Exposing Immich to the internet

[worldly wraith]

Because of it being front faced accessible from the internet, we want it as secure as possible. Suppose a vulnerability of Authentik gets discovered and I later discover it. I am doomed. Where as, CloudFlare zero trust is dependent on cloudflare's service and stuff. So, I basically for security trust CloudFlare more than myself, especially cause I have life beyond looking at vulnerabilities all day

[timid ravine]

Authentik is used across many huge corporations, it’s maintained by professionals. I doubt it has major vulnerabilities + who’s going to care what you host at home.. that plex server and your images are safe. You and I are not Elon Musk type of celebrities 😅

[worldly wraith]

Well, it just depends on what you prioritise ig

and it doesn't matter if it's maintained by professionals, problems are present everywhere. All I stated was it just reduces my effort in security

[timid ravine]

That’s also true. I mean for most people that self-host Authentik is quite a strong choice + it’s free.

Nothing that’s public on the internet is 100% safe.

It probably never will be.

[wild lynx]

On the other hand I would not hand over all my data to Cloudflare.

[fluid cedar]

i have a tunnel to cloudflare with rules that allow only connections from my city to access my immich page

not secure once someone figures that out, which is not that hard, but then ive got OAuth infront

other than that, nothing else

[thin tide]

If you’re that restrictive is it even worth using the WAN ..?

[fluid cedar]

used to access via tailscale but it used a lot of battery, found it much more convenient to just have it public in a place where im always located in

but also, now ive got OAuth so i do need a public domain for it, as far as i know though

google*

[thin tide]

Fair. Could be a good option for a custom header as well if your exposure is that narrow

[fathom patio]

Important note that cloudflare tunnels limits to 100MB upload per files.

[timid ravine]

Is that possible to increase?

Like a paid plan or?

[wild lynx]

If you have way too much money, yes. But for normal people - just no.

[remote widget]

also, not by all that much

[wild lynx]

The enterprise plan has up to 500MB, for more you have to get a custom limit through support

For context, the business plan with 200MB costs around 200$/month

[hollow spoke]

XD yeah not worth it

[timid ravine]

Oh my..

Is there also a limit on dl?

[quaint ingot]

Imo you probably better use something like pangolin/netbird/… although that comes with a certain overhead of features you probably won‘t use, but afaik it‘s the easiest way to get a similar experience

[timid ravine]

Cloud flare tunnels are just easy to setup and use.. that’s all

[quaint ingot]

I get that, but the other options aren‘t too complicated either, I installed pangolin yestwrday and the install process is completely automated using their installer, you just have to decide on a few options (give yes or no) and then it gives you a config to copy for the client on your actual server

[elfin radish]

How does this setup sound? I haven't started this just yet, I currently just have my Immich instance accessible via Tailscale, but I really want to expose it to the internet while keeping my home network safe.

I want to use a cloud vm on Hetzner or Linode as a proxy for my Immich instance. I would use Nginx/Caddy on the cloud vm to forward the traffic to my home lab Immich instance via tailscale. Use Tailscale ACL rules to limit the access that the vm has to my tailnet (only allow traffic to Immich). And on my home lab set up the firewall to ignore all other external traffic except from tailscale.

No open ports on my router. No cloudflare upload limits. Hetzner and Linode both have generous bandwidth limits, and excess bandwidth is cheap. Because it's not my home network, I can use Cloudflare without having to proxy the VM's IP address, avoiding the upload limit while still allowing for zone rules like geo-blocking (further googling revealed this to not be true, zone rules require Cloudflare's proxy, which imposes the upload limit).

There is still the risk of immich exploits and vulnerabilities, but we're all rolling the dice on that.

[turbid narwhal]

nifty setup! you can still set up geo-blocking from the cloud VM, both nginx and caddy have excellent plugins for it

[quaint ingot]

Do you plan to run a reverse proxy on the vps?

Also you might want to have a look at pangolin or netbird which both combine the vpn and reverse proxy part for exactly the usecase of exposing services.
They come with a lot of other features too though which makes them heavier than your setup

[elfin radish]

Yeah, I would use Nginx as a reverse proxy on the VPS. But Pangolin and Netbird sound interesting! I'll give them a look, but I'm already using Tailscale for other purposes so I may prefer to stick with that

[quaint ingot]

I recently installed pangolin and am simply using it for exposing my stuff but it can do a lot more which I don‘t need, probably also what tailscale does (im not sure though).
I mainly chose pangolin because I don‘t have the time/capacity to set up and configure everything myself (I mainly wasn‘t sure how to do the routing through the tunnel) and pangolin is very easy to set up

[worldly wraith]

I recently switched from Nginx to HaProxy and it somehow feels faster to use. even when loading huge videos

[scenic gyro]

I’ve got HaProxy facing the internet and then Traefik on the inside

[limpid plank]

ive pangolin for exposing it, normal email pass disabled on immich and user can only use Authentik + mandatory OTP flow (flow is a thing in authentik)

[craggy kraken]

Hi.
I created a NAT on my router for a high port redirecting to Immich server in house.
I urge my family to have a very complex password as we got a password manager.
The pseudo security i sassured by a static IP filter. Only one IP can use this NAT.
I rent a VPS (15 bucks a year) configured with nginx as a reverse proxy.
I own a domain name, created as many subdomains as needed (6 $ a year).
The VPS has only 100Mbps bandwith but it is far enough for my needs.

Hope this can help

[hidden lagoon]

You can slot in PocketID on your reverse proxy end and people can use the finger print to register OIDC to PocketID.

Just remove the password all together.

[light rapids]

I have a NAT on my router all ports are blocked but 1 and i forward that over to a managed switch. There is some built in security. I dont care if the whole world sees my photos. Im really unimportant and boring.

[keen mica]

Pangolin on a geoblocked vps. Pocketid for oidc

It's super solid and super easy to use for yhe end user. i just hope homelabbers dont get rugpulled

[bitter plume]

What do you do when it’s limitation of cloudflare? Its let only 100 mb maximum to upload…
Its so hard for large file

[wild lynx]

Quick answer is don’t use CF if you depend on uploading big files remotely. Some add either a VPN to bypass their own traffic or route the traffic locally when they are home.

[trim mango]

Every single piece of software on Earth can have vulnerabilities. And hackers automate abusing vulnerabilities and throw wide nets. Even more so with the advent of AI.

Deploy any service to the internet, wait 5m, check your logs, it'll be full of attackers trying to find unsecured endpoints.

Your pics could be used to blackmail you, even if you're not a celebrity. There's an industry around that. Every year, lambda people become victims to this. Could be used to generate deep fakes. Could be crypto locked. Immich could be used as a bridge to the rest of the network. Maybe the host runs other services?

I think one should always properly secure all the services it exposes to the internet.

[unkempt adder]

One could even argue that less used projects are more secure nowadays - if they are only used by private entities- because there is less incentive to target you.

I 100% agree with your statements

[turbid narwhal]

PSA for Npm-Plus users

Update ASAP, very bad vulnerability fixed in the latest release (DB of the whole admin operations exposed, containing dns provider credentials, etc)

https://github.com/ZoeyVid/NPMplus/releases/tag/2026-07-23-r1

[wild lynx]

That convo was not that there are no vulnerabilities, but that no matter if you use a SaaS or self host, they all have risks. Any exposed service can be attacked. Personally I just don't take photos of my credentials or whatever so there is nothing to blackmail me.

[trim mango]

We clearly didn't read the same messages.

Also, are you trying to argue that because you don't care, nobody else should care? I hope you can understand that your personal situation doesn't apply to everyone on Earth.

[zinc merlin]

TAC, everything you said is true...
and i would never advise anyone not to take measures to secure their environment... that is a general thing you always need to do
you can weigh your risk vs advantages though, i would say your google photos are at risk of being lost as well, though without further risk to the rest of your network
definitely dont expose anything if you dont know what you are doing but if you try to secure your setup, risks can be lessened (there is always a remaining risk)
I personally expose immich and many other services but everyone should decide that for themselves...
if you have data even on "secure" services like Google, Microsoft, etc.
they are never 100% secure

[wild lynx]

No, I'm not trying to argue to not do any security. I just think it's stupid to bring in some celebrity element into it. And no matter if you use a SaaS for protection or self host the components, you should ALWAYS be aware of the risks. A lot of people think when they click the cloudflare cloud icon they are safe.

But I also think it's not the smartest idea to put things on the public internet that are apparently so important they can damage your life.

Exposing a service should always be a concious decision, not a "I'm lazy and don't want to care"

Also please read, I wrote "Personally I don't care", not "No one should care"

[quaint ingot]

In the end you alway have to weigh comfort vs security imo, how much is the extra comfort exposing one or more services publicly worth to you etc

[thin tide]

No method of using computer is 100% safe. Local, exposed, cloud, vpn, it’s all a risk calculation

Life isn’t 100% safe either

[wild lynx]

I assume all my online services to be "hacked" the moment I put them online. Everything else is just denying the possibility. Especially with AI and all the IoT devices.

[zinc merlin]

your financials are usually mostly online 😛
but anything you put online will get probed eventually... you will definitely see tons of automated attempts in 5mins
that does not mean much but if something gets discovered you get put on a list with the info that was gathered...

if you dont secure...

i try to secure but have lots of things left to make more secure... I do expect not to get "broken into" but I know that its far from impossible

[trim mango]

I work in finance, and I'd argue 90% of the efforts put in our software is about security, 9% is corporate BS and 1% is feature.

The services we run have nothing to do with the traditional "secure" services like Google & co.
Our software doesn't trust the developers who build it, the DevOps who ship it or the operators who monitor and operate it.

But you can't expect every software to be build that way, it would make them 10 times more expensive.

[turbid narwhal]

10 bucks that the banking app "security" is banning grapheneos

but on a more serious note, that's an unrealistic expectation for self-hosted services with minor impact if compromised, the "doesn't trust the developers" doesn't really make sense from a technical standpoint, and calling Google "secure" jokingly really undermines the fact that they have a whole division/branch just dedicated to finding zero-days

[zinc merlin]

thats rare... i work in security and usually most financial institutes are not so much about security 😄

[wild lynx]

I don't think this applies to all companies in finance. And in the end you have to trust someone anyway. And if it's the secure hardware element checking the OS's integrity. Everything else is marketing 😉 It has to start somewhere.

[distant crypt]

I don't trust any root CAs. I only do HTTP

[quaint ingot]

Make your own CA

[trim mango]

Some approaches really aren't comparable. For starters, my client (I'm freelance) is a root CA (for financial institutions) and doesn't rely on anyone for the PKI. They buy HSMs but they don't blindly use them. They test them extensively.

Operators don't get any secrets to do anything. The secrets they use during deployments are encrypted and the key to decrypt is embedded in the binary of the service. Pretty much all data is encrypted even when hot, and is only decrypted at usage time.

By comparison, some company I worked for gave me the DB admin password to fix a few corrupted records.

When I asked my client to allow the usage of yq on dev machines, I had to wait 2 weeks for audits, then I had to defend the usefulness of the tool in front of a panel of 5 people from global security 💀 .

[trim mango]

You're joking, but you can easily do it. The annoying part is installing/trusting the CA on all devices that will use your services.

That's what I do with my VPS for admin accesses (mTLS). Of course, I upload the certs using another CA during the HTTPS upload. My client would fly someone to the server.

[quaint ingot]

Yeah I get that

Also if you want other people to use you as a ca it gets somewhat complicated I guess

[trim mango]

Sure, but if it's you and your wife, that's manageable. More than that and it's a headache.

[wild lynx]

some company I worked for gave me the DB admin password to fix a few corrupted records.
Yeah that's an example of how it should never be and I can only shake my head when I hear such stories.

[analog stirrup]

Hello,

Is there any guide I can follow to configure Tailscale for remote access? I'm very new to home networking and would appreciate any help with this.

[faint thorn]

i currently just have immich behind a cloudflared tunnel connected to a xxxx.mydomain.com url. But i've realized that probably isn't ideal.

Would this be good:

• Immich Public Proxy app to make the share links go to another subdomain (yyyy.mydomain.com)

• cloudflare zero trust with 2FA for additional protection on the main domain for access (with whatever is necessary for the mobile app to work)

[bold gazelle]

Try gemini i did it with it, and its doing good

[wild lynx]

Lots of things AI gets wrong, please be safe and confirm with a living being

Read the official documentation and if there is anything unclear ask 🙂

[wild lynx]

Proxy Authentication only works when e.g. you set up a bypass rule based on a header and configure that header in the app. Additional headers in the app are experimental and might not work as intended sometimes.

[bold gazelle]

I protected it trought block all port, i can go to my vps only trought tailscale. And only think i can do is share a image, but idc about it 😁.
But yes be carefull

[wild lynx]

I see a think in there 😉

[faint thorn]

hmm

[frank wyvern]

Anyone have a guide for the following setup, i tried to search but there is so much crap out there….

Authentik
Pangolin
Caddy
Immich

Authentik works in pangolin and immich currently.

I want to add immich to pangolin;
Pangolin -> Newt -> caddy -> immich

But want to make sure Immich in the mobile app will still work.

Would also like share links to still work.

[frank wyvern]

Or does it not make sense to have a “double auth” wall. Ideally you login for pangolin with authentik, you should not have to login again for immich cause your already logged in

[wild lynx]

Double Auth (aka Proxy Auth) will not work with the app (Unless working with bypass rules). Personally I would only have Authentik configured in Immich, skipping the proxy layer auth. I only use auth proxies for services that don’t support OAuth natively.

[quaint ingot]

I think there is an option if you register pangolin as an oidc client with authentik to use authentik as auth but pangolin for access control rules

[frank wyvern]

What do you mean

[quaint ingot]

https://pangolin.net/news/idp-support
mainly this short article, I‘ll try it out once i finish configuring my authelia and migrate my pangolin from hetzner to netcup

[frank wyvern]

I already have authentik setup in pangolin

You can login to pangolin with your authentik credentials

And login to immich with same credentials

But i have not added immich to the pangolin yet

My worry is if i require auth in pangolin for immich and then immich also requires auth i will run into issues with mobile app

And sharing

So like Finn was saying i might have to disable the pangolin sso and just use the tunnel part

[turbid narwhal]

you might want to specify some terms because referring to it as "pangolin" and "auth" is very confusing

what I got from this is that

you have either forward auth or oidc as login methods in the pangolin dashboard

you have oidc setup in immich

you want to add immich to pangolin ??? (idk if you mean to publically expose it or if you are calling forward auth "pangolin")

if you just add immich to pangolin to expose it, without forward auth enabled, oidc and the mobile app will work fine

however, if you enable forward auth for the immich domain, then yes, the app will break unless you do some additional trickery with headers

What's usually done is to have the oidc login, and normal app functionality, sacrificing the (minimal) potential security of the forward auth layer in front of all of it

minimal because it would take a very serious vulnerability in immich for oidc login to be bypassed, aka the only real case where a forward auth wall might help

it's up to you to judge the options and decide if your threat model is fine with it, I personally trust immich enough to expose it to the internet, some people prefer to keep it entirely local and have to VPN to their home network to get access, everything else is in between

[fading forum]

Why isn't that ideal?

[hollow spoke]

100 mb upload limit and potential privacy concerns

[fading forum]

100mb upload is fixed by using the cloudflare one agent, I have a blog post about that

[faint thorn]

Yeah that one I'll just live with, and upload large videos at home on local ip

[turbid narwhal]

is there a post about escaping the global MITM psyop ddos protection racket too? 😅

[fading forum]

I didn't escape it, I'm on their payroll! ☁️

[fluid cedar]

can i get the link for this?

[fading forum]

https://jogenfors.com/posts/immich-cloudflare-one/

[wet zenith]

do you use dns only or proxied for your dns record?

[distant crypt]

If you use cloudflare tunnel it's always proxied

[wet zenith]

ok then my next question: do you use the free plan?

[distant crypt]

If you're alluding to the 100MB upload limit then yes, that's one of the things that make cloudflare proxy very unattractive

[wet zenith]

I know, thats why I'm asking. First I used the cloudflare free plan but because of the upload limit I switched to dns only with a Opnsense reverseproxy at home for the security

[distant crypt]

Yeah that's sensible

[wet zenith]

but I would also use auth only via authentik

[distant crypt]

Yep, using oauth adds an extra security layer

[proper beacon]

Mine is just behind a domain and a proxy via public ip. I also have logto oauth set up.

[zinc merlin]

same and that can be fine 🙂
biggest issue are usually misconfigurations on the proxy

[drifting spoke]

Could the same be accomplished by using a wireguard tunnel to the local network?

[wild lynx]

Any VPN will do the same, yes

[fading forum]

They are quite different and I go through the differences in the article

[quaint ingot]

@leaden wasp I’d recommend you not to open ports but rather use cloudflare one (which is free but may come with privacy concerns) or rent a cheap vps at your favorite hosting provider and install something like pangolin or netbird to expose services to the internet
(I personally use pangolin)

[leaden wasp]

I'm currently using tailscale, it's good tbh. I just want to experiment with openings ports. While not affect my house's family internet

[ivory lark]

personally uses caddy as front proxy for my immich since forever now
(i use open port as primary means, with tailscale is my backup if all else gets messed up i can tailscale in and ssh away, which ssh port isnt forwarded)

[quaint ingot]

Tailscale is also a valid option, I prefer pangolin because I do really like to share foto links with friends so they have to be able to access the server and i dont want to give tailscale access to each of them

I used to use just a regular wireguard vpn to connect to my home network (there is a very easy to configure option built into the fritzbox)

[leaden wasp]

But they only have free 25gb a month limit. I'm trying to learn stuff by spending less(sort off)

[quaint ingot]

You can get a cheap vps for 5€/month or less

[leaden wasp]

Do you use a feature called lockdown or something. What's your opinion on it

[ivory lark]

sorry no idea of what is lockdown in context
though i dont think i ever paid for tailscale, it's just a background thing i keep as a backdoor

[leaden wasp]

5 is cheap but I'm not working, just studying rn. I'd like a way to do stuff without any subscription if possible

[leaden wasp]

Sorry I meant tailnet lock

[ivory lark]

normally my ideal scenario is not having to use it
but sometimes homelab means maybe a service was offline, and i REALLY do not want to have my SSH forwarded
so tailscale exist to securely access my ssh without making it free for rest of the world

[quaint ingot]

Im not working either 🙂

[leaden wasp]

Maybe my budget is lower

I mean I just prefer cheaper if possible

[quaint ingot]

You can use cloudflare one which is free afaik but then cloudflare will be scanning all your data - you may consider that to be a good or a bad thing, I personall value my privacy very much

[leaden wasp]

Yea but also I'll need to enter my card info

[quaint ingot]

In the end it depends on what it is worth to you I guess

[leaden wasp]

Hmm true

[leaden wasp]

What do u think about wireguard on x-ray in cloudflare

[quaint ingot]

I think netcup offers some vps options for 2€/month and Oracle gives you a free vps iirc

[leaden wasp]

I think Ill look into the Oracle ones

[quaint ingot]

Just make sure to have good backups I don’t know how reliable these free ones are but I haven’t heard anything too bad either

[leaden wasp]

Backups as in? I thought vps is just a proxy?

[zinc merlin]

a vps wont really be more secure than hosting a reverse proxy yourself

and hosting a reverse proxy yourself isn't necessarily a bad thing, many do that (including me)

[quaint ingot]

Your configs on the vps for your reverse proxy or tailscale access point or whatever you’re gonna be doing on the vps

[wild lynx]

If the VPS is gone and your proxy config with it you‘d have to redo everything

[dusk hornet]

Is mtls client cert on iPhone app working for anyone?

I posted here with issue getting it to work:

https://github.com/immich-app/immich/issues/15230#issuecomment-5523861021

[unique spruce]

[Issue] [META] Experimental network features (immich-app/immich#15230)

[frozen pecan]

I run it on a hardened docker image with Caddy reverse proxy and user setup disabled on a VPS. Details: https://github.com/thilo/private-cloud

[hollow spoke]

Next, run distroless containers 😛

Still haven't figured it out for Immich. But Caddy was quite easy as it's written in Go

[wild lynx]

Distroless can be a fun project, but it rarely improves security much.

[hollow spoke]

I don't know how much it helps in the real world, but on paper it should reduce attack surface

Also smaller images are very nice

I don't see it as "using distroless is the only secure option", but it's another layer

[rapid sail]

I don't make it public, but I use ZeroTier to access though my phone.

[crystal grove]

I use Tailscale and its pretty straight forward

[ripe blade]

Cloudflare domain --> Oracle free pay as you go VPS--> pangolin tunnel to my server at home.

[stoic notch]

contabo server (super cheap french hoster) -> pangolin -> pangolin cli -> homelab

[vast sparrow]

Isn't Contabo based in Germany ? But pretty good prices yeah, i've used their VPS for a long time :p

[stoic notch]

my vps is i lauterbourg, so at the rhein knick

[wild lynx]

German but with datacenters worldwide (owned by an US investor)

[chilly drum]

I am using internet on my laptop using my phone's hotspot, but it says server not reachable in the app. The ip entered is correct.

[wild lynx]

That sounds more like you have an issue, you should create your own thread in #1049703391762321418 also check if the IP is reachable from a browser.

Generally we can't provide support for anything that happens in the users network, but maybe someone can help you there

[chilly drum]

Okay, my windows firewall was blocking inbound connection. I just allowed for the 2283 port.

[ocean wolf]

I installed immich on NAS then set up reverse proxy with OpenVPN on the same NAS. Then my NAS only opens the VPN port to the Internet.
For example, if I want to use my phone to access immich over the Internet, I need to install both the immich app and OpenVPN Client on my phone. Then I first connect the OpenVPN before immich would work. No further setup is required on immich.

[vernal gate]

I was previously using Cloudflare, but this past weekend, I set up a free Oracle Cloud VM running Caddy with a WireGuard VPN tunnel back to my LAN.

The main reason for the change was Cloudflare's 100 MB upload limit, which caused issues when uploading large videos to Immich. With the new setup, I can bypass that limit and upload larger files without the same restrictions.

[unreal oar]

@vernal gate i sent you a DM kinda off topic so i dont diverge the conversation here. thanks!

[alpine oxide]

I am using cloudflared tunnel pointing to my server in docker which on a windows mini pc connected to a DAS system for storage. it has been working without much problems

[mild topaz]

Same as you，most secure solution

[errant reef]

DuckDNS > Oracle always free VPS > Pangolin > Immich VM in Proxmox server

[fading forum]

or follow my guide to use the warp client to use cloudflare and still upload files larger than 100mb https://jogenfors.com/posts/immich-cloudflare-one/

[stoic notch]

i just like the simplicity, and theyre cheap, have enough storage and i can have them at high usage (do would allways oom or kill me) they prob dont overallocate that much

[fair remnant]

I am new to self hosting and immich is my first project.

is above something to recommend or a tailscale setup is good enough?

[wild lynx]

For beginners I would recommend a VPN like tailscale instead of fully exposing to the internet, yes.

[fair remnant]

@wild lynx thank you! what is rabbit hole path in order of learning should I study?

[hidden lagoon]

First step is to do Tailscale/similar + no open port.

You can try to transition into more fun ones like

• run your own wireguard at home + ddns service/ddns + your own domain > open 1 port + maintain your ddns + wireguard.
• next step is a proper set up like: PocketID + Immich (any other as well) behind Caddy (I prefer Caddy) where PocketID is your OIDC for Immich (and others). And Caddy is the reverse proxy for all. Still need ddns service + free domain/your own domain > 2 ports open: 80 and 443. I am running this

With caddy/your choice of reverse proxy and an auth server in place, you got a pretty good set up that minimized a lot of attack vector vs open random ports/not having https

[scenic gyro]

Nice write up I started using CF Tunnels but I ended up needing to give other users public links of events I take photos of. So I ended up going back to reverse proxy

So I have HaProxy as the external LB and then Traefik as the internal LB

[stoic notch]

you guys should try netbird or pangolin

[fair remnant]

Thank you guys!!!! I will definitely study these terminologies and go back! 🤟🏽

[rapid sail]

I just tried tailscale and it works much better than zerotier I used before

[amber wagon]

Nginx + a free local dyndns webhost

[narrow valve]

Question about tailscale:
Can I invite people to my tailscale without compromising its security?
Considering transitioning to immich to improve the privacy of my closest family, but everything feels way above my knowledge.

[alpine oxide]

I created users for my family in immich and invited my family to upload their photos and videos. I use cloudflared tunneling to connect to my immich server. Works perfectly.

Immich is hosted in a docker desktop container on my minipc, which runs windows 11

[somber cedar]

Free for up to 6 users, and tailscale is great for this.

[digital flare]

Is that 6 login accounts or 6 devices on one account?

[somber cedar]

6 login accounts, I think infinite devices.

[inland gorge]

If we use cloudfare tunnel, can we upload the photos ? For me, Cloudflare Tunnel wasn't handling Immich uploads

[shut harbor]

You've got a 100mb upload limit with cf proxies

[night axle]

For my Immich instance, I use Authentik as my idP, and I use Pomerium as my reverse proxy, which allows for contexual awareness constantly. I have it scoped to my family-trusted rules, so anytime someone were to try and hit that address, it goes straight to the idP portal anyways. Once the user logs in, they're forwarded because oAuth is setup. Love that this became even more mature lately, as I'll be adding family members, given the People sharing.

I run this from UNRAID on my homelab. I used to use CF tunnels, but CF inspects, and I'm not a fan, even though I really like CF.

[rugged hollow]

My server is on Ubuntu on a wyse 5070 thin client, hosted on my home lan in the living room. 😂

1. Get a free dns address from duckdns.org

2. Install caddy infront of Immich for https

3. configure ports to use an unfamiliar one.

Eg. https://myimmichserver.duckdns.org:4756

[fading forum]

Since I often get pushback "why does etnoy recommend against exposing Immich to the Internet?", it's possible that versions below 3.3.5 are vulnerable to CVE-2026-111497. Update to 3.3.5 as soon as you can

[fading forum]

photos are no problem, cloudflare tunnels can't do more than 100mb uploads