cloud flare tunnel currently

zinc merlin
#

if that works for you its fine also 🙂

median cloud
#

I'm using tailscale to get access its super simple and easy and the most important part is that it is secure. Just install tailscale and then join the tailnet and then you have the access to that local instance.

zinc merlin
#

yea, wireguard,tailscale or other VPNs are great, especially if you are the only one accessing it

spring siren
brazen sentinel
#

I use tailscale. I hope thats secure enough.

zinc merlin
#

secure enough is a matter of opinion...
there is always a more secure option

for me, exposing it with a hardened reverse proxy, all running at home is secure enough for me

#

the reason I recommend a VPN for those that are satisfied with it is just ease of setup and limited attack vector (meaning a misconfiguration, e.g. admin user with password admin would not be able to be accessed by everyone... basically its a quicker entry to get running for people just starting out self-hosting)

median cloud
quick spoke
#

Anyone have any comments for my current configuration? I have Immich running on a Ugreen DXP2800. 2 8TB Seagate HDD in a RAID 1 configuration. I access it via a URL and have the NAS connected to my router at home. I have port forwarding that goes to NGINX proxie manager and then points it to my Immich. Any comments on security or volume of users I could service would be appreciated.

zinc merlin
#

have you tried reading anything here beforehand, any specific question?
if you are more elaborate, people can help better
e.g. how many users do you WANT to serve and what are the specs on that Ugreen device so people dont have to look it up?
where is immich running, where is the NAS running or are they the same device?
as for security... "I access it via a URL" and "I have a port forwarding that goes to NGINX proxie manager" does not tell me that much about your config but yes, if you set that up in a secure manner, its security would be enough for me (more secure is always possible).

quick spoke
# zinc merlin have you tried reading anything here beforehand, any specific question? if you a...

I hope to service about 15 people in the field that would have an iphone and an ipad. Non of these people would have a need for access via web portal. Their would be 8 people in the office that would only view via web portal. The Ugreen I have has a 12th gen intel N100 quad core with 8gb ram ddr5. This particular unit can upgrade to 16 gb ram, 2 m.2 slots, or even take ssd drives if I wish to add. Right now I have it with the basics and feels snapy when testing it with 5 people.

#

Immich is in portainer inside my ugreen NAS which is connected to my home router. Only downside is I do not have a static IP yet.

#

I guess what I was wondering is if anyone had an idea of how many users this setup could service. I would say the field accounts would take on average 8 pictures a day each x 15 people. So at the most, it would be 120 new pictures a day.

#

Plus the load of the 8 people in the office viewing these pictures via internet.

quick spoke
#

Feel like the speed of my internet would be the limiting factor here.

image.png
green dome
green dome
quick spoke
zinc merlin
#

20mbit upload will definitely be the limiting factor...
probably OK for 1-3 people but 23 people accessing it at the same time over 20mbit...
if you get the bandwidth resolved, you definitely want container data (thumbs, encodings, database...) on an ssd/nvme and depending if the users access the originals a lot, you may also want to get an SSD for the libraries

quick spoke
gaunt ruin
#

I've been slowly moving away with a VPS approach to on-demand wireguard through my vpn. the one thing i want to do though is stand up an internal reverse proxy to front Immich with HTTPS; is there a great way of doing that without exposing 80/443 on my internal network for DNS redirection/lets encrypt rotation?

green dome
#

You can do txt record validation instead

quick spoke
quick spoke
wild lynx
#

Just another type of verification. It's required when doing wildcard if I remember correctly. At least that's how I'm getting a wildcard for my local network.

distant crypt
zinc merlin
#

I would agree, it's just a different type of verification... has advantages and disadvantages. I do prefer it but would not say it is more secure...

gaunt ruin
unkempt adder
distant crypt
#

The Immich mobile app doesn't work with proxy auth, but we support OAuth natively

unkempt adder
distant crypt
#

Also, Immich does not target companies primarily :D

distant crypt
unkempt adder
distant crypt
#

And tbf even in companies the most common attack vector is phishing lmfao

unkempt adder
unkempt adder
distant crypt
#

After all self hosting is also about learning stuff, even if it doesn't make sense

#

(or your company just sucks, idk lol)

unkempt adder
wild lynx
#

An auth proxy layer is more of a "the software does not support oauth, so we need to add another component to our stack to make it secure".

distant crypt
unkempt adder
unkempt adder
distant crypt
#

Ok so that's an argument why ip address whitelisting is far from perfect. And what's the argument in favor of proxy oauth?

wild lynx
#

Just do both IP allowlisting and OAuth 😎

unkempt adder
distant crypt
#

Yes, as Finn said you can use oauth proxy stuff if your application does not support oauth

wild lynx
#

Fair. IMO you should prefer integrated solutions over added components in the deployment. It adds a lot of complexity for very little benifit.

distant crypt
#

If you want an additional layer of sec, use mTLS or something

wild lynx
#

The lib in immich is just as vulnerable as the one used in the auth proxy

distant crypt
#

Yup exactly

wild lynx
#

At my company we do use a combination of IP lists and OAuth where we feel like it's necessary (not all of it)

unkempt adder
#

Sure. Maybe I‘ll discuss that at work sometime in the future. Maybe there is some other reason that I do not yet know or someone just messed up and this just became company policy to at minimum have oauth enabled.

distant crypt
#

I don't think either of us is arguing against oauth tbc

wild lynx
#

I'd say OAuth or similar should be minimum everywhere

unkempt adder
#

Yeah, I‘d still be interested in the additional reasons for using instead of ip-whitelisting. Maybe it is just for convenience reasons, idk. My first year out of university, so I am currently learning some of the real life trade-offs

wild lynx
#

IP proves next to nothing. See it more as a weak second factor.

#

Any kind of secret send as part of the request would be better

thin tide
#

Don’t 100% agree with that, depending on the level of control you exert over that IP it’s exceedingly harder to fake that even if credentials are leaked

#

Obviously you could have an ISP level takeover etc

wild lynx
#

Sure, if you control it I agree. But for cloud envs that were mentioned before they may change regulary

thin tide
#

Yes they will

unkempt adder
#

Yeah. My university had been given an entire /16 range. They just gave every device unique IPs and specific subnets completely reserved for working on sensitive devices. Then IP whitelists are way more effective

unkempt adder
wild lynx
#

I'd still add another layer on this, even for private networks. With docker you might have many applications running on the same host, and you don't want every single one of these containers to be able to access hosts that are only intended for the other container

unkempt adder
wild lynx
#

In the end it's all about minimizing the attack surface

#

Ah sure IP per container also works. But I don't see that very often.

unkempt adder
wild lynx
#

Yeah my company has a /20. It's crazy what you could just get back then.

unkempt adder
#

Deutsche Telekom (known as T-Mobile in the US) still gives out a unique IPv4 to every customer (even more for some legacy customers)

thin tide
wild lynx
#

Most german ISPs still do that. I'd switch providers if they wouldnt

thin tide
#

Unless you mean for a cellphone..

unkempt adder
unkempt adder
wild lynx
#

Ah yes Vodafone is the bad one in that set and unfortunately a lot of people with them have no alternative 🙁

unkempt adder
unkempt adder
#

I am honestly waiting for the first IPv6 only networks

#

That would be a big step into the right direction

wild lynx
#

Won't happen for a very very very long time. It would just break too much for customers. v6 Servers on the other hand are starting to be a thing.

#

unless you consider v4 tunneling in v6 networks as v6 only

unkempt adder
thin tide
unkempt adder
thin tide
#

not having a public ipv4 unfortunately still causes many issues in the self hosting space

#

I used to run a wireguard tunnel from a vps back when i had cgnat

unkempt adder
green dome
#

I have a public ipv4 without cgnat, nothing special about it here

distant crypt
unkempt adder
distant crypt
unkempt adder
distant crypt
#

Then you can use any provider if it's actually fiber. That's thanks to open access

#

I am fairly confident you mean Vodafone Coax, not fiber

ripe lintel
#

Vodafone is a reseller for Telekom Glasfaser though.

distant crypt
ripe lintel
#

But yes, you can use any provider then.

unkempt adder
distant crypt
#

You get more than 100Mbps upload?

unkempt adder
distant crypt
#

Then you can definitely just switch ISPs if you want to

unkempt adder
unkempt adder
distant crypt
#

Then go with someone else? 1&1?

unkempt adder
distant crypt
wild lynx
#

Thing is: even if other providers can use the network, most don't offer this. I'm surprised though that VF has real fibre. Usually they switch to Coax for the final connection and still claim is fibre 🙃

unkempt adder
#

About a decade later btw, but we should have 100% fiber availability by the end of the year

unkempt adder
ripe locust
#

so what are few main ways people do this now, to sum up whole thread

wild lynx
#

I don't think you can sum it up to one solution. Minimum is put something in front of Immich and if thats only a proxy doing TLS.

ripe locust
#

didnt really mean one but rather what are some of the main setups people use

#

most frequent ones

#

tailscale would be one ei

unkempt adder
#

I am using TLS and Wireguard (The software Tailscale uses)

wild lynx
#

I use nginx proxy manager to proxy requests to my services. And Wireguard when I need to get into my home network.

unkempt adder
wild lynx
#

I just like having a UI from time to time, but yes running it standalone also works

distant crypt
#

Traefik and Wireguard/Headscale :)

unkempt adder
wild lynx
#

Kinda true, but I do that stuff too much at work to bother with this at home as well

distant crypt
unkempt adder
unkempt adder
wild lynx
#

Oh yes thats actually funny, I prefer running the applications on my server by hand with plain old docker compose. But configuring them via UI.

#

Especially the proxy config file would just get too long for my liking. Which means it would end in me trying to automate the generation of that config somehow to make it look cleaner

unkempt adder
unkempt adder
unkempt adder
distant crypt
unkempt adder
distant crypt
#

Yeah but java is ugly

#

The whole point is for any operator to also just be a function with the option to be notated infix

wild lynx
#

Doesn't Javascript count 1 as true? Then I prefer "if (count - 4)"

distant crypt
#

FWIW any number !== 0 would be truthy though

wild lynx
#

Ah crap

distant crypt
#

So it wouldn't be exactly the same :P

#

What you could do is if (!(count - 5)) hyperkek

unkempt adder
#

In every other language you tell your computer what to do in JavaScript you tell it what not to do

distant crypt
#

Except C. There you tell it what to do and it does what you didn't tell it

unkempt adder
distant crypt
#

Are you making me google a brainfuck interpreter now or will you send the readable code too? lmao

unkempt adder
#

+++++ // Cell[0] = 5

  •      // Cell[1] = temp flag

<< // Back to Cell[0]

[- // Start loop if Cell[0] != 0

  •     // Decrement Cell[1]

<- // Decrement Cell[0]
] // End loop

      // Move to Cell[1]

[ // If Cell[1] == 0, Cell[0] was exactly 5
++++++++ // Print something
.. // (e.g., print H twice)
]

distant crypt
distant crypt
unkempt adder
# distant crypt LOL

I only know one person insane enough to write brainfuck code and that is the person who wrote an entire OS with a network driver from scratch for his Abitur (high school degree)

unkempt adder
distant crypt
#

Damn they're crazy lol

unkempt adder
#

Yep. Switched schools just to get one that offered computer science as a main subject

#

According to him nobody in the room understood what he did anyways and they just gave him a 0.75 (A+)

#

And honestly I actually believe that

distant crypt
unkempt adder
#

If you gave that woman a bunch of 8th graders you’d get the closest to real world anarchy possible

distant crypt
#

The thing with CS kinda is:

  • If you're good and you enjoy research/education you stay at universities
  • If you're good and don't want to do research anymore you find a job in the industry that's very well paid (much better than a teacher job)
  • If you can't do any of the above you end up as a teacher
    There are definitely exceptions to this, people who are really passionate about educating young people (not university students) but those are rare
zinc merlin
# unkempt adder Yeah. My university had been given an entire /16 range. They just gave every dev...

that is actually one case where I would say that IP whitelisting is not enough....
generally ip whitelisting is fine, the danger is just in someone unauthorized being able to use the IP
in case of a university using a /16... that's is very likely a whole lot of smart people who would try to access unauthorized things just for fun... likely not hard to use an IP assigned to someone else.

generally, even with ip whitelisting you should use some kind of authentication. it just lower the attack vector and usually by a lot.

wild lynx
#

Reminds me of my study time. They tried to lock down the network by having us register our devices MAC addresses. We soon figured out we can retrieve any users MAC address from the AD. We ended up using one of our Admins addresses. Luckily that did not provide any system access, but tracing back forbidden activity would then lead to that admin ...

distant crypt
#

KEKWait no RADIUS/WPAE?

wild lynx
#

Nope just teachers thinking what they built themselves was genius and our report of this was "not an issue".

distant crypt
#

That's... Incredibly dumb lol

unkempt adder
zinc merlin
# unkempt adder It is and isn’t. The correct lan ports were in inaccessible areas

and how would they realize that an IP is fixed to a specific port?
its doable but not feasible on campus networks so there would be ways around this...
generally, I wouldnt see whitelisting as "secure", it would make it "more secure" than without it but you are still allowing a broad audience access to whatever... its fine if there is decent authentication

unkempt adder
thin tide
#

127.0.0.0 dogekek

quick spoke
#

I have two account set up with immich that communicates to my NAS. I recently updated everything to v1.138.0, including my apps on my phones. I access my NAS which is connected to my home internet via url and Nginx. Here is my problem. I can get background refresh to work on my android device, but not on my iphone. Settings are all the same and background services are enabled. Anyone have any clue as to why this is?

#

I believe I enabled Beta Timeline at one point on the iphone, but do not have it enabled anymore. Not sure if this information is relevent.

unkempt adder
unkempt adder
quick spoke
#

These options are located here

image.png
quick spoke
#

Update: Background backup still not working for my iphone. I got foreground working though. I have no trouble with my android device working with background backup. This is strange

hollow estuary
quick spoke
hollow estuary
quick spoke
#

idk... something is wrong with my ios version. I feel like something happened when I tried brta timeline for an hour and since turned it off. Feel like at that point it stoped working.

modest frigate
#

would just hardened nginx be good enough. or should i put in oauth through something like authelia

#

i understand depends on my tolerance for security but what do you all do

green dome
#

Just plain NPM here

zinc merlin
#

hardened nginx here with oauth with MFA (though for some testing I currently allow local logins as well, basically bypassing oauth)
If you can and have it, I would definitely use oauth for the added security, if not... make sure to use a good password and maybe not have the admin user named the default of admin

severe lava
#

Add webauthn (Passkeys) as MFA 😏

zinc merlin
#

thats what oauth is for, yes

keen vortex
#

How well does certificate auth work

severe lava
#

I mean what are you stuck on?

severe lava
keen vortex
#

and how it compares to using header authentication

severe lava
#

header authentication is usually an extra header (Authorization: Bearer <token>) and can be a JWT or API key or OAuth2 token.

#

so it depends on what your goal is and the application support if header auth or mTLS is a better option

keen vortex
#

like without cert/token it just throws a random error

#

In a sense to avoid having to relly on immich for authentication (in case of vunerability)

keen vortex
severe lava
#

ah yeah client certificates would work for that albeit a little more difficult to get going. Without a client certificate you cannot 'establish' the connection (e.g. you'd get a 403 or someting)

keen vortex
#

of browser

severe lava
#

nope

#

the browser will do that for you

keen vortex
#

are browsers smart to remember certs

severe lava
#

yes

#

they can be a bit finiky however

keen vortex
#

Also does it work with ios

#

like ipads

severe lava
#

Are you using cloudflare

#

yes

keen vortex
keen vortex
severe lava
#

aigt the set-up is pretty straight forward

#

yes fair enough

keen vortex
unique spruceBOT
keen vortex
#

this one I think right?

#

nvm

#

I'll look into it later

#

uni starting

#

Thanks for help

severe lava
#

They're using authentik. This looks to be something different

#

aigt np

# 
    ssl_client_certificate <bla>.pem;
    ssl_verify_client on;
``` probably something like this. But there are complete tutorials out there
zinc merlin
severe lava
#

I was just being pedantic, im sorry 🥺

zinc merlin
#

same, i'm happy with authentik... not the easiest to use though

severe lava
#

I used to run Authentik but I switched to Authelia

#

and now I HATE HATE yaml but it works

zinc merlin
#

i get that... havent tried authelia but i guess it is much easier to use

severe lava
#

ngl authentik is easier

#

lol

#

didn't help that my setup is weird and not recommended tbh

#

I do both proxy-forward and ODIC

zinc merlin
#

if authentik is easier, why would you switch to authelia? 😄

severe lava
#

with mTLS

severe lava
#

that really put me off

zinc merlin
severe lava
#

I went full insane

zinc merlin
severe lava
#

the fix was like: aight lets sprinkle some checks in the code as opposed doing it centralized and structured

#

I just don't feel confident

zinc merlin
#

🤷‍♂️ i am no dev, so i never looked at any code or fixes

severe lava
#

Fair enough

#

I mean I wouldn't that its vulnerable, I personally was put off by it

zinc merlin
#

yea, i understand but cant judge myself

severe lava
#

I mean I work in infosec so I have a vague idea

zinc merlin
#

me too but not with coding apps, not app security

severe lava
#

I was a secure developer (lol) for a bout 5 years, after that ethical hacker and now somehow managed to fail myself into a CISO position

#

so

#

I am not an expert and I will not give advice to anyone

severe lava
violet forge
#

I'm running a Pangolin instance through AWS that tunnels Wireguard to my home server.

high spade
#

Of course this doesn't mean anything bad about pangolin, it's just that quite a few people think it's more private than CF in this aspect.

distant crypt
thin tide
#

And honestly even SSL cannot be guaranteed to be private unless you do certificate pinning, which almost no one does

distant crypt
green dome
#

Cloudflare: "These are the most used insecure passwords: a, b, c ..."
Normal people: "Omg who uses that"
IT: "... wait you can see our passwords?"

high spade
thin tide
#

So any blocking or filtering becomes useless

distant crypt
high spade
thin tide
#

Hmm. That’s cool

distant crypt
#

I think you just use the X-Forwarded-For http headers, but not 100%

high spade
# thin tide Hmm. That’s cool

I started using this a week ago, works well. I plan to add pangolin to run locally on the home server but I need to see how it works.

wild lynx
distant crypt
#

Out of a fear of DOS attacks?

thin tide
thin tide
distant crypt
high spade
distant crypt
#

We only don't want to terminate tls

distant crypt
thin tide
distant crypt
#

Http headers are not encrypted

wild lynx
#

Huh? They are

distant crypt
#

There are attempts to include them, and I think the most popular one is a Http3/quic proposal.

#

But nothing is really there yet

distant crypt
thin tide
#

I’m pretty sure SNI is the only one currently not encrypted..

wild lynx
#

SNI is part of the TLS handshake

distant crypt
#

Gdi peepoLeave

#

I'll find myself out

zinc merlin
#

😄

#

sni not being included in quic is the reason quic is blocked in many enterprise environments

rancid solar
#

I use certificates via mTLS. Reverse proxy via Traefik and authtentication via Authentik.

cloud vector
#

I was going to use a CloudFlare tunnel along with WARP authentication.

But then I decided to just set up a VPN on the same network as my server so now I can literally just access it via the same IP as I would if I was on the same network as the Immich server.

It's also much easier to set up.

proven fox
#

since I originally posted this I figured I should post an update with my current plan. My idea now is to use mTLS (manually shared) along with some WAF rules in cloudflare and a cloudflare tunnel. I've set this up for Home assistant and it seems to works good. The one major downside of this is the 100MB upload limit, I figure that should not be a problem since hopefully any file bigger than 100MB will be uploaded once I'm at home. The major upsides of this is that you don't have to think about VPN connections, nothing that needs to be turned on/off.

zinc merlin
#

Why cloudflare though and not a proxy? Your data passes through unencrypted encrypted n their systems.

proven fox
#

But yes, it does require you to trust cloudflare, I guess that's one more downside of this.

zinc merlin
# proven fox what proxy would you suggest?

Any you are comfortable with (I use nginx), just need to do some basic hardening.
I personally don’t see an advantage that warrants the downsides. AFAIR, their tos prohibit media streaming like videos in immich. I haven’t found free, useful security features either… geoblocking can be done on the proxy as well and hiding your IP is security through obscurity at best.

proven fox
# zinc merlin Any you are comfortable with (I use nginx), just need to do some basic hardening...

Right, but that's going a vastly different route. I prefer to not open ports in my personal firewall. I've previously solved that with tailscale. However I've found that that is at times a little bit unstable. I'm running traefik as a reverse proxy on my local network tho.

Ultimately it's a question about what you want to trust. But it's not only about hiding IP but also having a stable IP, my ISP rotates IPs once in a while. Tailscale solved that. But so does cloudflare. I'm sure mTLS could be set up using traefik, but I've previously used authelia or similar in front of my services, with the downside that not alls (nextcloud for example) supports that.

zinc merlin
ivory lark
#

if you fancy renting another VPS to act as a fronting that's an option
it's still a point of failure, and something to manage
you can decide which one to trust: a vps on your provider of choice or cloudflare/tailscale etc
though it comes back down to cost, benefit and risk analysis of what you value more

#

a vps is still somewhere that can fail
but it's not like cloudflare is infallible either
it's still somewhere you have to manage too, but you have greater control of the stack

#

personally i just open a port in my IP, with caddy as fronting, for most of the publicly accessible services
but i do have tailscale to access other more sensitive services, or as a SHTF backdoor for myself to access inaccessible things
(like ssh which is not exposed)

wild lynx
# proven fox Right, but that's going a vastly different route. I prefer to not open ports in ...

imo a tunnel only moves the entrypoint to your stack. You still expose an HTTP service to the world which needs to be secured. I'm with @zinc merlin on this one, CF does not really offer much in terms of security that you can't implement yourself. Sure, if you care about having a stable IP you need a VPS or something as a proxy (which then could also tunnel through a VPN). I just live with a daily disconnect of about 5 minutes until the DNS update is propagated to all clients.

proven fox
# wild lynx imo a tunnel only moves the entrypoint to your stack. You still expose an HTTP s...

Given my WAF rules on Cloudflare it should be secure, it will only allow access if you have the mTLS cert installed on your device. Yes. That's perfectly doable on my own server and port forwarding from my router, but it means I need to open up my own network a bit more than I have now. Having family manage a VPN (even tailscale) have shown hard, they just don't keep it on. So this seems like a decent way for me. And while traefik with mTLS is probably enough and secure it demands that I keep it up to date, vs moving that to Cloudflare. It's probably just as likely that Cloudflare will have issues as Traefik. But if there's a zero day with traefik implementation I have to act, if there's a problem with Cloudflare they're bound to act quickly.
My reasoning is that I'd be able to keep less of an eye on it.

proven fox
proven fox
ivory lark
proven fox
#

I have strong opinions against CF to be honest. I dislike them. But for me it's about what will work for the family, me having to maintain, more than morality atm.

#

The downside I see with CF is the TLS termination on their server / 100Mb limit. But neither I see as a huge problem really

ivory lark
#

Having family manage a VPN (even tailscale) have shown hard
ah now i see why tailscale was passed
having vpn is definite an extra step needed

proven fox
#

While I could get people to install it, having them check if it was actually connected when something didn't work just wasn't easy. And for various reasons it would disconnect for people. Any extra step is just not doable for family is what I've come to realise.

ivory lark
#

agreed it's also not ideal even for me i dont like to keep it running constantly (i use adguard normally)
so it's just more hassle if my stuff has to be manually connected for immich to sync

#

that's why i decided to just open a port on my IP it's the easiest least friction method for me

proven fox
#

Installing a cert on familys phones, I think, will be rather easy to. Signal over the file and I can just install it for them. Afaikt that's the only thing needed really.

ivory lark
#

hmm right mtls, would consider but
i guess i am passing that because i do like the ability to share albums
maybe after i setup an albums proxy i could consider mtlsing certain services

severe lava
#

I tried the mTLS route but I ran into the issue that my mother also wanted to view photos on other devices that did not have the certificate installed so I ended up putting authelia infront of it and forcing auth via authelia before connecting to Immich 🙃

#

mTLS is still used to bypass Authelia for the apps

ivory lark
#

do you also use immich's internal auth for allowing people to login to the correct account then?

severe lava
#

SSO

severe lava
#

works really good

ivory lark
#

ahh so you dont use mtls anymore?

#

does authelia hardwalls immich to authenticated users only?
(ie you cant even see immich if you arent authed, would block things like /share/)

severe lava
#

thats correct

severe lava
ivory lark
#

i see mine is probabaly just the lowest serivcable security level lol
i leave it open because my family dont have authentik accounts
i dont trust myself to for my homelab to serve my family so it's just me rn

severe lava
#

That is fair enough tbh

#

I do trust myself :D

zinc merlin
# proven fox and from all I can tell Cloudflare is plenty secure as well. For my needs

if that is the case, then all good...
I won't try to make you understand things differently... if you did your research and due diligence and came to the conclusion that a self hosted reverse proxy is too much work and CF is secure and private enough, then that is your conclusion and decision!
should you seek any help with any explanations or suggestions, let us know 🙂

limpid bramble
#

I have issues with hosting stuff, specifically I've had on 3 separate occasions, someone be able to get into my hosting system and delete seemingly whatever they wanted. This was on a PC running Windows 10 and then a Mac running MacOS 10.15, and the Mac was running stuff with HTTPS.
I'm also running Immich on a different, much newer machine, but I have no idea how to run it with HTTPS or really do anything other than run Immich as it comes.
I've been told by anyone who knows better than I do that I need to have more security, but I have no idea wtf I'm doing. I've ceased running the other servers due to this, but Immich I can't just cut off because its how I share stuff with my friends, and at least one of them uses it to store their photos.

What do I actually do? I know almost nothing. Cloudflare is intensely complicated to me, and I couldn't even figure out how to do that.

limpid bramble
#

I'm just gonna... buy a Cloudflare domain and play with it. Does that sound like a sound option? Would this theoretically protect me from whatever has been happening?

#

Ok, I got it up. The problem now is I can't enable HTTPS.

wild lynx
#

Every software can have security issues. Cloudflare does very little to protect you from such issues, and even that little you have to configure first (not on by default). You should set up a proxy on your server to enable HTTPS. I use nginx proxy manager for that, it comes with a nice UI and does not require much work on the command line.

wild lynx
limpid bramble
#

It was powershell commands through the hosting software I used the first time

#

The dev made v2 though and said it was much more secure, and to completely stop using v1 because of how vulnerable it made everything

#

And that worked for a long while

#

…until it happened again, so I restored from a backup I had just made

#

And then I turned on HTTPS

#

Thought it was fine for a while AGAIN

wild lynx
#

So whatever software you used probably is just ... not good.

limpid bramble
#

Idk if they did the same thing or not, I couldn’t find out the same way I had the first time

limpid bramble
#

About 8 years ago I started experimenting with xampp or whatever it’s called

#

But that was overcomplicated for what I needed and eventually stopped working anyway

#

So I switched to HFS

#

But yea eventually it happened again, but the software had a macOS version, and the box I was running it on was kinda stupid slow anyway, so I switched to a 12 core trashcan, which I thought would be extra fixed.. because.. there’s no powershell.

#

But it happened AGAIN, the same damn thing. August 31st was the day I just took almost everything down and said “fuck it.”

#

And I thought I had a backup - I looked everywhere, but it’s just freaking gone - So that factored into my decision to take it all down.

#

2 of the servers I was hosting for someone who actually passed away later that evening

#

So whoever did that.. they’re going to a special hell. With me for not making better backup solutions.

wild lynx
#

Definitely look into backup strategies. Best case offsite with protected snapshots / write only operations from outside.

limpid bramble
#

Oh god I don’t have the means or the storage space for that

#

I’d just make a copy to a drive that lives on a drive in my closet every week

wild lynx
#

Cloud storage is cheap. Unless you want to store petabytes or something

limpid bramble
#

The best security: Not Online!

wild lynx
#

Yeah, outdated backups are always nice to have /s

limpid bramble
wild lynx
#

Then you probably don't use a proper backup software tbh

limpid bramble
#

Yes I don’t

#

AKA none at all!

wild lynx
#

Being able to "forget about it" is one of the most important aspects of backups. They should manage themself

limpid bramble
#

Yea… I never investigated software to do that because I always imagined they’d cost money

#

At least the ones I’d actually want to use

wild lynx
#

Borg and Restic are popular choices, both free

limpid bramble
#

Oh?

#

I might look into those if I ever host anything else again

#

I only run Immich now, and that… for SURE can’t be backed up properly. My folder itself is creeping up to a terabyte.

#

And my upload speed is 20Mbps so cloud storage really isn’t an option (especially since I heavily use that minuscule upload speed for quite a few other things that are time sensitive)

wild lynx
#

Initial backup will just take a while. I uploaded a terabyte over a 40 mbit connection. Took a couple of days but eventually it finished.

limpid bramble
#

Honestly I really should be backing Immich up because it’s on the RAID0 box which I know is a T E R R I B L E idea - I just had no where else to put it, and I’m scared that I’ll fuck it all up if I try to move it.

#

I just have no money rn so I can’t pay for cloud services like that

#

The best I’d be able to do is stripe 2 of those 500GB drives that were salvaged from DVRs and crap, and copy everything onto those-

proven fox
# zinc merlin if that is the case, then all good... I won't try to make you understand things ...

To be clear (even if it might not say much). I've been "selfhosting" for ruffly 20 years. Started running linux 25+ years back. I've use traefik/caddy/nginx (and even apache/httpd) for reverse proxying. I did start this thread because I was curious about what other did. But I think I do know most of the way I can expose a service, and its pros and cons. I do, however, prioritize things differently today than I did a few years back.

proven fox
proven fox
wild lynx
#

Kopia?

proven fox
#

rclone, had to look it up

wild lynx
#

Ah, so by extension also restic (it can use rclone as a storage backend)

proven fox
#

True true, when I evaluated them I ended up with rclone, it seemed like the simplest way

zinc merlin
zinc merlin
severe lava
zinc merlin
#

easier said than done but yes, at least some basic checks should be done... a full restore can be difficult sometimes
I dont actually test if all my databases restore properly, I should but I don't 🙁

severe lava
#

I sometimes do

wild lynx
zinc merlin
#

I scripted to look for updatetime and verification the the backup is not empty
i get a daily silent notification with statistics, how much was added/removed, etc.
and i get an alarm if the script had an error or the checks in the script say there might be something faulty

that does not actually do a full restore though and therefore verify it would actually work

severe lava
#

I mean i always recommend doing that periodically

#

I take full backups (incremental) of the VMS so the test is just as easy as restoring it from backup and verify everything boots and loads correctly

wild lynx
#

I make do with restoring individual files for testing. A full restore above a certain size is just way too much, at least on a regular basis.

zinc merlin
#

I don't have VMs, I only run containers...
I back those up with restic and dump the databases just before that

proven fox
proven fox
#

One of those things that makes me really question exposing anything online

zinc merlin
#

i would never use docker desktop
and yes, once container access is compromised, there are sometimes container escape vulnerabilities

proven fox
#

And for what it's worth, I've already rolled back my mTLS solution. Turns out I'm not able to read. While certs are possible to install on iOS and you can get Safari to respect them there's no way to get apps to just work with them, in the way Android do it. So I'm back to tailscale for now.

zinc merlin
#

too inconvenient for me to share my hosted services so I do it differently

severe lava
#

lol

#

vms all day

thin tide
#

Not that it makes it any better, but the container itself wasn’t really breached

proven fox
#

But its the type of think you, as a self-hoster, might have to jump on. Hopefully I'm not as exposed to that typo of things when not opening ports on my own router

zinc merlin
#

opening ports on a router is not a problem...
you know if you run docker desktop on windows, I would argue that it is more likely to be "hacked" by phishing, browsing or exploits of other applications

I feel quite secure with my hardened reverse proxy exposed on the internet 🙂

#

when i say "opening ports on a router is not a problem...", what I mean is that there are so many people which are afraid of opening ports on a router but do not associate this with the service this port gets forwarded to... the mere act of opening a port sounds threatening to many

proven fox
#

Well, to be clear, I would never run docker desktop on windows 🙂

#

And you're absolutely right in that opening a port isn't unsafe in itself.

limpid bramble
#

I don’t have the time to suck down all the info on securing a web server, I’d probably have to use Linux which is just a really bad idea for me and yea. Just… not happening right now, that’s why I shut it all down, except for Immich. That, with the help of a great and knowledgeable few people in another channel here, I made “a lot” more secure.

#

And hopefully that’ll be good enough.

worldly wraith
# quick spoke

I am currently running an n100 mini pc and n97 mini pc (Both have 16 GB ram). The n100 as a reverse proxy and exposed to internet via public ip DDNS, Crowdsec Autoban & Load balancing via Nginx native. The n97 on the other hand runs machine learning and keeps back files of my main machine directories. I have tailscale on both of them, Also enabled GeoBlocking and protection with Cloudflare Zero trust and WAF rules. I have them in a small server rack with my NVR and router on top. Because they sit in a closed space covered with wood, but do have holes in the back of box for airflow, I added usb server fans to them and my hard drives. Total cost spent 230 dollars excluding my 2 tb drive

zinc merlin
#

you exposed it via public ip DDNS and also use cloudflare?

#

whats the use case?

south smelt
#

Hi Folks, is it possible to install a domain certificate to immich? I have a wildcard for my main server and would like to use https and immich.mydomain.com. Apologies if I've missed it somewhere in the docs but I can only find nginx.

wild lynx
#

No. You should run a proxy in front of Immich to handle the incoming connections.

south smelt
#

Oke Doke, just seems an extra step that I don't need. I'll stick to Tailscale.

zinc merlin
#

it is much better (time-wise) to not develop your own webserver and have that handled by a well established product like apache or nginx
some kind of proxy is needed for outside exposure

severe lava
gentle tapir
#

I use a Tailscale Funnel. Seems to work pretty well, haven't been ransonware-d yet!

zinc merlin
#

havent heard of anyones immich being ransomwared through immich itself yet

cursive charm
spring jasper
low nexus
#

Hello, I hope someone can help solve the issue. I did the steps below, but still cannot access the server.

created an A record in Cloudflare that points to your public IP address
created a DNS entry in Cloudflare that's a CNAME called immich.subdomain.com
On my OpenSense gateway I forwarded whatever ports are used for NPM
created an unbound rule to allow these requests to flow to my router which my server is connected to

#

Im' using unraid.

unkempt adder
earnest harbor
#

I've seen a lot of different setups here. So I want to include mine as well.

My immich is exposed via domain with TLS Certificate. The reverse proxy is installed in a server for only the reverse proxy. Within the Config the header of the reverse proxy is hard restricted. From there it tunnels through a VPN to a DMZ. Behind the DMZ there are different subnets. One of those is for immich.
Between those different systems is CrowedSec and different firewalls. Everything is hardly restricted.

Is there something I can add here?

zinc merlin
low nexus
elder trellis
#

Dynamic DNS and a reverse proxy (Caddy, which handles LetsEncrypt automatically) combined with mTLS (very pleased immich supports that).
Used nginx before and that also definitely worked.

high spade
#

#10860

unique spruceBOT
thin tide
jolly sluice
#

Is it considered safe to expose immich with caddy externally without any additional layer of security like authelia?

ivory lark
#

provided you trust the authentication method
if you are using built in auth, you would have to assume your admins and users have secure passwords
if you are using SSO, same assumptions goes for that

#

personally i expose it with caddy + authentik sso, i dont really feel worry using pw+TOTP for login

jolly sluice
#

Yeah I feel that that's my only concern the password strength.

wild lynx
#

Personally I would not expose it without a second factor, but I would also not call it unsafe per se. You just have to be aware of the risk, especially when you don’t have any other security defenses that block attackers from brute forcing.

zinc merlin
#

also remember, brute- forcing is not that common anymore, pw/wordlists, yes... but even then, you have to first have someone who would waste the time on you to do that... and if you are worried about it, there is fail2ban or similar things

wild lynx
#

True, I just use that example out of habit. Haven't seen actual brute force in a very long time. Unless someone really hates you personally it's mostly bots trying leaked passwords or scanning for vulnerable software versions. So keeping up to date and using strong passwords is more important than overthinking the deployed stack too much. Just a bit 🙂

elder trellis
spring jasper
#

If I replace Immich auth with Authelia (Basic Auth + TOTP). The only better part is TOTP, isn't it?

#

I mean the basic auth method itself is just a combination of username/password. Regardless implemented on Immich or Authelia

wild lynx
spring jasper
#

Thank you. Just spinning up a Proxmox VE and learning something before actually buy a nas 🫶

green dome
#

Buying a NAS: DrakeNo.jpg
Making a NAS: DrakeYes.jpg

velvet galleon
#

Well I did the opposite, bought a mini computer to try out some stuff and make a NAS

#

Now I can't access my router via ipv4 anymore

#

But immich is working well behind my nginx proxy manager so at least there's that

spring jasper
#

Regarding Immich OAuth with Authelia. It works on web browser but ios app doesn't.
Failed to check server availability. It send request to this URL https://immich.example.tld/api/server/ping&amp;rm=GET and got blocked with statusCode=401
Do I help to whitelist that url path in Authelia access_control ?
Beside that, when I try to enter that URL on browser (authenticated), it returns {"message":"Cannot GET /api/server/ping&amp;rm=GET","error":"Not Found","statusCode":404,"correlationId":"9fa82clf"}

Edit: I tried to add bypass rule for /api/server, then it return 401 on /api/user... so I ended up with below Authelia config

access_control:
  default_policy: "deny"
  rules:
    - domain: "auth.example.tld"
      policy: "bypass"
    - domain: "imit.example.tld"
      policy: 'bypass'
      resources:
        - '^/api/' # Unsure if this is an potential security risk
        - '^/.well-known/(immich|openid-configuration)$'
    - domain: "imit.example.tld"
      policy: "two_factor"
ivory lark
#

i dont think immich was really designed for forward auth
as in proxy->auth->immich pattern
it's probably more so proxy->immich <-> proxy->oauth
apps and stuff will break if they cant access api paths

#

seems like there's people who had success using mtls with Authelia though
(search in this thread)

ivory lark
wild lynx
#

Immich is not designed for that flow at all. You have to add the OIDC provider within Immich. oauth proxies are not supported.

spring jasper
ivory lark
#

that tutorial is how to use authelia as a oauth provider

ivory lark
#

can you try removing these and see if that works again?

spring jasper
# ivory lark can you try removing these and see if that works again?

I setup exactly the same as they wrote. Then I found errors and solution as below

  • "Your app major version is not compatible with the server" -> Add bypass rule for ^/.well-known/immich
  • "Login with OAuth" button not shown on mobile app -> The mobile app log said 401 Unauthorized on route /api/server/info/ -> Bypass rule for ^/api/server
  • Still got "Login with OAuth" button not shown on mobile app -> The mobile app log said 401 Unauthorized on route /api/server/version/ -> Bypass rule for ^/api/version
  • Now OAuth button show, click on it direct me to Safari web browser, things went well before it redirect me back to the Immich mobile app
    Got new error in the log 401 Unauthorized on route /api/server/users/

401 code is return from Authelia middleware I guest, those request didn't reach Traefik, or Immich server at all.

---> So tired of adding route by route, I decided to bypass /api/ instead.
Then everything work well.

spring jasper
ivory lark
#

i see so this setup works as intended but you are asking if adding /api/ is okay

#

well the thing is, as i said before immich wasnt designed to have something sit infront of it
what you did here by allowing /api/ is to allow unauthenticated access to all immich API endpoints
(you are now only protecting the GUI, which means almost nothing you might as well have not protected anything to begin with)

#

hence why i said you could have removed the whole block here
and allow everything thru by default

access_control:
  default_policy: "deny"
#

because right now API request is like internet -> proxy -> (notices that /api/ is allowed, bypass auth) -> immich

#

which is effectively the same as having no access control

#

i wont say it is a security risk, i will say it is something you must be aware and consciously choose that
if you think it adds security that's bad, because you would be tricking yourself into false sense of security
it only become a risk, if you think you are more secure than you actually are

ivory lark
#

there's no wrong choices here
for my personal setup immich is directly exposed to internet
and auth is done via oauth on authentik

low nexus
#

Hello All,
I tried to run the Nginx proxy server using Cloudflare A list, but I cannot connect. I see that I have a CGNAT IP address since. I see that my public IP is xxx.xx.3.82, but the IP on my modem is xx.xxx.176.32. What is the other way to connect to a reverse proxy using NGinx Manager? Thanks!

spring jasper
spring jasper
jolly sluice
#

Is it fine to use "Proxied" dns in cloudflare for immich or is it recommended to disable it?

thin tide
jolly sluice
low nexus
#

Hello, I successfully reverse-proxied my server using Pangolin. I have an issue that I can access the immich via my.domain.com on the browser on my computer, even my Cellphone. The issue is that I cannot connect to the server using the app. I enable the PIN on Pangolin authentication. Has anyone experienced the same? Thanks!

thin tide
fair ermine
#

Try pangolin with Pocket id (Passkey Provider) works Perfect for me and Family They dont Keep remind the password anymore

low nexus
fair ermine
#

https://docs.digpangolin.com/self-host/quick-install-managed

https://docs.digpangolin.com/manage/identity-providers/pocket-id

https://docs.digpangolin.com/manage/access-control/rules

https://pocket-id.org/docs/client-examples/pangolin

Pangolin Docs
Quick Install Guide - Pangolin Docs

Deploy your own managed Pangolin instance in under 10 minutes with our automated installer

Pangolin Docs
Pocket ID - Pangolin Docs

Configure Pocket ID Single Sign-On using OpenID Connect

Pangolin Docs
Rules - Pangolin Docs

Configure rules to allow or deny access to resources without authentication

Pangolin

Configure Pangolin with Pocket ID authentication

#

@low nexus just read the docs its very easy

past plinth
#

Hey, sorry if that has been answered or if that isnt the right place. Did anyone set up the bypass rules in pangoline correctly? I cant get share links to work with the pangolin auth.

gilded nest
#

this discussion should move to another topic imho

spring jasper
#

Hi guys.

  • Immich and Tailsale are running at my hone. All behind ufw and physical firewall which not allow any public incoming connections
  • Now I'm outside (100km away). when using 4G. Tailscale show relayed conn. when using wifi It shows direct conn.

How is that possible? If the two network are not behind cgnat. Despite being on different isp. Tailscale can still init direct connection between them?

green dome
#

Are you confused as to what a VPN is @spring jasper ?

gilded nest
narrow sigil
# spring jasper Hi guys. - Immich and Tailsale are running at my hone. All behind ufw and physi...

Tailscale's relayed connections are when they relay packets through a Designated Encrypted Relay for Packets server (DERP)

Tailscale's direct connections work through a UDP socket through the WireGuard protocol

Two networks are still behind their own NATs
NAT traversal means you can still get a direct connection between two NATs

https://tailscale.com/blog/how-tailscale-works
https://tailscale.com/blog/how-nat-traversal-works
https://tailscale.com/blog/how-nat-traversal-works#:~:text=carrier-grade NAT.-,Concerning CGNATs,-Even with NATs

#

You can still connect to stuff behind CGNATs with sophisticated holepunching, but sometimes it's not worth it, like being on a phone carrier's CGNAT

spring jasper
thin tide
#

Tailscale can negotiate a direct connection even behind CGNAT, that's the main point of it

spring jasper
thin tide
#

it only needs the coordination server for the initial nat hole punch between the clients

spring jasper
worldly wraith
clever sail
#

Npm.

feral prawn
worldly wraith
#

And also specific device access if can configure everyone's phone in your family.

worldly wraith
#

Rather than updating Authentik and Authelia, I instead use CloudFlare to save on hardware and update.

somber basin
#

hope I am not derailing anything here, but wireguard is the only way I will access my pictures, you can even have a tunnel only apply to one app, or exclude other etc, its all in the android app, and its a single port forward, and docker compose, and QR codes makes adding peers so easy!

full marsh
#

I associated a sub domain from freeDNS to my external IP address, installed nginx reverse proxy with certbot in my PC. In the nginx config the access is allowed only to IPs:
172.0.0.1
192.168.x.x (LAN)
10.x.x.x (VPN users, I also have Wireguard set up)
IP address of my parents house so that they do not have to use a VPN

#

This way I can put the sub domain everywhere and it always works. Members of my family that are skilled enough also have access to the VPN for when they are not at home.

somber basin
#

ah good tip on the external ip of parents place! they dont change that often!

full marsh
#

I also put deSEC subdomain in their modem settings that is updated dynamically, so that I have a subdomain associated with the house and I can just check the IP by pingjng the domain

sharp zinc
#

Immich machine -> NPM w/letsencrypt machine -> hardware firewall -> router

Cloudlare points to endpoint.mydomain proxied, cname records point to endpoint.mydomain proxied

Subdomains have security rules to limit what can be called

violet nymph
#
  1. nginx => immich, accessible directly only on my home network.
  2. Let's Encrypt certbot to manage TLS certificates.
  3. frp tunnel from the home server to a remote host with a public IP (I use DigitalOcean but any hosting will work just as well).

The second third step is functionally very similar to Cloudflare Tunnels with two major differences:

  1. Cloudflare doesn't get to MITM my private data.
  2. I do not get the benefits of Cloudflare's DoS protection and similar out-of-the-box security features, so have to manage more of the setup (tls certificates in particular) myself.
spring jasper
violet nymph
# spring jasper Are you sure CF cannot play MITM ?

I do not proxy any traffic through CloudFlare and only use them to manage my domain.

So

  1. All traffic goes directly to my rented jump box that forwards it to my home without decrypting it (i.e. I terminate the TLS connection on my hardware at home) and no traffic except for DNS queries normally flows through any CloudFlare infra.
  2. Speaking hypothetically, if someone at CloudFlare went rogue, they still could MITM if they issued a new certificate for my domain and advertised their own IP for it but getting caught doing so would carry such an enormous reputational risks for them, that it is highly unlikely.
zinc merlin
#

if you speak of cloudflare, its easy to assume you mean as a proxy... usually the dns provider barely gets mentioned
but yes in your case, cloudflare will not see your traffic

i dont see how the second step is functionally similar to cloudflare tunnels though

thin tide
zinc merlin
#

yea but the second step is "Let's Encrypt certbot to manage TLS certificates."
the whole solution is similar with the difference that the provider doesnt MITM the private data

considering all that, I don't see much of a security benefit over just using a reverse proxy in your home network

violet nymph
violet nymph
hollow spoke
#

What would be the best way to expose immich as it's stable now?

zinc merlin
#

best way in which sense?

#

for me it is by using a reverse proxy and exposing it publicly so I can share photos with family, friends allover the world and also with e.g. people with similar interests like my sons guitar group

edgy creek
#

Nothing has changed in this regard since becoming stable. Same old still applies.

tepid hound
#

While I am exposing an url for accessing my immich through cloudflare, I still prefer using Tailscale for managing anything inside it

pale onyx
#

Same for me

hollow spoke
hollow spoke
wild lynx
# hollow spoke What is the "same old"?

As in nothing changed. Also secure depends on your personal requirements. For most people putting a proxy in front of it for TLS is enough. A next step might be using OIDC for login. And if that is still not enough for you, add filtering (e.g. crowdsec).

zinc merlin
# hollow spoke Mainly secure

that is defined differently by every person
if you do it correctly, using a reverse proxy is secure enough for me
doing it with a VPN is probably the easiest way if you dont have other people wanting/needing to access immich

azure latch
#

I have DMZ where is VM with podman with immich and on edge of DMZ is DMZRouter where I have haproxy with Lets encrypt SSL termination

hollow spoke
hollow spoke
azure latch
# hollow spoke Is your setup using podman much different from docker? Did you consider running ...

best for me is, podman does not have any socket like docker, so for first attacker can not attach socket to control everything (and also there are images, which attach this docker socket by purpose!!). Now I run it under root, because rootless is not requirement for me now. But yes, you can run podman as rootless, that is how I use it at laptop, but there is littlebit problem with UID/GID on mounted folders, because ot will chown it to some ID like 90 000 so from host it is perms denied

zinc merlin
#

before rootless does any good, they need to break into the container as well
which should be avoided anyhow 😄

worn blade
#

I use a WireGuard server installed on the machine where immich is and I access it as a WireGuard client.

hollow spoke
zinc merlin
steady forge
#

I am using Tailscale to access my Docker setup where Immich is running 🏃‍♂️‍➡️

high spade
#

If anyone is looking for a cheap VPS this seems like a great price
With 2 TB Monthly Transfer and 1Gbps Network Port
This is a significant upgrade from the oracle VM.Standard.E2.1.Micro I have
https://www.racknerd.com/specials/

I have no idea if they are good or not but at less than a dollar a month...I have nothing to lose

sage ridge
#

In addition to the other things some have mentioned... i also have a Firewalla Gold Pro ahead of the server, its a good hardware appliance that is NOT a subscription based security service, its a hardware prosumer appliance. Its got extremely controllable rules.

kind tinsel
high spade
remote widget
kind tinsel
high spade
remote widget
kind tinsel
#

You can continue using free forever resources without paying anything.

high spade
remote widget
high spade
#

Tell me your secrets.

high spade
remote widget
#

I've also killed the instance and reinstalled it numerous times. Think I only had restricted resources once

#

Yep. No $ added, just a card to charge.

high spade
kind tinsel
#

yes... please read the blog post

remote widget
#

It's worked well for me. However please know it's oracle, and stuff can just die

high spade
ivory lark
#

i rather just pay something i guess
though they wont take my card anyways so it's non starters

split rock
#

I want to reach my immich server over my domain address xxx-cloud.de. I configured caddy and I run a NOIP service on my Pi. In domain settings I set CNAME immich.xxx-cloud.de and activated dyndns option (without any further settings).
In android app i am getting Server not reachable when I try to connect to http://immich-xxx.cloud.de or http://xxx.cloud.de or without http:// or https://

fallow anvil
split rock
#

Yes but I think that my ISP is blocking 80 443 after researching and trying

#

Is there a solution for that?

thin tide
#

either cloudflare tunnels or your own jumphost in a VPS with a public ipv4

fallow anvil
# split rock Is there a solution for that?

I called my internet tech support to get the PPPoE username and password, then I configured PPPoE on my personal router instead of the ISP’s router.
After that, I was able to set up port forwarding myself.

split rock
#

Ok so I should ask

ivory lark
#

depends if blocking was done on your ISP router, or their side
my isp blocks 22 port from their side
even if i forwarded it
it simply wouldnt be reachable from outside

#

it's also possible to dump the PPPoE password/username on some routers, by using developer tools

split rock
thin tide
#

no. a jumphost is a vps that you setup yourself to route traffic from the WAN to your LAN

split rock
thin tide
#

if you don't understand any of the words I said I would not recommend this route

#

I guess you could use pangolin which is sort of designed for that

split rock
autumn sable
#

Since I updated from 1.137.3 to V2, I've had some issues issues where in order to view immich using my Domain name, I have to turn of CAching in Cloudflare. If I turn it on, it works for one or two requests but then just stops working completely. works fine via the local IP address, has anyone come across this before?

#

I did nuke all the cache from Cloudflare in an attempt to fix it but currently have to run in developer mode

split rock
ivory lark
# split rock Which tool I could try?

developer tools inspect element
it depends on the router if it's secure or not
some set it as type=password but include the full password as text back to the client

#

you might be able to crack the settings backup too
but no idea about that, it depends on your router and you will have to figure it out yourself

split rock
foggy sierra
spring jasper
zinc merlin
remote widget
zinc merlin
#

Wow really? I never took a close look but figured it just can’t work well on dynamic content as it is difficult to detect which parts may have changed on many sites
I used it many years ago and it was awful on anything not more or less static

remote widget
zinc merlin
#

My experience was many years ago but I had no luck with anything that was basically a web application

worldly wraith
worldly wraith
#

providers near me like xfinity or att allow it

#

or you can get a custom router with custom firmware if you use fiber connection

#

IDK for wireless networks though

charred spear
#

I setup with cloudflare tunnel zero trust, but this solution with required using cloudflare proxied, it limit the upload file size under 100MB. Therefore, big videos cannot be backup. I think the upload using chunk files will be implement in the future, but what is the best solution for now?

hollow estuary
opal panther
#

Or setting up the Automatic URL Switching to work when at home

charred spear
young valley
#

I have setup CF tunnel successfully for the past few month, only from recently, (mainly after 2.0 immich) My domain access to my server has been problematic. I can access the app, but very soon, it is timed out. then next day , it is accessable again, but if i were about to any search, it is timed out again. how do i troubleshoot this? If i access the app locally, it works perfectly, so it must be from CF side?

young valley
grand salmon
#

I have a reverse proxy (nginx) on a vps, which redirects the requests to my NAS over wireguard. But because I didn't want to expose any part of Immich directly to the internet I put it behind a login I made for a different app originally. This means there are two logins, but the HTTP header option in the app works, to access it and no API or anything is reachable by default.
The nginx config basically routes all unauthenticated requests to the login page.
In combination with fail2ban this feels like decent way to make it publically accessible. The login page access cookies are valid a year, so it is a minor inconvenience.

zinc merlin
#

dont think thats necessary, it is good for drive-by scanners though
just not sure why you run the reverse proxy on a vps instead of your home

if it works nicely for you then its all good 😄

pure mulch
#

nginx running on NAS with A record for immich proxied by cloudflare

zinc merlin
#

be careful running things on NAS, they are often outdated and have many exploits (unless its a self-made NAS and you are taking care of it)

cedar stump
distant crypt
zinc merlin
pulsar oracle
#

For people who are begind CG NAT, is Cloudflare Tunnels the only free option? Also should be have some auth like apart from strong ID Pass in Immich.

I use tailscale personally, but need to share the media!

thin tide
pulsar oracle
thin tide
#

No they didn’t, and you can use a VPN to pass raw TCP traffic

#

Even if you run your proxy in the cloud, ram inspection is MUCH harder than CloudFlare, which can easily log and see all your data

pulsar oracle
#

So I have a homeserver and CG NAT, how can I utilize Oracle

thin tide
#

You install WireGuard server on the vps and then pass the tcp traffic to your home server

#

There’s lots of guides

pulsar oracle
#

Understood, I will research and execute it'

#

Thanks'

remote widget
cedar stump
unique spruceBOT
cedar stump
opal panther
#

Locked not closed 🙂

zinc merlin
distant crypt
#

Oh well

#

Apparently we refuse to implement chunked uploads peepoShrug

high spade
pure mulch
misty sable
#

Or cheap VPS + wireguard to home server to proxy all your self hosted services

zinc merlin
#

for what?

regal blaze
#

I'm currently using immich on my umbrel with the nginx reverse proxy and cloudflare proxy.

However the issue is that cloudflare has a 100MB request limit for the free tier

#

And all uploads above 100MB are failing

#

Does immich not upload media in chunks?

remote widget
regal blaze
heavy crypt
heavy crypt
regal blaze
#

Does it have ddos protection

heavy crypt
zinc merlin
#

did anyone here actually ever experience any DDOS?
i personally never heard of any homelab being DDOS'ed which didn't belong to some kind of public figure (e.g. content creator or someone who operates some other well known website)

wild lynx
#

DDoS is the least of my worries. I’m not running an online shop that has to be online 99,999%

zinc merlin
#

Cloudflare does not provide full protection, it does a little bit in the free version but I personally don't see the added value over a self hosted reverse proxy

#

same here, data integrity and security is more in my focus

thin tide
#

DDOS is expensive to execute. No value in using it on the average self hoster

regal blaze
#

You right

zinc merlin
#

and DDoS on free users has happened in the past (public figures), from what I heard, those free contracts where cancelled thereafter (as defending a DDoS can also come with its costs which is not good for business on free accounts)

#

the trend does go away from DDoS and towards ransomware though

slow prawn
zinc merlin
slow prawn
zinc merlin
# slow prawn He is not a public figure. He's pretty confident that it was a DDOS. He tried to...

if you dont analyze it, you wouldnt be able to tell the difference between a DDoS, DoS or even some network problems at the ISP or at his own network...
pretty confident based on gut feelings without actually analyzing it...
the only way I would be "pretty confident" without analysis is if i pee'd on someones leg who would be capable of it and willing to pay for it AND that person told me they would do it

slow prawn
zinc merlin
#

unlikely, even for a small one, you would pay around 5$ per hour, assuming "a couple of days" is around 5, that would have cost a minimum of 600$
thats assuming he has a slow internet connection, if he has Gigabit or even 10Gbit/s links, that is even more unlikely

if he would say it was for an hour, ok... but days... who would spend such an amount of money to take down someones homelab that he doesn't even know?

slow prawn
#

Okay. Just assume I made it up then. Good chat.

zinc merlin
#

you are misunderstanding me, I am not saying you made it up
I am saying that my assumption based on the above statements is that he might have mistaken it for a DDoS while it wasn't
This is just because I don't know this person and I know how difficult it is to distinguish different issues from one another without analyzing it

Of course if someone had a serious grudge against him that has the connections and knowledge and is willing to spend that money just to piss him off and make this guys homelab unreachable from the outside for a while... sure that is a possibility as well

it could have been an ISP issue, isp router issue, issue with his network/server or even a DoS attack (which is different from a DDoS attack which is usually simply going for pure bandwidth exhaustion because that way you will be unable to block the attack at the final destination)

wild lynx
#

Somehow makes me happy we get a new IP address daily / on reconnect in Germany, just in case something does happen. Also ISPs have an interest to keep traffic low, so in case of a real DDoS they should be able to step in and blockhole that traffic. Though I'd say it's very easy to overload common home connections with a simple DoS.

zinc merlin
#

the times when internet reconnected every 24hours in germany was awful -_-

#

DoS: Typically targets specific server-side resources such as memory, CPU, connections (sockets), or application vulnerabilities. The attack is generally more focused on the resources of a single server or service.

DDoS: Typically aims to exhaust the bandwidth or infrastructure by using multiple sources, making it difficult to mitigate because the traffic is coming from many different places. The attack can overwhelm the network capacity (bandwidth) or can involve a mix of resource exhaustion techniques spread across multiple attack points.

#

that is just "typically" though, wording difference really is only one or many sources
in theory DoS could also use a bandwidth consuming attack and DDoS can go for resource exhaustion

wild lynx
regal blaze
wild lynx
#

You can add it manually to the self hosted version if you want. Just doesn’t go through a fancy UI.

#

iirc it also works on self hosted managed version. But that barely counts as self hosted if the management layer is on their side.

regal blaze
wild lynx
#

I haven't done the geoblocking part, but the documentation for it did not seem too bad.

zinc merlin
#

you can set up geoblocking with a self hosted reverse proxy...
I do actually do that... i have config files so that i just need to "include internal/whitelist/blacklist/customX/.conf"
my whitelist is the most restrictive, allowing only countries I go to frequently
my blacklist just denies some untrustworthy countries
my internal.conf allows access only from my internal LAN
for sites like nextcloud and immich that I use to share things, i only use the blacklist

i use some auto-fetching (maxmind) of the geoip database and use that for geoblocking
it could go down to city I think but I only use it for country blocking

regal blaze
zinc merlin
#

what do you mean with VPNs?

regal blaze
zinc merlin
#

you mean like NordVPN?