#Exposing Immich to the internet

6065 messages · Page 7 of 7 (latest)

worldly wraith
#

Because of it being front faced accessible from the internet, we want it as secure as possible. Suppose a vulnerability of Authentik gets discovered and I later discover it. I am doomed. Where as, CloudFlare zero trust is dependent on cloudflare's service and stuff. So, I basically for security trust CloudFlare more than myself, especially cause I have life beyond looking at vulnerabilities all day

timid ravine
worldly wraith
#

and it doesn't matter if it's maintained by professionals, problems are present everywhere. All I stated was it just reduces my effort in security

timid ravine
#

That’s also true. I mean for most people that self-host Authentik is quite a strong choice + it’s free.

#

Nothing that’s public on the internet is 100% safe.

#

It probably never will be.

wild lynx
#

On the other hand I would not hand over all my data to Cloudflare.

fluid cedar
#

i have a tunnel to cloudflare with rules that allow only connections from my city to access my immich page

#

not secure once someone figures that out, which is not that hard, but then ive got OAuth infront

#

other than that, nothing else

thin tide
fluid cedar
#

used to access via tailscale but it used a lot of battery, found it much more convenient to just have it public in a place where im always located in

#

but also, now ive got OAuth so i do need a public domain for it, as far as i know though

#

google*

thin tide
#

Fair. Could be a good option for a custom header as well if your exposure is that narrow

fathom patio
#

Important note that cloudflare tunnels limits to 100MB upload per files.

timid ravine
#

Like a paid plan or?

wild lynx
#

If you have way too much money, yes. But for normal people - just no.

remote widget
#

also, not by all that much

wild lynx
#

The enterprise plan has up to 500MB, for more you have to get a custom limit through support

#

For context, the business plan with 200MB costs around 200$/month

hollow spoke
#

XD yeah not worth it

timid ravine
#

Oh my..

#

Is there also a limit on dl?

quaint ingot
# timid ravine Is there also a limit on dl?

Imo you probably better use something like pangolin/netbird/… although that comes with a certain overhead of features you probably won‘t use, but afaik it‘s the easiest way to get a similar experience

timid ravine
quaint ingot
#

I get that, but the other options aren‘t too complicated either, I installed pangolin yestwrday and the install process is completely automated using their installer, you just have to decide on a few options (give yes or no) and then it gives you a config to copy for the client on your actual server

elfin radish
#

How does this setup sound? I haven't started this just yet, I currently just have my Immich instance accessible via Tailscale, but I really want to expose it to the internet while keeping my home network safe.

I want to use a cloud vm on Hetzner or Linode as a proxy for my Immich instance. I would use Nginx/Caddy on the cloud vm to forward the traffic to my home lab Immich instance via tailscale. Use Tailscale ACL rules to limit the access that the vm has to my tailnet (only allow traffic to Immich). And on my home lab set up the firewall to ignore all other external traffic except from tailscale.

No open ports on my router. No cloudflare upload limits. Hetzner and Linode both have generous bandwidth limits, and excess bandwidth is cheap. Because it's not my home network, I can use Cloudflare without having to proxy the VM's IP address, avoiding the upload limit while still allowing for zone rules like geo-blocking (further googling revealed this to not be true, zone rules require Cloudflare's proxy, which imposes the upload limit).

There is still the risk of immich exploits and vulnerabilities, but we're all rolling the dice on that.

turbid narwhal
quaint ingot
#

Also you might want to have a look at pangolin or netbird which both combine the vpn and reverse proxy part for exactly the usecase of exposing services.
They come with a lot of other features too though which makes them heavier than your setup

elfin radish
quaint ingot
worldly wraith
scenic gyro
limpid plank
#

ive pangolin for exposing it, normal email pass disabled on immich and user can only use Authentik + mandatory OTP flow (flow is a thing in authentik)

craggy kraken
#

Hi.
I created a NAT on my router for a high port redirecting to Immich server in house.
I urge my family to have a very complex password as we got a password manager.
The pseudo security i sassured by a static IP filter. Only one IP can use this NAT.
I rent a VPS (15 bucks a year) configured with nginx as a reverse proxy.
I own a domain name, created as many subdomains as needed (6 $ a year).
The VPS has only 100Mbps bandwith but it is far enough for my needs.

Hope this can help

hidden lagoon
#

You can slot in PocketID on your reverse proxy end and people can use the finger print to register OIDC to PocketID.

Just remove the password all together.

light rapids
#

I have a NAT on my router all ports are blocked but 1 and i forward that over to a managed switch. There is some built in security. I dont care if the whole world sees my photos. Im really unimportant and boring.

keen mica
#

Pangolin on a geoblocked vps. Pocketid for oidc

It's super solid and super easy to use for yhe end user. i just hope homelabbers dont get rugpulled

bitter plume
#

What do you do when it’s limitation of cloudflare? Its let only 100 mb maximum to upload…
Its so hard for large file

wild lynx
#

Quick answer is don’t use CF if you depend on uploading big files remotely. Some add either a VPN to bypass their own traffic or route the traffic locally when they are home.

trim mango
#

Your pics could be used to blackmail you, even if you're not a celebrity. There's an industry around that. Every year, lambda people become victims to this. Could be used to generate deep fakes. Could be crypto locked. Immich could be used as a bridge to the rest of the network. Maybe the host runs other services?

I think one should always properly secure all the services it exposes to the internet.

unkempt adder
turbid narwhal
wild lynx
trim mango
zinc merlin
#

TAC, everything you said is true...
and i would never advise anyone not to take measures to secure their environment... that is a general thing you always need to do
you can weigh your risk vs advantages though, i would say your google photos are at risk of being lost as well, though without further risk to the rest of your network
definitely dont expose anything if you dont know what you are doing but if you try to secure your setup, risks can be lessened (there is always a remaining risk)
I personally expose immich and many other services but everyone should decide that for themselves...
if you have data even on "secure" services like Google, Microsoft, etc.
they are never 100% secure

wild lynx
#

No, I'm not trying to argue to not do any security. I just think it's stupid to bring in some celebrity element into it. And no matter if you use a SaaS for protection or self host the components, you should ALWAYS be aware of the risks. A lot of people think when they click the cloudflare cloud icon they are safe.

#

But I also think it's not the smartest idea to put things on the public internet that are apparently so important they can damage your life.

#

Exposing a service should always be a concious decision, not a "I'm lazy and don't want to care"

#

Also please read, I wrote "Personally I don't care", not "No one should care"

quaint ingot
thin tide
#

No method of using computer is 100% safe. Local, exposed, cloud, vpn, it’s all a risk calculation

#

Life isn’t 100% safe either

wild lynx
#

I assume all my online services to be "hacked" the moment I put them online. Everything else is just denying the possibility. Especially with AI and all the IoT devices.

zinc merlin
#

your financials are usually mostly online 😛
but anything you put online will get probed eventually... you will definitely see tons of automated attempts in 5mins
that does not mean much but if something gets discovered you get put on a list with the info that was gathered...

if you dont secure...

i try to secure but have lots of things left to make more secure... I do expect not to get "broken into" but I know that its far from impossible

trim mango
#

I work in finance, and I'd argue 90% of the efforts put in our software is about security, 9% is corporate BS and 1% is feature.

#

The services we run have nothing to do with the traditional "secure" services like Google & co.
Our software doesn't trust the developers who build it, the DevOps who ship it or the operators who monitor and operate it.

#

But you can't expect every software to be build that way, it would make them 10 times more expensive.

turbid narwhal
#

10 bucks that the banking app "security" is banning grapheneos

#

but on a more serious note, that's an unrealistic expectation for self-hosted services with minor impact if compromised, the "doesn't trust the developers" doesn't really make sense from a technical standpoint, and calling Google "secure" jokingly really undermines the fact that they have a whole division/branch just dedicated to finding zero-days

zinc merlin
wild lynx
#

I don't think this applies to all companies in finance. And in the end you have to trust someone anyway. And if it's the secure hardware element checking the OS's integrity. Everything else is marketing 😉 It has to start somewhere.

distant crypt
#

I don't trust any root CAs. I only do HTTP clueless

quaint ingot
trim mango
# wild lynx I don't think this applies to all companies in finance. And in the end you have ...

Some approaches really aren't comparable. For starters, my client (I'm freelance) is a root CA (for financial institutions) and doesn't rely on anyone for the PKI. They buy HSMs but they don't blindly use them. They test them extensively.

Operators don't get any secrets to do anything. The secrets they use during deployments are encrypted and the key to decrypt is embedded in the binary of the service. Pretty much all data is encrypted even when hot, and is only decrypted at usage time.

By comparison, some company I worked for gave me the DB admin password to fix a few corrupted records.

When I asked my client to allow the usage of yq on dev machines, I had to wait 2 weeks for audits, then I had to defend the usefulness of the tool in front of a panel of 5 people from global security 💀 .

trim mango
#

That's what I do with my VPS for admin accesses (mTLS). Of course, I upload the certs using another CA during the HTTPS upload. My client would fly someone to the server.

quaint ingot
#

Also if you want other people to use you as a ca it gets somewhat complicated I guess

trim mango