#Exposing Immich to the internet

1 messages · Page 6 of 1

zinc merlin
#

i havent done it but you should be able to, afaik the maxminddb includes information like the organization
so you could block on organization of "NordVPN|ExpressVPN" etc.

#

looks like they do have it

regal blaze
#

oh

zinc merlin
#

it seems that using that comes with a cost though, free one might only include city and country data (like city name, postocal code, longitude/latitude,state name,state code,continent code and country code)

regal blaze
#

yeah idk

zinc merlin
#

?

regal blaze
#

also does this exist

spring jasper
#

After trying reverse proxy, wireguard (with port forwarding), cloudflare tunnel. Eventually I settled with Tailscale.
I'm not believe myself about my networking and security experience! Paranoid 🤣

heavy crypt
#

The "Enterprise edition" of pangolin is free to homelabbers. All you have to do is create an account and agree to an attestation that you're not using it for a business and they give you a key to unlock it.

Also, geoblocking is a bad practice. You are much better off setting up something like crowdsec. Geoblocking will inevitably block legitimate traffic and you'll spend hours trying to figure it out before realizing it's the geoblock.

naive oxide
#

I undestand the cloudflare upload limit but what would be the paid approach to cloudflare tunnels ?

zinc merlin
lucid torrent
#

I have my immich instance exposed via Cloudflare tunnels too.
immich.mydomainname.com>cloudflare access control>cloudflare tunnel> immich login page > Authentik oAuth > Logged in.

i have one question fot the group..

if i disable email login forcing only Oauth. What happens if my Oauth instance does down? is there a way to get back in?

unique spruceBOT
lucid torrent
raw jackal
#

What are the risks of just exposing immich to the web raw? I just connect to my home's public IP with http

distant crypt
zinc merlin
distant crypt
zinc merlin
#

🤣 yea I couldn't ^^
I see it now though... must've magically appeared

#

those two messages even ^^

#

I blame Daniel for hiding them

distant crypt
spring jasper
scarlet stream
#

Noobie here i buyed a domain name and cloudflared it to it, so i can access it very easily and share some pics too!

wild lynx
scarlet stream
#

Thanks ! Ive seen its a request size limit, so its okay for a lot of my work!

vast sparrow
scarlet stream
#

Then its good for me curently ! But thanks ! 😄

wild lynx
#

Yeah just something to be aware of. I’ve recently seen someone going through a ton of data usage because the video upload kept getting rejected by CF.

lethal plume
wild lynx
#

You can define a local URL to upload when you are in your home network/vpn. There is work in progress for chunked uploads but will still take time.

coral valve
#

Can folks ELI5? I wanted to reverse proxy but after hours of troubleshooting, I realized my ISP (Cox) blocks port 80 inbound. So I can't reverse proxy. I don't want to VPN (e.g., Tailscale) because then I either deal with battery drain or toggling the VPN on/off. I could do that personally, but it would never fly with my family members. Cloudflare seems to have privacy concerns with using their proxy service. VPS costs additional money to host.... Am I missing anything? I am not an IT guy, just looking for a simple way to host without just opening ports willy-nilly, because that internet says that is really bad.

thin tide
#

you can also call your ISP to try to get 80 opened

coral valve
shy dock
#

U can use dns challenge and try to open 443. Do they block that as well. Idk if it’s assumed 443 is blocked if 80 is blocked.

gaunt ruin
coral valve
coral valve
thin tide
coral valve
thin tide
low nexus
coral valve
coral valve
shy dock
#

I have only 443 open. And nginx redirects all http to https. I’m not sure why it works when 80 is closed. But it does work

#

Maybe that’s the browser thing that Zeus was mentioning

#

But even when I curl for the headers, I get the correct 301 redirect response

wild lynx
wild lynx
shy dock
#

Oh wait. Maybe u mean even when I put http, it automatically tries https first?

wild lynx
#

Yes.

#

HSTS also plays a role if you ever enabled that.

coral valve
#

Tangolin looks like an interesting option for me. I wonder what impact it has on speed. Sounds like it adds an extra stop for the data to pass through (client-->pagolin on vps-->host device and back again). I'm usually not dealing with huge files but some video uploads on immich could be larger, or if I connected my plex server.

wild lynx
#

The extra hop will add a bit of latency, but bandwidth should remain the same mostly. As long as the VPS can handle the speed of course.

low nexus
regal blaze
#

You should be forcing https either way

thin tide
regal blaze
thin tide
#

Most people mean putting a 301 redirect on 80 to force traffic to 443

regal blaze
#

HSTS

thin tide
#

HSTS is an option yes, pending browsers all following it

#

I wouldn’t call it forcing because it’s still up to the browser. Won’t work for stuff like curl

regal blaze
#

dont modern browsers already try https before http though

wild lynx
#

Also to get the HSTS policy, the browser first has to access the page somehow. Only from the second request onwards the HSTS policy will apply. Unless you are on the preload list.

limpid bramble
#

I'm having problems with the cloudflared tunnel that I was instructed to setup for Immich, and I have no idea how to fix it.

#

Sometimes Immich will come up, but most of the time it lands on a Cloudflare page that says "Bad Gateway"

#

(it works locally perfectly btw, this is externally)

#

And before anyone tells me about VPNs and Tailscale again, those are impcractical for my use case of simply giving people a link and having them, no matter how their technical skills are, able to access stuff - among other reasons. I already have this setup, and it was working for months, I just want to fix it.

#

I suspect this is a problem with our new networking stuff, the new Unifi stuff, but we have no idea what settings could be messing with this.

#

When it is *kind of *working, and I click on an image, it'll sometimes spit this out

📎 message.txt
#

And other times, it'll just be a black screen, and othertimes, the image will come up like normal.

#

I'm on the newest everything

#

Newest Mac, newest consumer ethernet speed (10G), newest Immich versions...

limpid bramble
#

We have Ubiquiti equipment, moved from an EdgeRouter (ERX) to a Cloud Gateway Fiber (UCG-Fiber) and it's mostly set to defaults. The config file from the ERX could not be read by the UCG, so all the port-forwarding and static-IP addrs had to be entered manually. Previously, 2283 was forwarded (its in the CFG file), but using CloudFlareD obviates this by using tunneling, right? But to make this work, I'm told that DDNS needs to be set up so CloudFlare, which is resolving our IP address, gets our WAN address if it ever changes. The dialog box on the UCG asks for four data: Service (CloudFlare selected), Hostname, Zone name, and API token. We got the token from CloudFlare as it is shown in the bottom-right corner of some page (right below the Zone ID), but we're unsure how to populate the Hostname and Zone name fields. Initially, we tried iredredux.net (the top-level domain name) in both, and that didn't work. We tried, changing to the subdomain (im.iredredux.net) for the Zone, and that didn't work, and then we tried the subdomain in both. No go. I had port-forwarding for 2283 back in the list until Red said it was no longer needed [because tunneling]. At this point I'm wondering if there's some other UCG setup that needs to happen, like in the Firewall somewhere. (Red's Dad)

#

(From the master of the network)

zinc merlin
#

Did you check the logs for any issues? Maybe open a helpdesk thread with all info requested and maybe a video of what’s happening

limpid bramble
#

The helpdesk thread can be seen. It wasn't fruitful.

#

Right now it actually seems to be working. We did some things last night (specified above) that... might... have fixed it? Strange to me that it maybe didn't take effect immediately. I'm very used to that. (Red)

#

I'll check back in if it breaks again.

zinc merlin
#

do you use caching on cloudflare?

severe lava
#

Are there any specific Immich rulesets being used for Crowdsec or the common consensus just running this mostly default?

vast sparrow
# severe lava Are there any specific Immich rulesets being used for Crowdsec or the common con...

There is an immich collection to use with crowdsec to parse logs files and have immich bruteforce detection, and that adds some attack scenarios to detect :
https://app.crowdsec.net/hub/author/gauth-fr/collections/immich

Idk how much it is efficient, but it's here :)

Collections, AppSec Rules & Configurations | CrowdSec Hub

Manage collections, configurations, remediation components, and AppSec rules with CrowdSec Hub. Streamline security with tools and integrations for enhanced protection.

summer fjord
#

guys

#

question

#

i made a python script that spams requests to immich login api

#

and it can do ~300 reqs per second

zinc merlin
#

why?

#

what for?

summer fjord
#

a hacker can brute force

#

i wanted to test if there is any resource rate limit

zinc merlin
#

there isn't if you dont configure one on your reverse proxy afaik

summer fjord
#

oh okay thanks

#

also what security concerns should be resolved by reverse proxy

zinc merlin
summer fjord
#

thanks

zinc merlin
summer fjord
zinc merlin
#

sorry, then i misunderstood the question

summer fjord
#

np

zinc merlin
#

if you elaborate, i will try to answer

zinc merlin
#

you can harden your reverse proxy with many different approaches...
https://www.cisecurity.org/benchmark/nginx
secure ciphers/versions/protocols
secure headers
blocking/limiting/detection
2FA/authentication
obscure identification
blocking based on unusual behavior, using things like crowdsec/modsec or even WAF-like plugins
best practices (disabling certain things, etc.)
lots of options here

CIS
CIS NGINX Benchmarks

Download our step-by-step checklist to secure your platform: An objective, consensus-driven security guideline for NGINX.

summer fjord
#

thx

#

actually rn im setting up pangolin

#

heard its good

zinc merlin
#

cant say, never tried it

severe lava
vast sparrow
severe lava
vast sparrow
#

like the immich one

severe lava
#

Ohh I shoud have specified that I run ODIC so monitoring for brute forcing doesn't really add value for Immich specificly. Sometimes there are more application specific collections aside from BF protection

severe lava
vast sparrow
wild lynx
#

Immich will not work with custom authentication in front of it. You need to trust the built in / oauth login.

wild lynx
#

You could put Authentik itself behind the Pangolin Auth. But tbh I don't really see any added value in such a double login. You could add a third factor to Authentik at that point.

#

Ah forget what I said. Protecting the Auth provider would break the flow anyways. Double auth just is not worth the hassle with oidc.

#

So yes. Basically overkill. Make the login flow on Authentik secure enough and add "standard" detection patterns via crowdsec. You probably are not a huge company that gets attacked non stop anyway.

wild lynx
#

Mostly just having a second factor. When I used Authentik I changed to Password + Passkey for Authentication. TOTP should also be fine though.

real maple
thin tide
#

Hot take. Many of us do it with no issues. 1) immich hasn’t had any login bugs (yet?) 2) with properly configured reverse proxy, fail2ban, crowdsec, geo blocking, the risks are honestly pretty minimal. Obviously this requires some reading and knowledge

real maple
wild lynx
#

What a weird take. Leaving a door unlocked is like disabling login alltogether. Not a comparison at all lol.

#

If we could not trust OAuth libraries the internet would have a huge problem

zinc merlin
# real maple This is not true, and "trusting immich's login mechanism" is awful advice. Do no...

next time maybe write it once you have the time to elaborate 😉

"This is not true"
is not true! putting a custom authentication in front of it DOES break the Immich mobile app!

the way you phrase it, it sounds like the login is a "trust me bro" implementation
afaik, immich uses standard implementations of login and oauth, oauth relays the authentication to the oauth provider
this already gives you MFA
you are also able to use client certificates and custom headers if you are a little paranoid (which I am not saying is a bad thing)

it is very common to not implement your own authentication suite into your product and instead rely on third parties for more advanced implementations and I would say that the login implementation gives a lot of room for your security needs with oauth, client certificate support and custom headers if you do not want to rely on a simple username and secure password version.

You need to trust the built in / oauth login.
This is true, otherwise you need to know how to audit the public code yourself!
If you put a custom authentication in front of something, you need to trust that as well
For me personally, the downsides of a custom authentication just put in front of it outweigh the benefits

now, is it more secure to put a custom authentication in front of it? yes
is it more secure to use a VPN and not have it publicly accessible? yes
is it more secure to not even have a VPN or even leave it offline? yes
there are always ways to make it more secure, everyone needs to find their reasonable access/comfort to risk ratio

a secure password and a properly configured reverse proxy already goes a long way!
fail2ban and geoblocking help as well (though I personally think the benefit is very limited)

#

many people leave their door unlocked without issues
now this part I do not like and have the impression is very provocative at best...
using the immich login implementation has absolutely nothing to do with leaving the door unlocked
If anything, it’s more like choosing a standard, well-tested lock instead of hand-carving one. The analogy just doesn’t track, and it distracts from the actual technical discussion. Let’s stick to concrete points about the implementation rather than dramatic metaphors.

crystal sundial
#

I just started using a cloudflare tunnel with rate limiting for incorrect logins and page loads to protect against brute forcing.

zinc merlin
#

you can do the same with a reverse proxy

#

rate limiting in general on e.g. the loginpage and also use things like fail2ban if you like

crystal sundial
#

True but I do like the idea of my home IP not being advertised to the WWW and having zero forwarded/open ports on my router/ufw

zinc merlin
#

Open ports are not a security risk in itself

zinc merlin
#

If there were a vulnerability, it would carry across cloudflare to your server anyhow

crystal sundial
#

It's not really about 'hiding' the vulnerability—it's about infrastructure and defense-in-depth.
I actually use both (Tunnel to ingress, Caddy for local proxying), but here is why the Tunnel is non-negotiable for me:

  1. Zero Ingress: My firewall is strict default-deny. I don't have to open ports 80/443 on my router or worry about scanners/Shodan hitting my residential IP directly.
  2. Resource Offloading: I’d rather Cloudflare’s edge handle the WAF, DDoS mitigation, and bot filtering than burn my own CPU cycles and upload bandwidth fighting noise at the modem level.
  3. ISP Independence: Tunnels bypass CGNAT completely, which is a lifesaver if your ISP doesn't offer static IPs or blocks ingress ports.
    It’s less about fear of open ports and more about keeping the attack surface off my actual hardware.

Oh, and it’s free.

thin tide
# crystal sundial It's not really about 'hiding' the vulnerability—it's about infrastructure and d...

Yes, but there are downsides that make it more of a “debate” than you suggest:

  • you are dependent on an outside infrastructure (recent outages notably have affected CF)
  • more importantly, CF (and anyone with control over them - US gov?) can see (and edit) all your data in plain text as it transits the data center
  • unless you setup split DNS and get an SSL cert anyway, pings at home (where you usually are) will be slower than they could be
#

Also, your own hardware still is a major attack surface because at the end of the day many (but not all) requests are still passing to your backend service. Whether the incoming port is open or not isn’t the only factor here

#

If you use only OIDC login with CF, that does mitigate the last issue

crystal sundial
#

Valid points, and I actually agree with you on the trade-offs—which is why I don't use the Tunnel in isolation. I treat the Tunnel purely as an Ingress Controller for the WAN, not a replacement for local networking.
To address your specific downsides:

  1. Latency/Local Access: I specifically set up Split-Horizon DNS (using Technitium) and a local Caddy reverse proxy to solve this. When I'm on my LAN, DNS resolves directly to the local server IP, bypassing the Cloudflare Tunnel entirely. My local speeds are line-rate (Gigabit), and I'm not dependent on the Tunnel for home usage.
  2. Outages: Because of the Split DNS setup mentioned above, if Cloudflare goes down, I only lose remote access. My local home lab remains fully functional and accessible via the local domain.
  3. Privacy: You're right that this is a trust tradeoff. I am trading the theoretical privacy risk of TLS termination at the edge for the concrete security benefit of their WAF and Zero Trust policies. For my threat model (hosting family photos/media vs. storing state secrets), offloading the attack surface is worth the encryption tradeoff.
    It's definitely a debate, but I've found a hybrid approach (Tunnel for WAN + Split DNS/Reverse Proxy for LAN) covers the bases you mentioned.
gilded nest
crystal sundial
# gilded nest unless you have an enterprise plan, the protection you get from CF is very limit...

It's all relative. Compared to an Enterprise plan? Sure, it's limited. But compared to a naked residential router with ports 80/443 open to the world? It's a massive upgrade.

The Free plan successfully:

  1. Masks my home IP (preventing direct network attacks).
  2. Blocks all port scanners/shodan (since I have 0 open ingress ports).
  3. Handles basic bot challenges.

For a home lab hosting family photos, that's plenty of protection for $0/month.

remote widget
#

I personally don't like giving CloudFlare access to all my media. All of the same can be accomplished with a VPS acting like a reverse proxy, with the added benefit of their business model not relying on inspecting all traffic that flows through their servers to find a way to monetize it

lucid torrent
#

Hi Team, I need some guidance/ assistance with my setup.
I have exposed immich to public web successfully via cloudflare tunnel and zero trust access.
So when a web browser logs in, its presented with Cloudflare zero access. after clearing that, its redirected to my immich instance where OAuth needs to happen for login. This works just fine for web. However, the OAuth flow breaks for Mobile app.

for mobile app. i would like to bypass the cloudflare access via mTLS. which is successful. however, when i attempt to login via mobile app. i get invalid redirect from my OAuth. How do i resolve this?

tired loom
# lucid torrent Hi Team, I need some guidance/ assistance with my setup. I have exposed immich t...

Have you tried this?

also please note, CloudFlare Tunnel restricts you to 100mb per action so if your trying to upload a video or image over 100mb, i will fail

https://youtu.be/J4vVYFVWu5Q?si=TPVVUd9gXMf0WEIn

YouTube
Thomas Wilde
Can't get past ClouldFlare Zero Trust on Mobile? Do THIS!

You've put your self-hosted Immich application behind a forward authentication layer like Cloudflare Zero Trust (or maybe a self hosted Authentik or Authelia?), but now you can't get the mobile application to work. Noooo!

It's ok! That's why we have service access tokens. So we can get our mobile app to still communicate with our API by bypas...

▶ Play video
worldly wraith
real maple
#

Yea, I'm not gonna bother with the attitudes here. I don't claim to be the best infosec expert around, but it is my day job. There is so much wrong with almost every "Support Crew" reply here I don't know where to begin, so I won't. Almost every reply to my alleged "hot/weird take" is just defensive attempts to prop up bad recommendations by "proving" a negative with anecdotal non-evidence. Some of this bad advice can have real consequences. I was going to correct your errors until you demonstrated that the Support Crew, as a group, don't appear to be concerned about safety or open to learning, you jump straight to talking down to people you disagree with. Childish behavior.

My comment about leaving the door unlocked was quite obviously not an analogy, (even less so a "metaphor"), so taking it as one just to try and sound right is.. wow. I was obviously pointing out that this is anecdotal non-evidence, and you're trying to prove a negative. A few people not having been hacked, assuming you'd even know it if you were, means absolutely nothing.

I wrote a long-winded detailed explanation, but work needed my attn and I'm in the middle of a move. On top of that, Discord seems to have deleted it. When I had time I came back, all I see is snark and nonsense so I wasn't going to bother to reply, but someone with some sense did so I'll at least contribute this.

Even simply pasting the conversation into ChatGPT and telling it to point out why you're wrong is enough to prove my case, while incomplete, so for giggles I did that much for you. I sure hope the attitude and these recommendations of the "Support Crew" aren't representative of the dev and his team's mindset. I highly suspect they aren't. If they are, you're only proving further the need to layer up and not blindly trust the project.

My comments were never a dig on immich itself. If you had experience in the space, you'd know that the risks here are the same that putting any community server project online (particularly with an open port on your home network) brings - namely, that there is a lot more at play than just the OAuth protocol implementation in a library, which is being hailed as the end-all-be-all here.

I would suggest that you stop being blinded by ego and be open to learning. I comment only for the sake of those who read these recommendations later, are open to learning, and to say that @crystal sundial is correct about everything he mentioned. The Support Crew members for the most part have demonstrated that they are biased at best, and only have a partial understanding of things, and as such don't really have any business commenting on what is secure and what isn't. Until they demonstrate otherwise, I wouldn't follow their advice. Do your own research (the actual, non-echo-chamber kind). Those of you employing CloudFlare and mTLS are on the right track. I'm still learning myself, that's the point of a homelab, but I see holes places where others might not, and you won't catch me certifying things as "secure" or even "secure enough" on a whim. If the attitudes were to change, and assuming I have time, I would be open to answer questions and elaborate.

I'll close with: if immich were open-port-worthy as you suggest, the project below wouldn't exist. As I said, I would argue almost no community-run server project is, especially one this new. As historical supply chain / watering-hole attacks have demonstrated, even "proven" projects are subject to new attacks. Heartbleed, Shellshock, and countless more were huge issues in ancient projects. Even the project below, created with the sole intent of being secure, needs to be implemented carefully in order for it to actually achieve the goal, and that wouldn't involve an open port. Someone suggesting you open one on your home router in 2025 is a good first hint you're talking with someone who's knowledge is, at best, out of date.
https://github.com/alangrainger/immich-public-proxy

hollow estuary
#

Just a reminder to everybody here to be open minded and to keep the discussion sane. We all come from different background, with different experiences, there will be things we won't agree on and it should be ok to have disagreement. 🙂

real maple
#

I'm all for being open minded and that's what I'm suggesting, but security isn't something where anecdotal evicence and different backgrounds really matters. It's generally either secure or it isn't at the time it's being discussed. Some of the questions are being confidently answered here with wrong information and bad advice that can get people in trouble.

hollow estuary
real maple
#

Overall Immich is a great project and I really appreciate all the hard work you've put in btw @hollow estuary . It's fantastic as it is and is showing even more promise with each update. Great work from you and your team.

hollow estuary
#

Thank you

wild lynx
# real maple Yea, I'm not gonna bother with the attitudes here. I don't claim to be the best ...

Just to be clear: I’m open to hear your concerns anytime. As your first reply was about one of my statements, I’d be VERY interested why me saying the Immich App only works with the supported authentication methods is not true.

It is not my intention to give bad advice and most of my experience is based on my work where I manage authentication and authorization for over 100 developer teams. I don’t claim this experience is the end of all, but just my current state of understanding how things work and at which point you are starting to over engineer for a potential problem while still having other holes to fix. Again: I’m happy to hear what other Immich users are doing and how they protect their infrastructure. There are a lot of ways to do this that don’t break the authentication or rely on big tech - even in 2025.

cinder adder
thin tide
cinder adder
#

I know the dns proxy limits it to 100mb.

#

But I've never used the new CF tunnel.

#

The tunnel that ppl these days use to expose a backend service w/o having to open ports.

thin tide
#

Yeah, that uses the proxy.

regal blaze
cinder adder
#

Hmm ok thats enough reason for me to stick to my current setup then.

wild lynx
#

cf tunnels only change how cf connects to the target, so the same limits apply.

real maple
#

@hollow estuary I saw talk of chunking/resuming support in I believe the 2.0 release notes or at least the new version of the backup engine. could you speak to whether this was a response to Cloudflare’s 100mb limit and if there has been any success with overcoming it? I have had strange results on my instance that I haven’t shared yet.

thin tide
unique spruceBOT
thin tide
#

This is blocking on interaction between CF and Apple - as far as I know, until one side patches it, we cannot progress on the immich end

#

Basically, Apple supports RUFH, which we want to use, but cloudflare doesn’t support using the spec as written (and may have very little incentive to change this to enable larger uploads)

real maple
#

seems odd we would be beholden to RUFH on the apple side. i may not have read everything yet. this is what i had read previously and was referring to
https://immich.app/blog/sync-v2
this phrases it as if it is a requirement for a stable release, and 2.0 was dubbed "stable", so i wondered if this implementation was already live. i have noticed that turning the old and new "timeline" on and off causes syncs to behave differently, particularly over cloudflare, and I prefer the greater detail I get on the "old timeline" UI, currently. The "old timeline" implementation seems to think it is sending the entire file successfully to somewhere, even if cloudflare is ultimately rejecting it somehow. on the new timeline implementation, i can't really tell what's happening.

#

in any case, i didn't know if this chunking implementation was intended to solve the cloudflare issue or just large syncs in general. and i'm real curious why the transfer on a 300+mb video doesn't just die at 100mb and instead continues through the whole job, but none of them actually show up in immich

hollow estuary
#

The blog post is for the data synchronization mechanism between the server and the mobile app, not related to upload implementation

thin tide
#

Regarding being beholden — we sort of are stuck complying to apples approved paths if we want to have the best background experience. Apple limits these activities severely

nocturne vessel
real maple
#

thanks for the insight guys

shut harbor
#

I've got two instances, one personal instance that never goes on the public internet. I have no reason to put it on the internet, but I have good reason not to, so I will not expose my personal photos.

However, Immich is quite useful for sharing photos during/after a trip, or sending/recieving the full, high quality photos from folks
I have a public instance exposed either thru a CF tunnel if I need a pretty url, or through tailscale funnel to avoid the 100MB upload limit. This instance only has very few photos, that once shared/recieved, are placed in the private instance.

Eager to hear your guys' opinions on this way of doing things!

wild lynx
zinc merlin
# shut harbor I've got two instances, one personal instance that never goes on the public inte...

I also think it's reasonable
You don't want your personal photos on an exposed service and also have no need to and you accept the extra work this brings with it -> perfect use case (you seem to be aware of what you want).
You consider and minimize risks on the public instance.

Now, as long as you understand the setup and weigh benefits and risk for yourself, then it is all good...
many people have different opinions and preferences.

one thing I would add is to make sure you have proper backups of at least your photos!

Some off-topic to your actual question and just some rambling/general things:

I am generally not a fan of CloudFlare for Immich, simply because in my personal opinion, the actual security benefits in this case are minimal and for me do not make up for the downsides (like the 100mb limit, my decrypted data being present on their system and "analyzed", etc.)

there are other solutions I prefer for different use-cases
Personally, I like to run my own reverse proxy for my use-case.
I am always happy to explain my view and why and how I would do things a certain way (this can obviously be different from other people, especially because they weigh different aspects differently than I do or have more or less information/knowledge about a certain topic)

e.g. if you have little knowledge about security best practices and use immich just for yourself and maybe your spouse, a wireguard tunnel to your own reverse proxy which is not publicly exposed may be the best solution for you...

but if you are not afraid of the work and have the need to share with many people, a hardened setup with your own exposed reverse proxy may be the best solution for you
there are always ways to make your (or any) setup more secure and you need to find a balance for yourself

there are also setups created to get around restrictions like CGNAT

shut harbor
# zinc merlin I also think it's reasonable You don't want your personal photos on an exposed s...

Yeah, I just have kept it simple. I guess for me right now, the benefits of a self-hosted reverse proxy (pangolin maybe?) don't really outweigh hassle that I would put in to it. Also, since I'm not very familar with security, I'm fine paying cloudflare a bit to not have to worry about it. But maybe that's not the right way to think about things!

I would like to hear more about your privacy concerns with cloudflare, because that might be enough reason for me to self-host my own reverse proxy.

(oh yeah btw for my personal instance i just use tailscale for remote access)

thin tide
zinc merlin
# shut harbor Yeah, I just have kept it simple. I guess for me right now, the benefits of a se...

Love to!
My privacy concern with CloudFlare is simply that it is decrypted, partially analyzed, then encrypted again.
I don't know what exactly they do with my photos and other decrypted data.
With many photos I don't care so much but I am more protective about my childrens photos.
Now if that is a concern for you or not is for everyone to decide... less of a "concern" than usinge Google Photos but definitely something to consider if your a concerned about privacy!

My personal belief is also that CloudFlare does not offer that much actual added protection for immich.
It provides DDoS protection (anything medium to major could lead to them canceling your membership as you are not a paying customer but every DDoS attack will cost them actual money), GeoBlocking (which can also be done on a reverse proxy), basic rate limiting (which can also be done on a reverse proxy).
Now the security benefits it does give are basic WAF / threat capabilities: this blocks things like Top10 vulnerabilities like sql injections and cross-site scripting (I would say these don't apply to immich and if there were an actual vulnerability on immich, immich is likely too small to be included) and also blocks a few known attackers IPs (the first part can be done (maybe even better) with modsec but I would consider this hard to implement or with an actual WAF like bunkerweb and the latter has alternatives like crowdsec)

PS: tailscale / wireguard is perfect for personal instances where you don't need others to have access to

thin tide
#

I also use crowdsec which can detect many of them more easily than bunker web or mod sec which is much harder to setup

#

Crowd sec also uses peer sourced IP ban lists

#

I agree with everything you said btw!

shut harbor
zinc merlin
#

Personally I think CrowdSec gives a benefit but mainly for keeping logs sane, in my opinion it does not offer much long term protection
there are not really any downsides to it other than the added work of implementing it though

thin tide
#

It does nothing for a targeted zero day , but that’s what containers, VMs, and sandboxing are for

zinc merlin
thin tide
#

Running services on a wildcard subdomain and avoiding common ports cuts out many of the zero day scanners

#

I never got hit with the Emby vuln for example

#

But people with default port got pwned

zinc merlin
# thin tide I like it because 1) bad actor IPs will often try the “low hanging fruit” first ...

it reduces the likelihood but does not protect... illegal scanners will find you, it will just take longer...
it has no downsides though, so it is definitely good to have it

I also try to stay off of official (and unofficial if possible) scanners by not having a default site and/or certificate on my IP / reverse proxy and also block the ip ranges of those scanners as those are usually published for those "legal" ones

"obfuscation" makes you harder to find and might keep you off of the "low hanging fruit" list but will not protect you (just to clarify: this is still good but it does not offer protection in a direct sense... indirectly it does to a degree)

I try to add those layers, obfuscate as much as possible, assume that obfuscation does not protect me and add actual protection and harden where possible (e.g. most vulnerabilities rely on internet access of the server, if you limit that outgoing access to only needed services, it adds another huge barrier)

thin tide
#

And I block shodan etc from the firewall as well as some geo blocks, again all cuts down on noise nothing can 100% protect.

#

Security is all calculated risks

zinc merlin
#

completely agree 🙂

thin tide
#

One thing I did recently is I moved every service into its own docker network stack and then connected all these to nginx.. this helps reduce lateral attacks

#

Many people use a proxy network but IMO this provides no protection

zinc merlin
#

😄 yea I do the same ever since I started...

#

important... i have a lot of security based on connections between containers... no need for a container to be able to reach another container it is not associated to...
I just don't have any actual firewall rules in place on those networks between containers, so it is bidirectional access

thin tide
#

I make most of my containers talk to each other through the proxy unless they are I. The same stack

#

For example sonarr and qbittorrent

#

This gives me more visibility into the metrics etc

zinc merlin
#

yes, same
I have different kinds of networks:
1.) connections between containers, these allow no outside connections and only between containers connected to this network... I have one or more of these per stack
2.) one network for each container which needs to be accessible via the reverse proxy, the network is limited to the reverse proxy and that one container only
3.) a network shared between all containers who need external access, this network connects to my firewall and allows no connectivits to IPs in the same network (the proxy is in a different network on its own,
so they could in theory connect via proxy to any other services if the firewall rules allow it)

#

all that is just another layer of security... and just in case they ever were able to get access to any container...
of course there is tons more I could add... e.g. I don't run true rootless yet 🙁

thin tide
#

I have them segmented but no rules on them.

zinc merlin
#

I also have no rules on them, the complexity of using iptables or nftables on docker networks is too much for me

#

I just make use of different bridge and network types

#

e.g. I do not use the default bridge ever as that one gives network access through the host

thin tide
#

Maybe that what I mean. I think all mine are bridges

#

I don’t use the default but I don’t change the settings on the others

zinc merlin
#

for 3.) I use private macvlans

#

if you have no external firewall vlans, you can try to create something like public and private bridges

#

basically ones allowing ip forwarding but not allowing container communication and ones not enabling ip forwarding

thin tide
#

I’ll look into it
I’m not sure what you mean by fire wall VLAN. I have UniFi now but I don’t segment the traffic within each machine into VLANs yet

zinc merlin
#

my firewall also segments my actual network
I have the following VLANs which have a relation to container functionality:
ProxyVLAN: This VLAN is solely for my reverse proxy
Dev VLAN: This is a VLAN which I can directly access but is not accessible from "untrusted" networks like the internet. I use this to try out containers before making them accessible via reverse proxy
DMZ: network to access public resources for containers I consider trivial (not holding any valuable data or not needing a lot of security for whichever reason), this gives unrestricted outgoing internet access, this is not used much
SecureDMZ: network with restricted internet access to destinations a container might
InternalDMZ: network to access resources on my network from containers without additional internet access

I also have several Client VLANs like Guests, Kids, IoT and "Secure"

Traffic between those networks is handled by the firewall

I mentioned the above bridge possibilities in case one does not use VLANs on their network (as most only have a flat LAN at home)

#

of course this suffers from time contraints and e.g. containers stay on the DMZ for longer than I plan (as I need to find out what they need access to and allow this on the SecureDMZ before moving them there)

zinc merlin
#

I make use of the prefix option to differentiate between the different kinds of networks I use in case I take a look at them inside of the container

#

with the options you can adjust bridge behavior to what you need

#

#1122615710846308484 message
that conversation I linked here above is talking about a similar topic and some more insights if anyone is interested

zinc merlin
thin tide
#

You canDIY it super easily if you want. It’s for a VPS in the cloud. Only should be used if you have CGNAT. Stop worrying about your IP leaking 😛

shut harbor
zinc merlin
shut harbor
zinc merlin
real maple
real maple
#

Things you're right about:

  • A home reverse proxy is better than nothing, could allow for e2ee (mostly) and some of the protections Cloudflare can provide can be provided at home by various means (with a big but...).
  • Cloudflare (for a split second, likely in ram) terminates TLS, because they pretty much have to to function as an https/mTLS destination and proxy. If Immich wanted to, they could implement encryption on their own for "e2ee" in transit purposes. If they did, Cloudflare would be blind despite TLS termination.
  • "tailscale / wireguard is perfect for personal instances where you don't need others to have access" Correct except that last part. It's perfect for where you don't need the public internet to have unadulterated access. You can divy out access via tailscale, twingate, WARP, other solutions with trusted people/devices.

Things you overlook:

Self-hosting a reverse proxy at home...

  • Exposes your home IP which could have been stealthed, and now opens you up to things like directed and highly-effective DDoS attacks should someone be inclined, when the same attacks wouldn't affect Cloudflare (and by extension, you.)

  • Requires a permanent open port, which attracts massive attention from attackers beyond normal ambient web traffic, and allows for recon and attempts at more vulnerability exploits deeper into the network

  • The "Raw" attacker packets this open port attracts traverse your modem, router, and potentially other network equipment at home, all of which run their own OS and software, before reaching your server, os, and server software. All of these are additional potential attack surfaces that you are now defending personally, rather than a billion dollar company responsible for large portions of the world's architecture that have seen every type of attack under the sun. They have a 24/7 funded, manned SOC and years of collective experience blocking threats baked into their rulesets. Home users have a Chinese modem and router, likely with out of date firmware and no IPS/WAF.

  • Things like Access + mTLS on the external Cloudflare side, plus the Cloudflare Tunnel itself means that exactly zero traffic intended for the open port on Cloudflare's side gets through that doesn't originate from a known-trusted device, or Cloudflare. Yes normal internet ambient traffic still hits your router, but it is met with a very simple "deny all inbound" rule and no response that again reduces attack surface and dissuades attention since your equipment is stealthed.

  • "Cloudflare is analyzing my traffic" with a comparison to Google Photos - highly unlikely. They process your traffic but calling it "analysis" aside from WAF rules is pretty disingenuous. They perform the operations necessary to perform the network actions you asked them to perform, like re-encryption on the way to your server, redirection, WAF filtering, etc. At worst, if they were hacked I might worry about passwords being passed over the pipe. They're not analyzing your photos with AI or anything of the sort Google would have a vested interest in doing when you store photos with them. It would be costly and likely introduce massive latency. If they were caught doing this I'm sure there would be massive lawsuits. Companies this big have open privacy policies they adhere to, and in Cloudflare's case they operate as a processor and promise not to log, sell, or rent your data, and likely would not "view" it except as needed to "identify, analyze, mitigate, prevent, and block malicious activities on Cloudflare's network". Cloudflare is unique in that it gives them no advantage to analyze your traffic content - they aren't serving you ads or anything bc they basically can't, and they actually encourage user-level encryption. As I mentioned, Immich could implement "e2ee" in transit between their apps and server if they wished, aside from TLS.

#

Things that are just incorrect:

  • "Immich is not subject to XSS, injection, OWASP Top 10 etc" - All webapps can be subject to all of the above, especially anything with an API or that takes user input, or especially uploads like immich. It is drasitcally lessened on something security-oriented that takes no user input such as Immich Public Proxy. It depends entirely on dev knowledge and focus, how hardened and sanitized the implementation is. For a young project like immich where the focus is getting it working.. not thwarting every injection under the sun.. hacking it is often trivial. The only time I could see this being remotely true is if you're using something like Tailscale or Cloudflare Tunnels + mTLS where traffic flat out cannot arrive at Immich's doorstep unless it is already authorized, which is why I suggest this approach for any community project. Even then, you're trusting any machines you have manually trusted not to be a carrier or proxy (hah).

  • "Immich is too small to be included" - Immich makes use of underlying libraries which hundreds of other projects use, and rulesets which isolate things like injection attempts are often generic, i.e. regex looking for particular strings within a given protocol. A lot of protection can be afforded despite a project's age or popularity. The same is true for any WAF/IPS.

  • "anything medium to major could lead to them canceling your membership" - Immich is a small, commonly single-user instance. Even if they could isolate a DDoS campaign as attempting to hit your hosted services and no one else's, which is extremely unlikely, they're not going to punish the end user for that. Even if they did, that would mean closure of the tunnel, which wouldn't afford them any additional protection or save them any cost. It would only serve to inconvenience the customer, blocking all access and you'd simply have to find another solution. It would "fail closed", which is zero risk aside from lost convenience, whereas exposing your home IP and port, and praying for no vulnerabilities across all the moving pieces I mentioned, on an unmonitored connection, is potentially a lot of risk.

thin tide
#

TLDR, cloudflare does seek out and analyze passwords, at a minimum

real maple
#

tell me you don't understand what that's reporting on without telling me. great example of nuance missed

thin tide
real maple
#

i specifically mentioned passwords if you bothered to read. that specifically says it's collected as part of an application security offering you can place in front of things like api's. if you don't see how that's useful, lol

zinc merlin
#

Hey, first of all, please consider that the way you write comes across as condescending.
Just as your comparison with the unlocked door, that was provocative at best, you continue to talk down on people.
Some examples:

#

many people leave their door unlocked without issues; this doesn't prove anything. again i'll explain.

Yea, I'm not gonna bother with the attitudes here. I don't claim to be the best infosec expert around, but it is my day job. There is so much wrong with almost every "Support Crew" reply here I don't know where to begin, so I won't.

I was going to correct your errors until you demonstrated that the Support Crew, as a group, don't appear to be concerned about safety or open to learning, you jump straight to talking down to people you disagree with. Childish behavior.

Even simply pasting the conversation into ChatGPT and telling it to point out why you're wrong is enough to prove my case, while incomplete, so for giggles I did that much for you. I sure hope the attitude and these recommendations of the "Support Crew" aren't representative of the dev and his team's mindset. I highly suspect they aren't. If they are, you're only proving further the need to layer up and not blindly trust the project.

I would suggest that you stop being blinded by ego and be open to learning.

The Support Crew members for the most part have demonstrated that they are biased at best, and only have a partial understanding of things, and as such don't really have any business commenting on what is secure and what isn't.

This is another example of a litany of incorrect and presumptuous statements. Some teter on correct in certain instances, others are flat out wrong. I don't know why someone would have a "belief" about objective things that can be researched rather than just researching them.

tell me you don't understand what that's reporting on without telling me. great example of nuance missed

i specifically mentioned passwords if you bothered to read.

#

I hope you see how messages like the above, at least when sent in such quantities, can be very offensive

#

I hope you see the pattern and agree that this is not the best way to talk to others?
If you would seem to want a serious professional discussion and not just troll and bash, I would happily continue a conversation but this will be the last time I will respond to you for as long as you speak this way.

Please remember that the support-crew is a bunch of nice people, dedicating their free time to helping people out, simply because they believe in contributing to projects like these.

There are things in security that are facts and things where you have an opinion / personal belief on.
Often opinions are expressed as such as to not get into arguments about details.
I understand that security is your day job, believe me when I say that many of the support crew have a very professional background.
If your opinion is that companies as big have open privacy policies they adhere to and that those privacy policies are there to protect your privacy... then that is OK, it is your opinion but not everyone shares the same opinion on this.

Now I do not agree with your take on open ports, exposing your home IP, tailscale being practical to share photos with everyone, projects only existing because security on immich being bad.

Immich not being subject to XSS, injection, etc....
Yes, reading this I wrote this incorrectly! yes, immich can be subject to this.
I do not think it gives "enough" (in the free plan) security benefits for the privacy concerns and upload limit it comes with, at least not for me...
I think everyone can decide for themselves though. Many do not have concerns about privacy and don't mind the 100MB limit as they just upload those at home on WiFi... Many of those are very happy with CloudFlare.
Many are happy with a simple reverse proxy as well.

#

I definitely agree (and always say this here) that more security is better... run a WAF in front of it, run IDS/IPS, modsec,crowdsec, harden your OS, harden your docker installation, harden each container, harden your network.
more is better, no arguing that!

I do however stand by my stance: Attackers are financially motivated, they will go for the easiest way to get the most amount of money. This includes high value targets with unique malware designed just for those targets (and more if possible).
If you are a person of interest, I would agree that even your immich installation could be a potential target and you should secure it as best as you can.
For the average immich user, the likeliest scenario would be a vulnerability that is found someday and is published, the targets will then be installations which are listed on scrapers, public (e.g. shodan) or illegal. you can take measures to avoid being listed there
Is it possible someone will still use an undisclosed vulnerability to take over the immich installation of a "normal user"? possible yes, likely, no!

real maple
hollow estuary
#

I think the best way forward here is for @real maple and <@&1184258769312551053> to dissenage with each other on this topic.

#

Thank you

real maple
#

Now I do not agree with your take on open ports, exposing your home IP, tailscale being practical to share photos with everyone, projects only existing because security on immich being bad.
what? i am advocating against that.
Many of us are happy with it
that's great, but you are advising people who are asking security questions about putting it on the internet with incomplet or incorrect information which puts them at risk. it's not a matter of opinion or being "happy" with a product
attackers are motivated by money
you're not wrong, except that you're assuming attackers are a person. attacks are widespread and they find targets via automated tools. Shodan is an example of one that is publicly listed, but groups and botnets do this on their own all day long.

hollow estuary
#

@real maple Please read my message above, thank you

real maple
#

it is a strange position to advocate that your users shouldn't be informed that advice they're being given puts them at risk.

hollow estuary
#

I am specifically talking about we cannot have a good discussion here without bashing on each other, so I'd like to stop that.

real maple
#

consider it stopped from my end. i have no interest in being rude or condescending to anyone. i have an interest in protecting people who are asking security, not immich, questions. as you can see in previous replies were i was treated respectfully, i was respectful back. i'm citing risk to a team that seems (seemed?) to think adding Oauth to an app means it's unhackable, and being laughed at in response. sorry, you get condescension for that.. shocking. if you silence me by saying don't respond to the bad advice being given, the same thing will obviously continue as users ask if putting this project on an open port is ok, and are told yes by "support".

real maple
# zinc merlin I hope you see the pattern and agree that this is not the best way to talk to ot...

I will say that aside from the beginning remarks, most of what is said here, I agree with. I'm glad you changed your position on the XSS and injection things, I respect that. I don't agree that it is unlikely users will get hacked. I've seen it first hand on numerous occasions, and in a lot of cases targets were relative "nobodies", including me. What you say used to be true, but really isn't anymore in the age of AI and automation. Botnets and scanners are the minions and Nazgûl on autopilot scouring the net - every single IP. My inactive domains I've never posted anywhere get thousands of hits a day. Same for anything with an internet IP. If you don't believe me, fire up a honeypot or Wireshark on an open VPS and just watch it for a while. Create a new MongoDB database in AWS or Azure using default settings, and see how long it takes before it gets taken over and "ransomed". (It's minutes, ask how I know.) It's common for even experienced IT professionals to think that not having DNS pointing to their IP will save them. This is "security by obscurity", and now more than ever it doesn't work. you've seen the same thing happen with robocalling and smishing becoming more frequent. These days as soon as a new vuln PoC drops for a version of something they've found previously with their own personal shodan-type scanner, they can quickly spin up an agent for it, act on the instances they're previously found, establish a foothold, and report it to the mothership, perhaps all before a human is involved. The onus is on us to layer up and reduce attack surface.

hearty zephyr
#

On another topic: if you pick a unique subdomain (hunter2.mydomain.com) to get security through obscurity – once you get a targeted HTTPS certificate, the domain name leaks and is searchable via https://crt.sh. Getting a wildcard cert (like CF does for example) masks this vulnerability. NB generally security through obscurity is not a good goal on its own (but is - statistically speaking - better than nothing).

Now that we got this out of the way, is there a list of HTTP endpoints that need to be exposed to the public? E.g. something like /login, /oauth/* etc? Asking to craft a rule which would drop all traffic w/o Authorization header to any other URL for a friend.

crt.sh | Certificate Search

Free CT Log Certificate Search Tool from Sectigo (formerly Comodo CA)

ivory lark
#

i think the first thing to consider is: will they use the share album feature
(OR they have an alternative frontend to handle sharing links)
if you will use share link, basically all frontend files need to be served (i dont think there is an easy way since everything is minified)
and also whatever links used to fetch photo by the album script

that's a tradeoff to consider/know first before you get started

#

i think it will be easier to hardwall the whole thing if you dont care about the sharing of album but i elect an informed decision on my own instance to not do that

#

(security is at the end a calculated measure against own risk, at cost to own convivence)

wild lynx
remote widget
pearl swan
pearl swan
real maple
# remote widget https://github.com/alangrainger/immich-public-proxy Is a community option that y...

Yep, this. One of the biggest advantages is turning what would normally be a full app with user input, API, and uploads into what is more akin to a static site. Far less things to try and break on it via injecting, bruteforcing, etc. Generally proper use of it would look like network-segmenting this project from Immich itself with either layer 3 switching or a firewall or something between the two, such that it can only access what it needs port-wise from the immich server frontend/api, not the database or anything else on your network. You could also whitelist it URL-wise, though that's the point of the project so if you trust it it's a bit redundant.

You yourself could Tailscale / VPN / tunnel to access the secure side without exposing it. The public proxy app's segment would effectively be in a DMZ. If you were ok with inconveniencing users a little bit, you can also set up Clouldflare Access with a one-time-pin and have an email-based allowlist, similar to how MFA works, generally on a per-subdomain basis. This drops a cookie in their browser for a customizable time period and they can then access that subdomain (the DMZ) at will from that browser for that time period - again reduces attack surface to the public proxy app and it's server by limiting what can hit it. To earlier points, in this setup Cloudflare itself could potentially see the data, likely in memory, but I think it's pretty unlikely they're performing any analysis that your ISP isn't already or logging much - would be mostly for network optimization type things. Some people put a honeypot in their DMZ or use canarytokens to see if anything has made it into the DMZ and started looking around, and this serves as an early warning that the public-facing server has been popped, and allows you to take action before it's really a problem.

amber crane
#

Im working with tailscale.

dreamy pulsar
#

After learning that Cloudflare-Tunnels necessarily give cloudflare plain-text access to your traffic I migrated to pangolin as well. it's been working well for me so far 🎉

pearl swan
#

Specifically proxy_request_buffering off;, which by default would result in uploading files to the proxy server fully before the proxy server would upload to Immich. With big video files this caused issue when the proxy server didn't have enough memory to store the full video file. Also, the Immich web upload progress would reach 100% when the file was fully uploaded from the client to the proxy server but it would then take just as long (assuming the proxy server has the same bandwidth to the Immich server that the client has to the proxy server) to upload from the proxy server to the Immich server resulting in it sitting at 100% for just as long as it took to get to 100%.

#

With this setting the uploaded file is "streamed" through the proxy server and 100% on the web should be 100% on the Immich server.

pearl swan
wild lynx
#

assuming the proxy server has the same bandwidth to the Immich server that the client has to the proxy server

I'm jealous of people who have an external connection as fast as their internal one ... For me it's the difference from going from 40 Mbit to a local bridge interface (or 10 Gbit if it's another device on the network) 😅 Thanks for the contribution! I guess buffering is not that required for most home setups anyway.

high spade
pearl swan
#

If the proxy server to the immich server is slow this makes a bigger difference.

#

(If the proxy server is on the same server as Immich this is going to be a very small difference.

#

I was testing on my LAN and I have 1 Gbit from my desktop to my router (with my reverse proxy server on it) and 1 Gbit from there to my server with Immich.

#

But yeah, proxied uploads make no sense in most cases and if you want it then you should explicitly enable it.

old acorn
#

Using a tailnet for mines, secured it behind a Tailscale vpn and got a password manager stored creds and the biggest password I can make haha 48 long and the most random ass combination haha

uncut sand
old acorn
#

going to expand it to other apps very handy setup, just need to switch my vpn on my phone and boom got access to my immich server.

wise merlin
#

I use Openvpn installed on my router

coral tinsel
#

NGINX and Cloudflare

real maple
#

the obvious downside is it isn't free when that's what we're all trying to avoid - paying, but if you can score something like the nerdrack black friday deal (i got $10/yr for a 2TB/mo transfer 1 core 1GB VPS), then that is worth it to roll your own cloudflare tunnel, circumventing the transfer limit and keeping TLS intact through the proxy

worldly wraith
# coral tinsel NGINX and Cloudflare

Very similar, but CloudFlare Zero Trust Auth and protection Access keys, Nginx performance settings, Crowdsec on the inside and Ipta les Local Firewall with internal request allowance permission to only CloudFlare proxy ips (I have a script that queries CloudFlare once every morning to get the new CloudFlare ips ranges. Now my Servers are completely protected from the domain side & the public ip side.

coral tinsel
worldly wraith
worldly wraith
coral tinsel
real maple
#

whitelisting just their IPs is a great practice. love the recent contributions 🙂

#

also, even though it’s really buggy right now, I got deep into the weeds on the alternate network settings and found a workaround to get it working, thanks to some of the people on the github issue. thanks to whoever linked to me to the first github issue, I found it a workaround in a different issue than linked. i’ll try to write it up in an easy to digest manner.

the tl;dr is the UI seems to assume you are setting the alt up while on your local home connection, which most people won’t be who want this i would guess.

on your endpoint, sign out of immich, change network settings and then sign in using your local IP or bonjour hostname or whatever, and THEN go back to network settings and add the alternate connection settings. specifically, use the button to copy the current Wi-Fi and current (local) server URL, and then in the list below, put the same information in for the URL in the first slot, but add a second entry below it. only here would you put your remote URL of https://whatever.com:port. highlight the first field again and you should get a green checkmark on both of them. If you don’t, you either mistyped it or the UI is being stupid. Close out of immich if it refuses to give you a green checkmark because it won’t save any of the settings until URLs are green. restart the process and fiddle with things until you get two green checkmarks. eventually, it will work, assuming you have the right information. /api is not necessary. now, when you leave home, it will try the servers in that order meaning it will try your local host name first, fail, and fall back to your external URL which will be your reverse proxy.

basically it ignores the main setting next to the wifi and seems to try the servers in that order meaning it will try your local URL first, fail, and then try the second entry, which will be your reverse proxy.

this means you can upload images and videos smaller than 100 MB while you’re out roaming, and then at home bypass the proxy and upload the rest easily. if you want to, you could also roll your own reverse proxy like pangolin instead of Cloudflare tunnels and have that as a middle entry, falling back to cloudflare if both are unreachable for some reason.

wild lynx
plain timber
#

I’m using CF Tunnel but seeing issues when going through 1000s of items.

I have a VPS and I have a local server at home where my Immich service is hosted and my NAS is located.

I’m thinking to use the nginx proxy manager at my VPS to be the entry point and then proving that traffic over WireGuard to my UniFi UDM Pro router, and then access the inmich instance on my local server.

Does this sound like a reasonable plan to remove reliance on CF Tunnel?

I don’t feel like exposing my local network, I run lots of other services at home..

#

My npm is already setup with let’s encrypt wildcard cert

wild lynx
#

You can use any combination of proxy & VPN, it does not have to be a pre configured solution. I previously had npm + wireguard running very well.

#

Just for the "exposing the local network", keep in mind that on layer 7 you are still doing exactly that, no matter if there is CF or any other proxy between your immich and the internet.

plain timber
#

did you have both wg and npm running within docker containers?

wild lynx
#

npm as docker, wireguard directly on the vps. But should work similar with docker (the docker compose in the github project you linked is a good example)

plain timber
#

Although my UDM pro is a client to my Wg container on the VPS, I can’t ping my UDM from within the container, so there’s got to be some routing and firewalls stuff to figure out

wild lynx
#

From which container, wg or another? Depending on your network config on that setup you might need to change the network mode of the wireguard container. I run the local side in docker and have set it to host mode so everything on that machine can also connect.

plain timber
#

from the wg container itself

#

im not using host mode on any container

wild lynx
#

Oh then you don’t even reach any docker network things. Probably some issue with the tunnel then

plain timber
#

So I got most of it working

  1. Wg easy container on vps
  2. Udm pro at home setup as wg client
  3. Iptables rules to send dns req to pihole
  4. Opened firewall at udm pro so vpn can access lan

Now my iPhone connected to my wg server can access lan and pihole.

Last part is making nginx proxy mgr pass req via wg container. Looking at the caddy example, they use network_mode: service:wireguard, but I can’t do that since I have lots of containers on the vps setup for access via nginx.

Wondering if there is some other way to route req from nginx to wg container down the tunnel?

wild lynx
zinc falcon
#

has anyone here used tailscale? i wanted to try vpn but i dont have static ip sadly and the ISP is on CGNAT.

wild lynx
#

Lot's of Tailscale users, any questions? (Don't use it myself, running my own VPS for these things)

shut meteor
#

Just use Tailscale

#

I have placed the setup in immich github repo

#

if you want public just add funnel. But its better to share the node with friends and family. most private and secure way

wild lynx
#

Funnels can reportedly be somewhat slow sometimes, so it’s difficult to give as a recommendation. Maybe it gets better once they are out of beta.

peak tangle
#

I believe Tailscale does not recommend funnel for production but rather for temporary use. I don't know if that's still true though

high spade
#

From past experience with Funnels it is simply too slow for production

wild lynx
#

Funnel is also beta which is usually an indicator of don’t use it in prod yet.

bronze agate
#

I have immich/traefik/authelia/crowdsec hardened ufw and domain proxied on cloudflare.

zinc falcon
#

So which are the best for remote access if im not able to port forward as option?

hollow spoke
#

cloudflare tunnel is 1 option i think

unique spruceBOT
quaint ingot
zinc falcon
#

Is it the paid service?

quaint ingot
#

CF tunnel is free

#

A vps (virtual private server) will cost you <5$/month

#

Although there is also a paid version of cf tunnel

stoic notch
#

Im currently a haply user of pangolin

#

its a really nice reverseproxy, but I'd reccomend using it on a vps since the free non selfhosted version costs from 20gb traffic

wild lynx
#

I always forget there is a fully hosted version of Pangolin

shut harbor
remote trench
#

there is 5k message and i cant read them all , is there a ggood message discussion in here that we can pin or a video i can watch and copy paste to my pc

#

im mainly planning to use the option 1

wild lynx
#

Option 1?

#

There is not a single message/video it depends on what you need and what your options are

remote trench
wild lynx
#

Ah, remote access. Yeah if you don't need to expose that is the safest option.

turbid narwhal
#

and they have no bot protection like Cloudflare offers

stoic notch
#

i also very much enjoyed twingate

#

but currently im all in with pangolin, even for my gameservers with Proxy Protocoll

high spade
#

People who use Caddy and defined
protocols h1 / h2c / h3 in Caddyfile
Have you noticed a change in speed for the better?

I actually set it up, and noticed a really good speed change
I wonder if this is something worth adding to the documentation under reverse proxy
But I want to know if other people have noticed this

Edit:
See here:

#off-topic message

arctic storm
#

It’s immich that untested? Or is the feature development too fast for the security testing to catch up?

remote widget
arctic storm
#

I don’t understand the risks, nor the mitigations. Are there any guides for setting it up for the interwebs? That’s how I’d like to use it ultimately

#

Right now I have a reverse proxy behind a firewall with port forwarding

#

And of course no super valuable data, yet

remote widget
#

the immich-specific examples can be found at the reverse proxy link in the docs. However, exposing an application to the internet is very different than creating an application to manage your photos. That is why there are purpose-built reverse proxies, as that's a task all in it's own.

thin tide
unique spruceBOT
arctic storm
zinc merlin
thin tide
zinc merlin
#

then I wouldn't know how that snippet would improve immich speed

high spade
zinc merlin
#

I would've thought that the immich app supports the use of quic...
each version could show a step-up in speed (i have seen cases where this is not the case but in general I guess this is true)
if immich itself does not do http3 with the proxy, just the proxy using it to the client should improve speed already (even more so if the backend supports it as well)
at least with the browser it should work and should be noticeable especially on outside connections

short:
if you notice an improvement, it likely works 😄

pearl garden
wild lynx
#

First time I heard of CRS. Is it some kind of application specific WAF?

zinc merlin
#

I haven't been able to implement OWASP into my reverse proxy because I haven't found a suitable way to get modsec running with nginx...
@glossy jasper where do you run this on even? a WAF or via modsec?
afaik modsec works with apache but it's a lot more difficult for nginx the last time i checked

if anyone has this running for nginx... please let me know, would love to implement OWASP CRS in my deployment 😄

pearl garden
#

@zinc merlin I'm running a Ubuntu server with LXD containers, where the reverse proxy container runs a Docker container with Caddy and Coraza. Haven't regretted a second after making the switch from nginx to caddy. See this repo: https://github.com/corazawaf/coraza-caddy The reverse proxy container uses Coraza with the Nextcloud rule exclusion plugin when relaying traffic to the Nextcloud container. Would love to see a similar Immich rule exclusion plugin 🤞

#

@wild lynx It's a generic WAF that you can tweak according to the application you're hosting. You'll want to exclude different rules for different apps. It works at the reverse proxy level in your stack.

wild lynx
#

ngl "rule exclusion" sounds super reverse of what I'd expect with what it's doing 😄
okay so a ruleset for some compatible WAF you are running. wonder how it compares to crowdsec (someone did create immich rules for crowdsec afaik)

zinc merlin
zinc merlin
turbid narwhal
#

not a fan of Caddy
may the light one day shine upon your web server

zinc merlin
zinc merlin
# turbid narwhal > not a fan of Caddy may the light one day shine upon your web server

I prefer Nginx because it generally offers better performance and lower memory usage. It has also been used in production for a much longer time, which means that when you run into issues or look for configurations and explanations, it’s usually easier to find answers for Nginx.

Caddy is definitely easier to configure at the beginning but certain edge cases or fine-tuning scenarios can become difficult. For quick and simple setups it’s a good choice from what I have heard.

The main reason I wouldn’t switch to Caddy, even if I thought it was technically better, is familiarity. I’ve done so much with Nginx over the years that I know my way around it. Switching to another product would mean going through that learning curve again, which is also why I understand why people tend to stick with their preferred tools as long as they work well enough for what they need.

I should correct the "not a fan of Caddy" though...
I do not mean to say it is a bad product, I simply prefer Nginx over it.

turbid narwhal
#

fair enough 😄
as someone without a professional background, nginx has always been some sort of "black box" where 4 different install scripts had modified it for different services, and it kinda sorta worked-ish, although I think that when I was using it I had somehow borked it enough to where it looped back on itself at least 2 times before actually proxying the request

it was one of those things you set up at 3am in a rage of productivity, then wake up the next day and have no idea what to touch, what headers to manually add, what to customize for each service...

Then I jumped ship to NPM, then NPM-plus because it's just better then regular NPM in every single way with no downsides, but still found myself needing to tweak the advanced config to set up stuff like geoblocking, WAF, etc etc, which not only defeated the entire point, but sometimes broke all the forward headers

So one day I just stopped the npm-plus container and set up caddy, and haven't looked back since.
Easy config file even for someone with limited programming knowledge, automatic forward headers for everything, (mostly) good documentation, and easy integration of external plugins for WAF, geoblocking, OIDC forward auth, and the like.

You are completely right on your points tho, one thing I really miss is the advanced customization of nginx, with caddy there's some (imho) dumb restrictions on if something needs to be global or site-wide (looking at you, automatic https redirect, why do you need to be a global toggle and not site-wide, whyyyy), but the advantages in my case far outweigh anything bad I can ever say about it

zinc merlin
#

completely understand! 🙂
i've heard from most who use caddy that the main reason is the initial ease of use, seems to be its strength
and for such use-cases, I dont think a performance difference is noticeable much with a low load

hollow spoke
turbid narwhal
#

I was thinking of adding https://github.com/corazawaf/coraza as a WAF but I've seen it breaks plenty of stuff that needs manual whitelisting and it's exam season so I don't have much time on hand

turbid narwhal
#

for example, traefik is like 2x worse

#

some day in the distant future I'll try to set up cloudflare's pingora reverse proxy, they claim it uses 70% less CPU and 67% less memory then nginx with the same traffic load.... unfortunately it's not really used by the self hosting community so there's no support and no external plugins/guides

wild lynx
#

Funny, last time I saw a comparison caddy was noticeably behind everyone including traefik

#

One of the reasons I never used it

#

Looking at the pingora repo it’s easy to see why adoption seems lacking. If you need to code and compile the routing yourself it’s not as simple as throwing a small config file into a proxy 😄

zinc merlin
#

That’s just latency on low loads… good for home use.
The difference would likely look worse when they are under high loads with lots of requests

stoic notch
#

but when do 3ms matter in a real world usecase for a software like immich thats not ment to be deployed in such scales where it would matter

cosmic root
#

Pangolin uses Traefik and it seems to work well so far (and includes easy way of installing crowdsec and geoblock), you are not a fan of it I take?

thin tide
#

I personally don’t get all the love for pangolin, but I guess it’s fine. It’s a lot better then CF tunnel

zinc merlin
zinc merlin
stoic notch
thin tide
#

Just run the WG server and proxy on the VPS and connect your home by WG to the proxy

stoic notch
#

but thays two things to manage

thin tide
#

Sure, but you’re not locked into a relatively new project that already seems to be pretty aggressively monetizing

stoic notch
#

pangolin is one thing and auth for my proxy is nice

thin tide
#

It’s also extremely basic networking knowledge that’s probably good to learn

stoic notch
stoic notch
zinc merlin
#

the fact that me and Zeus dislike CF (I assume we have similar reasons) is mainly because it decrypts your traffic
they need to, the way their service works but I still don't like them having cleartext access (not just pictures but passwords, tokens, etc.)
with it being a U.S. based company, we would never know if they gathered info that way

cosmic root
#

well, if they turn "evil" we can always change I guess, get our traefik config and install some wireguard stuff

zinc merlin
#

if they do, you might never know...
as long as you know of the possibility...
i might just be too paranoid 🙂

cosmic root
#

ah yes, for cloudflare yes, was more thinking about Pangolin, being open source and with standard encryption I hope it is less of a concern

zinc merlin
#

if it all runs on your equipment, yes
but again, my opinion is a bit paranoid
you would have the same issues elsewhere... e.g. if you use microsoft Entra / Azure AD you would also have your credentials somewhere else (I think, havent actually checked if they implemented anything to NOT have access to it).

wild lynx
stoic notch
#

one compose

wild lynx
#

I only like it for it's UI, I could do my setup by hand but UIs are nice to look at

wild lynx
#

You also need to update the traefik plugin for example

#

I can put a VPN and proxy into one compose as well.

stoic notch
#

i have it basic and some other stuff is on the backends

wild lynx
#

Whatever basic means, just wanted to point out pangolin is actually more to manage than one might think 🙂

cosmic root
#

I actually did my first update now

#

not sure if just putting latest in the images would work (on the traefik config would it?), anyways, everything has breaking changes that need to be reviewed from time to time I guess? pretty new to this world to be honest

wild lynx
#

Yeah their release notes lists the 5 versions that they recommend to run together.

#

But most of the time it runs well with only updating pangolin itself and then updating the rest at some other time

#

I just saw they finally have their mobile apps out

cosmic root
#

btw, this triggered myself to check, they have release a pangolin app on ios for private services, I think this looks pretty much like tailscale, I will check it out

wild lynx
#

They had the desktop version two releases or so ago. It's nice, works well

cosmic root
#

maybe I can uninstall tailscale then, is this theoretically any safer or just same stuff, different wireguard implementation? I guess this is still tehcnically on topic as it is a way to expose immich to local devices 🙂

wild lynx
#

Both use a wireguard tunnel in the end. With pangolin it's just self hosted so one party less to trust

stoic notch
#

its ztna so its more like twingate than tailscale

wild lynx
#

Isn't that what tailscale is about?

stoic notch
#

no, you cant restric on ports/services

wild lynx
#

Latest Pangolin fixed port restrictions (didn't work before on my setup) so I guess it's finally usable (officially out of beta as well)

cosmic root
#

just set it up for immich and seems to work, nice

turbid narwhal
#

Pangolin has already started having a business plan that costs money and while they don't lock up features for now I am not trusting them

#

if I need a GUI, NPM-plus has the same functionality, runs on the faster nginx, and has built in support for all the bells and whistles of pangolin, you just need to uncomment what you need in the compose (geoblocking, access log GUI, crowdsec, QUIC, openappsec, Anubis, etc etc)

#

As for the vpn, remember the Unix philosophy, one service for one thing

#

Having a dedicated wireguard service gets you updates and critical security fixes faster, not to mention better customization

#

I just run wg-easy to have a nice GUI to configure everything, zero maintenance, just works, usually withstands watchtower updates without a problem

#

it even has amnezia-wg support for when I'm at my dorm and they have a DPI firewall to block normal wireguard

#

holy text wall 🥀

wild lynx
#

And while you can still run it without the centralized management console, I get what you mean. No one knows which features get paywalls in the future

#

wg-easy had the biggest breaking change I had in a long time, they basically said start from scratch you can’t just update this.

turbid narwhal
#

yea fair enough v15 did require me to reinstall it 😅

#

still, running the vpn separately gives you the option to choose whatever you want

#

tailscale? go ahead
wg-easy? right over here
OpenVPN since you're a masochist? that too

#

(although you'll never catch me using tailscale for the same reason as pangolin and crowdsec, fuck central consoles)

snow crow
#

I saw discussion on Pangolin, does anybody know why authentication breaks /public/*? Are there other paths I need to bypass?

thin tide
#

You need to bypass /api, which contains all the important routes, so there is no real way to do path based auth for immich unless you use an outside tool like immich public proxy

turbid narwhal
#

it is now 2:08 AM and i have just discovered RFC 9460

#

this is amazing

#

you can specify the preferred http protocols for clients to use when connecting to your website in an HTTPS type dns record

#

so from the first connection clients can instantly use h3 / quic

#

😁

thin tide
# 
$ dig +short @1.1.1.1 HTTPS immich.domain.tld
1 . alpn="h3,h2" ipv4hint=1.2.3.4
turbid narwhal
#

yea i just discovered it

#

so cool :)

#

ipv4 hint is also cool if i didnt have a residential dynamic ip

thin tide
#

you can easily set it whenever you update the A record

turbid narwhal
#

and i dont think the auto updater i have supports https records

turbid narwhal
thin tide
# 
DataHttps=$(jq -n \
  --arg name "$CfName" \
  --arg ip "$Ip" \
  --arg comment "$(datex now)" \
  '{
    type: "HTTPS",
    name: $name,
    ttl: 60,
    comment: $comment,
    data: {
      value: ("alpn=\"h3,h2\" ipv4hint=\"" + $ip + "\""),
      priority: 1,
      target: "."
    }
  }')
#

curl -d "$DataHttps" -X PATCH "${Auth[@]}" <CFURL>

turbid narwhal
#

i dont use cloudflare

thin tide
#

ah, I am sure most DNS providers support it

turbid narwhal
#

and i think ovh has shit APIs in regard to that

but their .ovh domains are soooo cheap that i'm willing to put up with it lmao

turbid narwhal
#

makes me wonder what other stuff i've missed

turbid narwhal
#

just checked with wireshark and it's basically a poor man's ECH if the client supports quic... this is amazing.....

thin tide
turbid narwhal
#

well

#

quic has encrypted sni by default iirc

thin tide
#

didn't know that. so if it starts as quic, you are good.

#

nice

turbid narwhal
#

so if your browser uses dns over https, fetches the HTTPS dns record, and connects with quic from the very first connection..

#

it never gets leaked

turbid narwhal
#

the sni is there it just doesn't show in the info coloumn

gaunt ruin
#

for those using immich public proxy - where are you running it? in a VPS? inside your home lab in a separate VM than immich? trying to think about the best way to set it up

#

right now i use tailscale for my own personal access to the mobile app but id like to be able to create share links for external sharing

fair ermine
#

Im using pangolin with Immich its easy as fuck and has no Problems

wild lynx
lucid lodge
cosmic root
#

I run it in a docker lxc, use cloudflared (though should probably move it to Pangolin now that it is setup)

#

Tbh I have not used it even once other than for testing, share the photos through WhatsApp if needed 😳

gaunt ruin
lucid lodge
gaunt ruin
#

yeah i just got it working. immich-public-proxy container and cloudflared container in the same docker compose as immich. on the cloudflare web portal, configured the tunnel to point to immich-public-proxy only. working great

#

i think moving to an LXC approach would be ideal but i was scared off of doing it with Immich

zinc merlin
#

I just use immich and nginx in two different compose stacks.

lucid lodge
gaunt ruin
#

if you use helper scripts

lucid lodge
#

Yeah, but why so you use it and not Forward the Traffic directly by Cloudflared? You can forward there by the .env settings.

gaunt ruin
#

so i want to gate the rest of immich behind tailscale and only expose the /share path that IPP exposes

#

basically, keep the main app behind tailscale for the family, but when we want to share photos with others, let cloudflared tunnel in for that

lucid lodge
#

Ah, understood, thanks.

floral mulch
#

also using pangolin on a oracle cloud free vps ( use pay as you go mode so i't won't get disposed, still no costs) and immich lives on unraid at home. also crowdsec as failtoban replacement and not using tailscale as i use adguard on android which already uses the only vpn slot that there is and family also uses adguard on mobile

gaunt ruin
#

i have considered doing something like that because the handoff from local wifi to tailscale when leaving the house can cause some issues in the app

sand wolf
#

I'm using immich behing nginx as reverse proxy. Does anyone think this is too risky?

Also is there any pro or cons to put immich server on a DMZ in my local network?

green dome
#

I bet you over 25% of our users use nginx

balmy pendant
#

i use caddy but same principal

cinder adder
#

Especially if firewall on the server is misconfigured.

sand wolf
wild lynx
#

Forwarding a single port is usually not a problem. Of course it's always better to add some more security on top of the service but not an absolute requirement.

#

For the DMZ: Isolating public services from the rest of the network is generally a good thing, if it's necessary for you is another question.

rigid sequoia
#

Hi, I've just wrote about exposing Immich to the internet on my blog post.
I use Tailscale funnel fuction for it. and additionally I set Oauth2 with google authentication to block malicious access. How's that?

My blog is in Japanese, but you can translate it to your language, if you use translation function of the browser.

wild lynx
#

My Japanese is still too basic for this, but going by the automatic translation it looks good. I like that you give some info in the end about debugging in case of issues! A lot of articles don't mention anything in that regard.

Personally I don't like handling authentication to Google, but it still is better than hoping no one get's through your password.

lucid lodge
turbid narwhal
distant crypt
wild lynx
#

SSO is more for comfort

distant crypt
#

However long your password is, it's still a single factor

green dome
#

Why would you not like SSO

fading harness
#

Hey all, unsure if my usecase has been discussed before, but couldn't find it via the search feature.

I'm on unraid and want to expose Immich through Pangolin reverse proxy.
By using a sharable link and using the additional headers, I'm able to easily connect the mobile app to my external domain, but backing up photo's results in an error.
Next to that, I also can not see any of the actual images on my server, even though the app connects and logs in correctly.

My debug attempts seem to fail me, since increasing timeout and idle limits in Pangolin/ Traefik didn't seem to work, which was my guess at what is going wrong

green dome
#

No logs in the app?

fading harness
#

didnt check in androiddebugger and unsure if there are logs in the app itself

#

Rebuilding network stack now, so all good, will report back if issue persists

green dome
#

There are logs in the app

fading harness
#

connection closed while receiving data, so connection gets terminated for some reason

#

And a bunch of 400 status codes, so clearly pangolin/ traefik messing things up. There is also never any issues locally, so time to fix the network

ivory lark
#

is there an auth page?
how is that auth setup?

#

if it's a reverse proxy sided auth
this means
client -> rp -> auth -> immich
this would imply all client must authenticate to reverse proxy before any request can reach immich
and i dont think the apps would be able to do that

the difference is in
client -> rp -> immich
client -> rp -> auth (for sso)
auth is bypassed, and only require when signing in (immich enforces this, instead of the reverse proxy)

(this is assuming, you can connect to immich in your browser, but not the app)

wild lynx
#

The apps do not support authentication via proxies.

#

The additional headers are in experimental state, could be some issue there

young anchor
#

I use nginx+Netbird as a VPN tunnel. After everything is set up within Netbird, you must add a DNS entry in nginx immich config file, with either your own resolver or Google, cloudflare one. Obviously that assumes one has a domain tied to the server

sand wolf
#

I'll have to check how to activate an SSO solution or at least a 2 Step verification. Is Authentic difficult to configure?

wild lynx
#

It could definitely be easier (especially for small home use setups) but it's also not the end of the world.

fading harness
#

on browser I can complete sso flow offcourse, and added the headers in the experimental feature. Worked great for login, but after auth stuff seemed to break.

Thats why I decided to rebuild and see what happens

lucid lodge
cosmic root
#

I went with PockeID and so far so good

sage lintel
#

you pay to be able to upload files larger than 100mo? because cloudflare blocks requests if files are too large in the free tier.

#

I was using tailscale it worked fine but it was annoying not being able to "share" content with a link, or share albums with people that don't have tailscale.

tired loom
fathom socket
#

haproxy.

faint thorn
sage lintel
#

you've set the option to only backup over lan with your local ip? not using your url? ah.

#

i might give tunnels another shot but with the new zero trust security page they released I got a bit lost hiw to configure everything, I'll check that out tomorrow. I have reinstalled the app tho

faint thorn
#

And actually I have DNS setup on my local network for my homelab URLs. Set it up before Immich had the option for separate IP on local network, but I like the seamless setup anyway

#

Not that that matters in this problem, but you mentioned "not using the URL" so thought I'd mention it

stoic notch
#

can i use anubis as a traefik middleware for the immich app

wild lynx
#

afaik Anubis will intercept all traffic initially which will break the app

zinc merlin
wild lynx
#

It shows a challenge that needs to be solved by the browser. I doubt the immich app executes JavaScript on the api

zinc merlin
#

ahh, i thought its simple decryption 😄
yea, a challenge would break the app if that challenge cannot be deactivated

stoic notch
#

it sometimes worked for me, but only after I solved the challenge in a web browser, then it worked in the app but just some apis

zinc merlin
#

doesnt sound very practical
sorry I dont know Anubis and just assumed its just a WAF that decrypts traffic...
if it displays challenges or authentication, that would break the app functionality

turbid narwhal
#

you can whitelist the api from anubis while still having the webpage under challenge requirement, for what that's worth

inner wasp
# wild lynx afaik Anubis will intercept all traffic initially which will break the app

anubis has policy configuration which can let immich through
https://anubis.techaro.lol/docs/admin/policies/

Policy Definitions | Anubis

Out of the box, Anubis is pretty heavy-handed. It will aggressively challenge everything that might be a browser (usually indicated by having Mozilla in its user agent). However, some bots are smart enough to get past the challenge. Some things that look like bots may actually be fine (IE: RSS readers). Some resources need to be visible no matte...

#

i've set up pangolin vpn and placed immich into private resources alongside other docker conteiners... so far i figured it isn't working well with authentik since you need separate accounts for vpn and openid (vpn doesn't accept users from external providers)

wild lynx
#

The thing about these exceptions is that it mostly comes down to allowlisting /api/* which basically renders all protections useless

ivory lark
#

^^ this part is important to note
stuff out of /api/ is just the UI, protecting FE has no use here
everything is operated via the API
so if you bypass the API then you are better off not having anubis at all

the common escape hatch i seen is a secret header to skip checks for apps
some user use this to skip auth proxy checks (by protecting /api/ to require auth)
this same approach can be done for anubis, it isnt ideal but might beat nothing in some user's view

zinc merlin
#

yea
doesnt anubis provide some IPS functionality if it already decrypts?
that wouldnt be bad either 🙂

real maple
real maple
#

(Finn is correct.)

valid nest
#

Hi folks. I'm searching and googling what I can but am fairly green. If I'm willing to pay maybe 20$ a year, (I don't know for what), what would be best practice for remote access for myself and one other user. Goal is closest to Google photo experience where I can share albums with people who have no immich access, and perhaps they can upload pictures to that folder.

Again, sorry, I'm new. I hope I can learn enough so I know what to Google. I'm not familiar with Internet but have experience with following GitHub tutorials and YouTube videos lol

#

(a bit off topic but how do I purposely cause a corruption so I can test my backup / restore process)

remote widget
valid nest
#

I have a complete unifi network, which I'm told is prosumer. So I just have to learn how to setup a reverse proxy with that equipment and more or less I'm on the right track? No other "services" needed?

#

Assuming my provider doesn't allow it. Is there preferences to cloud far/tailscale/??? if I'm willing to pay for a better experience?

remote widget
valid nest
#

Thank you. Well that didn't take long. Cox doesn't allow reverse proxy for residential lol.

remote widget
#

That's unfortunate. blocking port 80 on inbound connections kinda sucks.

I think a vps will likely be easiest for you. There are many options out there - with quite a few name brand hosting services. I'd assume your cost for soemthing like this would be approx $5/month

thin tide
#

you don't really need port 80. port 443 is fine

valid nest
#

I'm happy with 5/month. I know there's free ways to do this but I'm assuming there's less restrictions on paid versions. I think I'll go with cloud fair since there's plenty of guides. Thank you

bronze spire
valid nest
#

I'm looking into best practice for remote access. I want to be able to send a link to my grandma, and she can access/upload their own photos to the album.

I imagine cloudflare is the answer with a domain name? I cannot open port 80 for reverse proxy.

#

I would like to use tailscale because it's simple, but as i understand it, i have to download it onto anyone's phone that wants to view a share album link.

young anchor
#

Yes

green dome
valid nest
#

from what i read, cloudfair + domain name i just send my grandma a link and she can upload and view without needing any setup on her phone.

I thought tailscale required the vpn to be on her phone.

green dome
#

This is a vpn but it runs on cloudflare's servers so the other users don't need to install things

valid nest
#

aweswome, so cloudflare is the way to go for that. thank you.

lucid lodge
bronze spire
lucid lodge
# bronze spire I'm a bit worried exposing it public but I've also done everything in my power t...

Basically, using an OIDC provider lowers the risk, as there is only one attack point (Authentik) remaining for potential intruders (in case you are using it for different apps). Using passwordless options in Authentik even lowers the risks (Passkeys / FIDO2 key sticks)
You could use also Cloudflare Access to create a OTP by mail to allowed mail adresses, before a user even sees the login screen of Immich / Authentik. Thats how I am securing critical pages, which are basically exposed also to the net.

bronze spire
lucid lodge
remote widget
valid nest
#

gotcha, i assume that means she could upload plenty of pictures.

#

is there another service that wouldn't have a limit on upload limit? Because i imagine that means i can't backup videos remotely.

fresh patio
#

Guys, i want to expose immich to the internet so i can temporarily create a shared album and share it with qr-code so guest at a party can share the pictures they took.. what is the best approach for this? Currently immich is running locally on my proxmox server and i’m reaching it externally through wireguard

green dome
#

Buy a domain, use a reverse proxy like NPM, Caddy

zinc merlin
cosmic root
#

I think there is a way to use duckdns with let's encrypt as well? haven't done it because domains are cheap anyways, but might be an option to look into

wild lynx
#

I don’t see a reason why it would not work with duckdns 😄 Having a valid DNS entry is basically the only requirement for let’s encrypt

valid nest
zinc merlin
valid nest
#

they do not unfortunately.

zinc merlin
valid nest
zinc merlin
#

can be fun but the initial steps can take some learning
all the best and enjoy the journey 🙂

valid nest
#

for reference, the only people who use immich is my wife and I, but we'd like to be able to send shared albums to relatives to view and upload their own stuff without needing to do any changes on their phone.

zinc merlin
#

I use Immich with my wife and son and plan to migrate my in-laws to it as well
We share with relatives allover the world and also with clubs/associations like when they had a music camp, I would share photos that way.

But Immich wasn't the first service I publicly exposed

sage forge
#

I was using Immich on my local network only, for a while: I run proxmox with a pi-hole LXC as local DNS and setup Caddy LXC as a reverse proxy so that I'd use photos.home to access Immich.

This works fine but I wanted to expose Immich to the Interwebz. So I've set up photos.mydomain.nl to point to a small Hetzner VPS. On the VPS I run another Caddy reverse proxy and a frp server.

photos.mydomain.nl points to the VPS'es Caddy, which forward to the frps tunnel, which is connected to my local Proxmox frpc client, allowing access.

This gave me some troubles because the two Caddy's were competing for SSL termination (INTERNAL_ERROR). Having my VPS Caddy handle TLS and forwarding plain HTTP through an (encrypted) frp tunnel solved that issue.

I still feel a bit uneasy exposing my local Proxmox LXC to the Web, but no open ports on my router and proper HTTPS so it's probably fine? 😬

wild lynx
#

For any open port (no matter if it's on the router or the VPS), it's generally fine. Many add additional filtering in front of their proxy. For me thats the Unifi IDS/IDP which will block some threats. In the end no protection will save you from every kind of attack, but for home use you don't need to worry too much. imo having working backups is more important than squeezing the last bit out from a WAF.

sage forge
#

I do have some Hetzner firewall rules, so there's that 😅

wild lynx
#

Last time I checked Hetzner did not have a WAF at all

#

allowing/blocking ports is another layer 🙂

left shoal
#

But if you use a Cloudflare Tunnel, the HTTP request gets blocked when uploading files larger than 100MB, right?

faint thorn
limpid hare
#

What are the benefits of using Immich Public Proxy over exposing the bare minimum endpoints to get public shares to work via a Caddy side car? The one major benefit of exposing endpoints is allowing guests to upload images. What are the cons of the minimal endpoint exposure?

I'm imagining a use case where one uses Tailscale to serve the full app privately to users on the VPN but then use a secondary Tailscale and Caddy sidecar for Immich-Shares (immich-shares.tail.ts.net/s/) which points to the real Immich on the same compose.yaml but only the necessary endpoints are exposed publicly.

Possible Caddyfile

:8080 {
  @allowed {
     path /s/* /share/*  /_app/*  /assets/*  /api/assets* /api/shared-links/*  /api/assets/*  /api/upload/* /api/server/* /custom.css /appl*.png /favi*.png
  }

  handle @allowed {
    reverse_proxy immich-tailscale:2283
  }

  handle {
    respond 404
  }
}

Thanks in advance

wild lynx
#

The main benefit is you don’t have to configure anything and actually protect your files. While you don’t allow the login endpoint, technically you still allow the api that can be used to get all your assets.

#

Also since we don't provide a list of minimum api coverage it will be a trial and error path you are going.

limpid hare
#

technically you still allow the api that can be used to get all your assets.
Oh that's good to know. Is the recommendation to keep Immich behind a VPN at all times? I imagine there's some form of authentication going on so that people cannot just get your assets.

How does IPP work so that attackers cannot get all your assets? I imagine it's more thanjust the /s/ and /share/ endpoints being used by IPP

wild lynx
#

AFAIK IPP does not expose any API externally so you are safe from these kinds of attacks. Also to note, without the auth endpoint an attacker would need to get or guess your session token, which is very unlikely. I just wanted to point out it will not be a 100% protection. Our recommendation is: do it the way you feel safe. Personally I have my full Immich instance available publicly.

fresh patio
#

If i use immich public proxy and share a album with someone can they add photo’s as well or is it view only?

wild lynx
#

view only

#

unless it changed since the last time I looked at it. But the goal of the project is to provide minimal access for viewing a share.

limpid hare
#

So doing the Caddy config is going to be safe for most purposes, but there's a small but still existant chance that someone somewhere COULD do something, but it's not likely and less likely than if they had the auth endpoint?

wild lynx
#

Yes

#

We won't be able to assist with any errors you are getting on these restrictions, you'll be on your own then.

limpid hare
#

Sounds good. I think I got the Caddyfile and composed structure working. I just wanted to check security wise and have a better understanding before deploying the configuration

high spade
#

FYI Caddy v2.11.2 is out with 2 CVEs fixes

unique spruceBOT
turbid narwhal
#

i should really get around to automating the caddy build when a new base image gets released

hollow spoke
wild lynx
#

Not sure if any of the popular docker management tools has it built in, but one option is just create a cronjob for it

gentle tapir
#

How bad of a practice is it to leave the Tailscale funnel open to access Immich without needing to be connected to Tailscale all the time? I prefer using Proton VPN consistently.

turbid narwhal
#

many of us use a domain for immich soo.. about the same

#

not inherently bad, but it can lead to bad things if a very severe vulnerability in immich gets discovered by bad actors

#

(very unlikely)

#

though you could use OIDC to have another safeguard against attacks

gentle tapir
wild lynx
#

If someone really is interested into getting your data - yes it's the same risk as exposing it via other methods.

turbid narwhal
young anchor
# gentle tapir I'm mainly worried about somebody somehow getting the URL and brute forcing in a...

URL will be known to the world the second you request a cert.
The way I done it before I decided to go Netbird way, was to harden the server I was running immich on, and then use best practices from industry to configure reverse proxy to minimise the attack surface. I am running vaultwarden self host on the same machine so I used majority of it's config to strengthen immich side of things. But then I managed to configure Netbird, so majority of that stuff is kinda pointless now 😁

stoic notch
#

Netbird user ⬆️

zinc merlin
#

thats why you need backups...

zinc merlin
wild lynx
#

Netbird is a VPN but also offers a proxy to route public traffic into the network

#

Kind of what Pangolin is doing but their origin is reversed

#

And the netbird proxy is still early beta, I had some issues with it

#

Need to redo my security rules with the netbird proxy some day

stoic notch
#

i just use netbird with godoxy

#

and my own ca ofc

zinc merlin
#

mhh, id rather use a well established reverse proxy for that 😛

stoic notch
#

its just internal so idc

gentle tapir
wild lynx
#

I'm using Caddy, even with the new Netbird proxy that they advertise as Traefik only. Requires some extra work though and breaks easily as such.

pliant vault
#

I use the following setup to access Immich from the internet (full access, e.g., mobile app with photo uploading and limited access to shared assets for others):
Cloudflare Proxy (rate limiting, bot blocking, etc.) -> Cloudflare Tunnel -> Reverse Proxy (on my host)

  • For LAN access, I use a simple domain like immich.mydomain.com (this is solved only localy by DNS rewrites, not exposed to Cloudflare connectors)
  • For external access on mobile, I use a random phrase domain like abc123.mydomain.com (in the mobile app, you can select a secondary address to be used outside of your defined home network).
  • For shared photos/albums, I use another domain like share.mydomain.com, which is then proxied to the Immich Public Proxy to cut off the admin panel on this domain.

I deployed also CrowdSec with a bouncer to the local reverse proxy as an additional shield (e.g., against known threats or to ban IPs for multiple wrong password attempts).

turbid narwhal
pliant vault
#

Yes, but I've whitelisted the LAN IP pool. In the beginning, I struggled also with fast scrolling on the timeline, but it was caused by CrowdSec requests (a few hundred per second) choking my host. I solved that by (if I remember correct) increasing the timeout limit, decision buffer duration and some other settings which I forget 🙂

turbid narwhal
#

hmm

#

I solved it by removing that resource hog, rugpulled, configuration mess of a software that (imho) is crowdsec

#

as bad as naysayers will say it is, I'm just running with geoblocking & ip blacklists

#

and yes, blah blah blah enumerating badness, blah blah blah.... I get less then 100 requests/week that get past the filters and aren't me

zinc merlin
#

CrowdSec does add some additional security but I also think there are ways to get similar results with much less effort. rate limiting is available on reverse proxies as well and good blocklists are available also…

Most helpful is usually a “simple” hardening

Some proxies also have modsec support, can use OWASP there

ivory lark
#

i recently started doing backup to backblaze B2 using backrest for incremental backups
i dont have much data but i do want to keep it safe, i guess they just charge by what i use which isnt much to pay for
i am glad i didnt went all in on hetzner storage boxes, they are cheaper by bulk i think

1773614325983.png 1773614325983.png
#

i am saying this if you are under the assumption you need to pay for at least a whole TB every month

naive lintel
#

hey,

#

is there a single message around here that I can read and refer through for securely exposing immich to the internet?

#

the issue I would like to highlight which im facing right now is,
I have cloudflare tunnel configured and working, but stuck with 100 mb upload limit

And I have my debian no gui remote home server access right now (Im in college) and im unable to access and do port forwarding while going for reverse proxy

thin tide
#

No, this is a lot more complex than a single message.

naive lintel
#

where can I find a curated article resource then?

distant crypt
#

Why are you unable to do port forwarding?

wild lynx
#

If you don't have remote access to your router I guess you have to wait until you have a chance to get to your router.

#

We can't provide a single article for setups like this because there is not a single solution for the whole thing. And everyone has different needs

distant crypt
#

Or use tailscale funnel

naive lintel
wild lynx
#

True, if there is already a connection to the home server it could be extended

naive lintel
#

but the new issue is, my wifi just shows ipv6 wan and not ipv4

naive lintel
distant crypt
#

As Finn said, it's basically impossible to tell you what you need to do since it's highly dependent on your setup. Even more so if you don't tell us exactly what's going on

naive lintel
#

now the WAN IPv4 isn't there, I enabled port forwarding but im getting -

Connection timed out Error code 522

What Im able to see is I used the ipinfo gave me IPv4 that i used in DNS in cloudflare but now as there is just IPv6 WAN in my router, im not able to access the domain

wild lynx
#

Your router needs it's own public IPv4 for simple port forwarding to work. If your ISP does not provide you your own address, you'll need another server acting as a proxy into your network.

#

Or if it's an option you could go IPv6 only. But that depends on who is connecting to you

naive lintel
#

Yeh Ig my router uses CGNAT

distant crypt
#

routerISP

naive lintel
#

yeh ISP

naive lintel
distant crypt
#

In that case you could either proxy the traffic through a self-hosted VPS that has a public v4 address, or use a service such as tailscale funnel

naive lintel
distant crypt
#

There are some free VPSs out there (most commonly oracle), and plenty that cost like $1 or $2/month. FWIW you generally don't self-host to save money though 😅

#

What limitations are you running into with funnel?

naive lintel
#

the speed limit,
unable to share with other people,
etc

distant crypt
#

unable to share with other people,
Huh?

naive lintel
wild lynx
#

You should be able to share when using funnel

distant crypt
naive lintel
distant crypt
#

Where does it say that?

wild lynx
#

Never heard about such a limitation

naive lintel
distant crypt
#

You can only have x free seats in your tailscale org or whatever they call it, yes

#

That's unrelated to funnel though

#

For funnel your users don't need to be connected to your VPN mesh in the first place

#

They don't even need the tailscale app

naive lintel
#

Tailscale VPN is requried on client side each time?

distant crypt
#

No.

wild lynx
#

No

distant crypt
#

Could you read through the page I linked you?

naive lintel
#

sure

distant crypt
#

And/or watch the video at the top of that page

zinc merlin
#

internet without your own IP, thats unimaginable to me :[
I mean do the ISPs there not even offer that or is that just a cheaper option/ISP?

turbid narwhal
#

for a company here, you need to choose the "net neutrality" package and use your own router to even be eligible to ask for a full stack ip

naive lintel
#

is it a good idea to go for oracle free tier VPS while exposing immich to internet?

wild lynx
#

That's up to you. I'm using oracles offering myself

#

Oracle will only provide the infrastructure, you'll need to manage the setup by yourself

remote widget
#

Also be ready for the VPS to disappear without warning. I've been using it for years without issue though

quaint ingot
#

I want to set up traefik as a reverse proxy and from what I’ve seen there are two ways to configure routing: Via docker labels or via a central configuration file.
I don’t plan to do a very complicated setup, I want to route my services via https (via let’s encrypt for certificates) and add a few middlewares like authelia and maybe crowdsec. Later on I’ll probably hardwall immich with authelia and add mtls for the app.
From what I’ve everything cam be done both via the configuration file and docker labels but especially mTLS is easier to set up via a configuration file.
What do you recommend, docker labels or central configuration file?

wild lynx
#

My preference is a file as I like to see the config in one place instead of being spread around on each container

naive lintel
#

I have finally done the setup with VPS
Pangolin was reallyyy greatt help!

ivory lark
wild lynx
#

I often think about yesterday being very old, until I remember the endless passing of time where each day ends after just 24 hours when in reality I need 36 hours a day ...

Jokes aside, yes compose files kind of put it into a place, but if you do it right you have many compose files and then the config is spread around again. In the end it depends on if you prefer the service config close to the service or the proxy config close to the proxy 😛

turbid narwhal
quaint ingot
ivory lark
# wild lynx I often think about yesterday being very old, until I remember the endless passi...

yep i dont think there's wrong way per say just whatever is most convenient to you who will be managing it
i use caddy so it's not like i got a choice, but i actually prefer having a overview of all my ingress, good to be mindful and have a singular view of it all
i do have a lot of docker compose files for all my different services, and i do enjoy it that way for ops side
my friends who use traefik though likes the label because everything is close to the container, even though that wasnt my thing
personally it feels like a bit of a hack to define rules that way(you will have to treat everything as a KV), i rather have a nice DSL like caddy config

scenic gyro
#

I use HaProxy as the external proxy and then reencrypt and send to Traefik internally

#

It’s not perfect, I would like 2FA

zinc merlin
#

you can use OAuth for 2FA

frigid merlin
#

Hello, looking for some advice. I use authentik and oidc and everything is peachy but i have to leave /api unauthenticated to use the android app. Are there any guides to using a custom header to authenticate the /api route? The only ones I'm finding are for cloudflare...

frigid merlin
#

Just in case more context is needed: I have my own WAN IPv4, traffic goes through caddy with fail2ban and forwarded on to authentik. I have a forward Auth app in authentik and another oidc app which together give me OIDC only login (password disabled, oidc redirect on auto). On desktop this lets my through perfectly. The forward Auth app lists the /api route as unauthenticated so the android app can do its thing. I'm looking for any guides that would help me compare the custom header against a custom user or group attribute for traffic going to /api from the WAN (the containers are in their own docker network with only the main app container exposed to the same network as caddy)

turbid narwhal
#

ideally you wouldnt even need forward auth when using oidc login

#

but you can always do some trickery in caddy to have the /api endpoint still behind forward auth for everything except the immich app's custom header

frigid merlin
#

Yes, that might work... If i check the custom header first but in caddy instead of authentik and pipe everything else as normal... Thanks, I'll try that

turbid narwhal
#

I don't use authentik so maybe you need to add copy_headers or something else to the forward auth

#

but you should already have that set up from before

frigid merlin
#

Yes, header forwarding is set up, this is wonderful, thank you.

wild lynx
#

If your auth proxy supports custom headers you could also set it up there. Never done it with authentik as I skip auth proxies whenever possible so not sure if they support it. I'd be surprised if not though.

frigid merlin
#

Oh it does, it's why i thought of doing it there first but couldn't find a guide, but caddy will probably work for my case

sharp fog
#

I use Sophos XG for my home firewall. I secure Immich behind a WAF (type of reverse-proxy) and use a Let's Encrypt certificate to secure the url.

quaint ingot
solar eagle
#

I've exposed my Immich server to the internet because my users aren't tech-savvy enough to use a VPN. I'm using Cloudflare with geo-restrictions (allowing only my country) and I've blocked bots and high-risk IPs.

For those with a similar setup, do you recommend adding extra rules based on specific URL paths?

ivory lark
#

do you know if your users will strictly be using the mobile app?
if you use header filters
it's a low tech way of creating a preshared secret key as filter

#

i think IP filters is not ideal.... given what if i am traveling, or what about someone's compromised device(local botnets)
so i wouldnt give it a lot of weight and safety

#

if you trust your users to set secure passwords
it might not be the worst thing ever to just leave it exposed

#

personally i would at least set a SSO, and make sure that it requires strong password or passkey login
so the authentication process get redirected to the SSO login
and the SSO login can enforce policies, and safety measures

  • like enforcing strong password/passkey/2fa
  • enforcing max login attempts
  • captcha filtering of bots trying to brutefoce
    etc etc
chilly ingot
#

Cloudflare tunnel is great but the fact you cannot send over files bigger than 100MB is painful

wild lynx
#

It's an easy way to get started, but it has it's drawbacks. When possible I'd always recommend hosting the public endpoint on your own.

chilly ingot
#

I'm still somewhat a noob in this field

#

So doing this would be painful xD

#

But I guess at some point I will have to switch

wild lynx
#

Taking ownership of the storage with Immich is a good first step, second would be taking ownership of who can read your traffic. One thing at a time 🙂

quaint ingot
chilly ingot
chilly ingot
#

sorry for being stupid

#

lmao

quaint ingot
#

You’d have to set it up on a vps and then install the client on your home server from what I understand

quaint ingot
wild lynx
#

Pangolin is a popular solution when you either can't or want to access your home network directly. It works similar to what Cloudflare is offering with their tunnels. Another self hosted option would be Netbird (I have this on my VPS).

quaint ingot
wild lynx
#

I had both running, they do the same nowadays. Pangolin started as a proxy and gained VPN features, Netbird started as a VPN and got proxy features. Pangolin was a little easier but they also push a bit more into their subscriptions. Like for geoblocking you basically had to manually add it to the traefik configuration and in the end it felt like I could have done everything by myself.

quaint ingot
#

Well I plan to use it mostly as a vpn only so Im ok with that

stoic notch
#

since newt has quite the performance issues

wild lynx
#

Both??? Sounds very redundant

#

Since they both do the same

stoic notch
#

i just use netbird as my backend for everything

#

and pangolin on my local servers

#

then another traefik on a public vps

#

which allows me to do direct acces to my jellyfin and everything else locally

#

with my own ca locally and a wildcard cert for the vps

wild lynx
#

locally I just have a caddy with a simple config file

stoic notch
#

works like a charm, netbird allows me to allow my friends faster direct connections to my gameservers etc

wild lynx
#

What's the reasoning behind doing pangolin locally?

stoic notch
#

it enables me to switch to the next free vps if i run out of DigitalOcean credits

#

and having the same setup locally and remote makes it really easy

wild lynx
#

You live in a DigitalOcean datacenter?

stoic notch
#

no

#

only using the gh student vps rn

stoic notch
worldly wraith
#

Don't underestimate its power

#

More than enough for immich

#

I started my setup from a single n100 mini PC with 16gb ram

#

Had immich, nginx reverse proxy, authentic etc

tawny sentinel
zinc merlin
#

PQC so if anyone captures my traffic to try to decrypt my immich photos in 5 years, they wont have to look at them 😄

image.png
#

ok, Hybrid PQC but still PQC nonetheless 😄

wild lynx
#

Oh interesting, I should upgrade my proxy config 👀

zinc merlin
#

which proxy are you using?

wild lynx
#

Caddy

zinc merlin
#

ok yea, that should work

#

i just read, it should be enabled by default on newer Caddy versions

wild lynx
#

I saw that too, now I just need to check if my browser actually uses it. Seems like Firefox defaults to the non quantum curves

#

false alarm, looks like it works an I'm safe

image.png
#

They just decided to hide this in the developer tools

cosmic root
#

I see this, is this fine? what do I need to do to Caddy to use something better?

image.png
wild lynx
#

It's basically all you need

#

x25519mlkem768 is the one you are looking for with PQC

zinc merlin
#

too many germans here 😄

cosmic root
#

seems it already takes it by default?

wild lynx
#

Caddy has very modern defaults, yeah

#

I think they allow TLS1.2 by default but the cipher and curves are all pretty good

zinc merlin
#

i think my downstairs neighbor (like 70+ yrs old) is running a server farm cause our floor feels like we have floor heating...

#

so i have to be wary of her capturing our traffic and decrypt it when she is 85 :[

#

either that or its because of her cactii farm 😇

turbid narwhal
worldly wraith
wild lynx
#

If you have HTTPS/TLS then you are encrypted. I posted a link a bit down where you can generate a modern configuration for your proxy

sick bramble
zinc merlin
zinc merlin
zinc merlin
#

guys, btw.... this is in no way necessary....
I just did this for fun, noone will need this to secure images...
this is just so that noone will capture your traffic and decrypt it once quantum computing is more readily available...
your neighbors are unlikely to have this and whatever bad actors would make use of it, would do this on more confidential data like trade secrets and state secrets
just dont want anyone to do this to "increase their security" and put in a lot of work.... if you do it for fun, all good 🙂

quasi bane
#

Someone said it was a bad idea to use Cloudflare tunnel to expose you Immich instance because Cloudflare can basically see all your photos, is that so? What are the alternatives? I won’t use Tailscale because I run Mullvad pretty much all the time and can’t have two VPNs running at the same time.

thin tide
#

Alternative: use the Internet as designed by hosting your service locally (typically with a reverse proxy like Nginx)

quaint ingot
zinc merlin
quaint ingot
turbid narwhal
thin tide
turbid narwhal
#

just take this and replace Google with (maybe) cloudflare

nsa_slide.jpg
sterile zinc
#

I JUST started using Immich so, thus far I'm using a Cloudflare app tunnel just to get it working. Next I'd like to get Pocket ID working. Then I'll probably try to replace Cloudflare with Pangolin or Tailscale.

My previous effort was trying to use NextCloud and their photos app with ddns and a reverse proxy. I never got that fully working and then my mini server died. When my replacement mini server had to be a different machine that didn't accept the previous machine's M2 drive, I decided to try all different software, too. This has proven to be easier and faster to set up.

quasi bane
quasi bane
hollow spoke
#

The truth is that you're probably not worth the time for someone to hack your server (if you have properly secured setup)

#

Be sure though that you'll probably be hit with bots, especially if you have something like ssh exposed

wild lynx
hollow spoke
#

Yeah of course

zinc merlin
#

and hardening your home setup can be fun 😄

turbid narwhal
#

"opening your ports will give hackers access to everything, kill your cat and set your house on fire.

Use cloudflare tunnels or a vps instead so the ports are open on someone else's machine"

WeirdChamp

#

also applies to a lesser degree to the tailscale shills who cannot for the life of them understand that I can't connect a smart TV to tailscale

distant crypt
thin tide
#

Yeah but in most cases it’s family with a POS ISP router haha, not openWRT/opnsense

distant crypt
#

lmao that's fair

thin tide
turbid narwhal
turbid narwhal
wild lynx
#

Just wait until they learn that outgoing connections open a port for return traffic

quasi bane
zinc merlin
quasi bane
# zinc merlin Plenty, never ending list Which part exactly?

I’m really a novice so I’ve been doing port scans and found out that my NAS poked two ports in my network, I panicked and shut them so now I can’t use my NAS outside with the built in service.

What are some techniques I can use to harden my network? I’m using a TP-link mesh router (I know about the vulnerabilities 😭)

thin tide
#

Turn that off IMMEDIATELY whenever you setup an edge device

#

Crowdsec
Fail2ban
VLANs
Geo blocking
All terms you can Google

quasi bane
zinc merlin
#

Search for cis security
They provide free best practices for anything
Docker, nginx, Linux, etc.

hollow spoke
#

Basically if anyone got into your network and bypassed your security measures, you want to restrict their access and what they can do as much as possible on the host

zinc merlin
#

a seemingly endless endeavour 😄

quasi bane
empty pollen
#

Hey guys, let me know if you think this public Immich setup is secure:

Connection:

Traefik reverse proxy
Port 443 public

Security Configuration:

  • Disabled password login (oAuth2 login via Authentik only)

  • Crowdsec actively scanning Immich logs AND Authentik logs to detect bruteforcing, scanning and any other funky requests

  • Configured Crowdsec to automatically ban any connection to ANY part of my server (not just Immich) that originate from outside my country (since i dont really travel anywhere at the moment)

I know security through obscurity is not real security, but I never post my IP or domain online. So I think that factor certainly lowers my attack surface even more.,

Id say as of right now, my biggest threats are probably LAN based attacks. My WAN is pretty secure i like to think

#

My host was also vulnerable to the copy fail exploit released a couple days ago, so I had to manually patch that too since I use a custom kernel on my Host.

ivory lark
#

your cert renewal is public information(depends on how your cert renewal is setup, if you are using wildcard cert or not)

empty pollen
#

yes im using wildcard certs as opposed to subdomain certs

thin tide
#

Wildcard certs are in my opinion extremely underrated. It allows you to add a significant degree of obscurity to exposed services , especially from bots and crawlers

ivory lark
#

like i am not "going all in" on wildcards
if you try you can guess my services but at least it's not advertised for the world to see on crt.sh
if i was going all in it would be like abc.xyz(domain)
and mount it as (service).(some long string).abc.xyz
where (some long string).abc.xyz -> bounds to a single host

thin tide
#

In addition you can configure your proxy to serve a fake cert when connecting by IP or without a matching SNI host

ivory lark
#

oh yeah my caddy just hangs up the connection i think if you connect to public ip

empty pollen
#

me too, i have sniStrict: true in my traefik config

turbid narwhal
zinc merlin
#

obscurity is always nice but not security, partly true
if that would be all you do, it is not security.... but it can be part of a security concept, no need to make information discovery easy
as Zeus said, serving a "fake" snakeoil/dummy cert is nice so the true domain does not get "discovered" by scanning the IP or by accessing it with invalid domains
years ago wildcard certs were frowned upon because of the security implications... especially in a self-hosted environment and nowadays with always shorter certificate lifetimes, this is not necessarily true and I personally use mostly wildcard certs (with some specific certs for stuff hosted elsewhere, like my emails, etc.)
after that, look through hardening guides specific to your proxy and your host and if applicable your docker installation
a basic look at your network setup between all your services could be worth it once you start self-hosting several things (I like cisecurity.org which offers free best practice lists)

stoic notch
#

a big thing almost everyone should do is set the default bind to localhost on docker, since docker usually bypasses your firewall rules

turbid narwhal
#

I mean I purposefully leave it on 0.0.0.0 because I want to access immich from lan but yea

empty pollen
#

I think my biggest priority as of right now is ditching my shitty ISP router and replacing it with a nice UniFi router that actually lets me setup VLANS

#

my ISP router does have an "iot network" and "guest network" but my main network is still accessible from those networks for some inexplicable reason, like what the hell is the point

zinc merlin
#

lol yea that makes no sense.
Do you know what you want to do with those vlans yet?
For many one vlan is enough because they don’t have many devices.
I like to segment my own network as well though 🙂

turbid narwhal
zinc merlin
#

Most IoT devices need Internet access for functionality 😄

I limit internet access for some of my IoT devices. My todo list has plans for device profiling them and then allow access to whatever they usually access but not more

empty pollen
#

my smart lightbulbs are going straight to my internet jail VLAN, no internet access for you....

empty pollen
wild lynx
#

For IoT devices it depends on if they are cloud based or not. I would limit all IoT devices that can run locally. ofc something like a media player or smart home hub needs internet access, but apart from that everything is walled off. I do some light country blocking and my philips hue bridge always tries to reach chinese IPs for it's time 🙄

empty pollen
#

XDDD

fading forum
topaz solstice
#

Excuse me, I’m not sure how to leave a review. I’ve been using Immich for a month now and have some suggestions and feedback regarding its performance. Where can I send them?

wild lynx
#

We don’t have a space just for reviews, but #immich would be a better place than this thread.

#

Actual suggestions would be a feature request on GitHub though

bright wind
#

anyone using pangolin on a vps for exposing immich? my cheap vps is to slow, transfer speed is only 3-4 MB/s and I'm looking for a new one in central europe.

distant crypt
#

Hetzner?

bright wind
#

I just wanted to try them out - but the VPS with ARM is currently not available. Do you have experience with them?

distant crypt
#

I have a 4c/8GB cloud VM for years (I think right when they released arm instances) for various things

#

Generally hetzner is a solid choice

cosmic root
calm jackal
#

Is there anywhere that people have a roadmap for what is needed or what would make people feel better about exposing Immich to the internet? It's honestly not a reasonable expectation that it should not be exposed, one of the big use cases for a "cloud" image service is exactly being exposed. There are features built into Immich that only make sense if it's exposed! (i.e. share links).
So, I guess people are just paranoid about it, and nobody willing to sign off on it being "hardened" enough? It seems like that is an important thing to do.
Are there any known weaknesses in particular?
The main weakness I can think of is that there is no way to make only parts of immich public - e.g. if I could make only share links public, that would be good, but share links need the API so you mostly have to expose everything.
Exposing everything should be fine, unless we're just not confident that it is protected.

wild lynx
#

Everyone has a different definition of what needs to be done to securely host Immich. You won't find a list of things you need to do as it's highly subjective. It's been quite some time that someone put Immich itself in a negative way that it should not be exposed. It usually boils down to your setup in front of Immich.

#

fwiw I've been running exposed Immich instances for around 2 years with no issues

thin tide
#

So I think your premise is flawed

calm jackal
# thin tide So I think your premise is flawed

Huh, I was sure I saw it mentioned in some getting started docs that they don't recommend exposing it, but I can't find it. So you must be right. That's great!
I mean, I wouldn't expose it to the internet if there was a reasonable way, but there's no way I've seen to expose only some parts.
I'm not sure why people claim it shouldn't be exposed, other than just the general principle of only exposing the minimum necessary. Of course, if you're running it through a reverse proxy you're still exposing the same surface as the ports.
I run it exposed to the internet, using oauth / authelia. I just have multiple kinds of backups and try to follow best practices. I thought maybe there was some roadmap for security improvements but I don't know where I got that idea.

wild lynx
#

No, it's just the setup in front (OAuth, Proxy etc.) that's usually discussed here. Some don't feel safe without additional security measures.

thin tide
#

Most of the noise you see around this is a function of 1) immich handling relatively personal information and 2) immich attracting many self hosting newbies

calm jackal
#

Makes sense. It is very easy to set up initially, probably easy to step in it.

thin tide
#

At the end of the day it’s a webapp and you expose that however your threat model dictates

wild lynx
#

Also keep in mind that there are A LOT of Immich users that already struggle with setting up Immich. For them it's a whole other challenge to keep it secure.

#

We are here to help whenever there are questions, but there will never be a single truth

calm jackal
#

Well that makes me feel better. I feel like all I was hearing was people talk about various ways to block all public access, and not so much from people who allow public access (obviously with auth I mean). Thought I was the crazy one (I'm sure some would still think so). So good to hear your pov Finn.

thin tide
#

I allow public access with immich login 🙂 no issues

wild lynx
#

I usually take the standpoint "I will not do more security in my homelab than what I'm doing at work" at that's where my setup stands today: just enough that I feel safe for the kind of data that lives there. It's a risk analysis 🙂

cosmic root
quaint ingot
zinc merlin
#

To each his own...
I also have immich exposed publicly for 2+ yrs now
though hardening is always a good idea

lusty thunder
#

FWIW I did a security audit and came up with these 3 items worth noting...

Anyone using a reverse proxy should ensure IMMICH_TRUSTED_PROXIES is configured.

[P1] Default proxy trust is broader than a Traefik deployment should allow.

Express trusts loopback plus network.trustedProxies: server/src/app.common.ts (line 49). The default trusted proxies are all link-local and unique-local/private ranges: server/src/repositories/config.repository.ts (line 324). In a Traefik setup, only Traefik should be trusted to supply X-Forwarded-*; with the current default, a reachable private-network peer or compromised container can spoof X-Forwarded-For and X-Forwarded-Proto, affecting audit IPs and request.secure-driven cookie security: server/src/middleware/auth.guard.ts (line 57). Express’ own proxy guidance warns that the last trusted proxy must overwrite forwarded headers.

Fix: default to loopback-only, or document and require IMMICH_TRUSTED_PROXIES to be the exact Traefik container IP/CIDR, not broad private networks. Source: Express behind proxies.
# 
[P2] Shared-link slugs can leak the real share key through Host-derived metadata URLs.

SSR derives defaultDomain from request.protocol and request.host: server/src/services/api.service.ts (line 76). For public /s/<slug> pages, metadata generation embeds a thumbnail URL containing ?key=<real-share-key>: server/src/services/shared-link.service.ts (line 227). If server.externalDomain is unset, which is the default, that secret-bearing absolute URL is based on the incoming Host/proxy headers: server/src/config.ts (line 372), server/src/utils/misc.ts (line 52). A permissive Traefik router or direct backend access can therefore make Immich render the real key into attacker-observable HTML for a slug URL.

Fix: never build secret-bearing URLs from Host/X-Forwarded-*; require a configured external domain or validate Host against an allowlist before rendering those tags.
# 
[P3] Socket.IO accepts WebSocket connections from any Origin while authenticating via cookies.

Both gateways use cors: true: server/src/repositories/websocket.repository.ts (line 45), server/src/maintenance/maintenance-websocket.repository.ts (line 28). Auth reads cookies from WebSocket request headers: server/src/app.module.ts (line 86), server/src/services/auth.service.ts (line 472). Socket.IO notes that CORS does not protect WebSocket upgrades; allowRequest is needed. In common Traefik setups with many same-site subdomains, a compromised sibling app could open a socket to Immich and receive user-scoped events if cookies are sent.

Fix: enforce an Origin allowlist for WebSocket upgrades, ideally based on configured server.externalDomain/trusted hosts. Source: Socket.IO CORS handling.
wild lynx
#

„worth noting“ is that AI reports still need to be checked if they are actual issues or if AI is just talking. P2 was funny to read

stoic notch
#

the thing with immich is that most stuff needs some sort of acces key, either an auth cookie or the share key, making it quite secure

turbid narwhal
wild lynx
#

Do they have a history of unprotected endpoints?

turbid narwhal
#

apart from admin stuff

#

they heavily rely on the url uuids or whatever being too long and unique to guess

#

test it for yourself, log into jellyfin with dev tools' network tab open, get an url of whatever (image/mp4/etc etc)

and then open it in incognito without having logged in

wild lynx
#

Media files being streamed with url encoded keys is quite normal and you often see it for commercial streaming services as well.

#

It's often used when you grant direct access to files hosted in an S3 bucket or similar.

turbid narwhal
#

TIL

lusty thunder
wild lynx
#

Weird thing to say in a channel about exposing. But surely the best way if you don't need to expose.

sick bramble
distant crypt
wild lynx
#

Eh ... I guess it's at least easy on the processing, just adding 1 instead of using entropy to generate a random string??? Yeah, no nothing excuses that

real maple
fading forum
stoic notch
#

maybe smth like this could be written in the docs?

#

since many people use cloudflare

wild lynx
#

There is a small note in the FAQ about the CF limitations but I doubt many look there when setting it up

limber igloo
#

I have Unraid and I use Cloudflare One trust

crystal leaf
#

I have a couple of questions about what happens when I import a SSL Client Certificate, if anyone knows the answers?

  1. I have to log out and back in to import it apparently. What happens when I log back in? I have 14k assets on the device, as well as specific folders that I back up, an also some settings under Free Up Space so that it never frees up certain albums I want to keep. Will these preferences be wiped? Will Immich have to re-scan/hash every file locally and compare to server?

  2. I currently utilise a split-DNS approach for many services so that when on my home network service-name.mydomain.com resolves to service locally, and also a public DNS for the same service-name.mydomain.com resolving to the external entry point. If I do the same with Immich, when I'm on my LAN, the app will presumably still present the mTLS cert - but nothing will be expecting/requiring it. Will this break anything?! Or will the immich app just happily continue to talking the server? When I go off my home LAN the mTLS cert will be expected by Cloudflare, and it should "just work"... I'd prefer not to have to use 2 different URLs, but I suppose that is an option since the Immich app does support it.

Thanks in advance for any info about what might happen here!

wild lynx
#
  1. Yes to all - settings are reset and assets will be hashed so it knows which ones are already uploaded.
#

Not sure about 2, never used mTLS

crystal leaf
# wild lynx 1) Yes to all - settings are reset and assets will be hashed so it knows which o...

Do you know if there’s been any conversation about why it’s necessary to log out prior to importing a client certificate? Has it been investigated if it could be possible to add/enable mTLS without a full app reset?

Re 2) ok thanks! I use mTLS with a couple other services that are straight web apps/sites and they work fine going between local connection (no mTLS requirement) and external connection (mTLS required by Cloudflare) and Safari on iOS handles it without any problems. Just not sure if the Immich app will or not!

dapper panther
fading forum
zenith radish
#

Hey everyone! Just wanted to share my Immich setup and see what you think.
I’m running Immich on my QNAP NAS (a massive upgrade from the awful QNAP gallery app). For remote access on Android, I use an app called WG Tunnel connected to a WireGuard VPN on my FRITZ!Box.
I set up an app-specific tunnel so the VPN only triggers when Immich needs it. Plus, it uses the "trusted Wi-Fi" feature, so the VPN automatically disconnects when I’m at home and reconnects when I leave.
It’s always-on, completely seamless, and works perfectly. How do you guys handle remote access?

quaint ingot
calm flare
stoic notch
#

or netbird

sullen geyser
#

i use DuckDNS

#

it's pretty simple

#

you spin up the duckdns docker container with the token and domain env. variabiles and thhen after exposing your immich port to the internet (Who changes for all routers i suggest searching up a tutorial for your router provider but generally it is under NAT) and then you are all set

#

or if you want you can use caddy who is another world

wild lynx
#

Please do not expose Immich directly without a proxy in between for TLS. Everyone between your server and client can read the unencrypted data, including session tokens for your account.