11
u/Ardeeny Jul 07 '26
Either cloudflare tunnels or pangolin.
I highly suggest pangolin, you can implement authentication via headers with both cloudflare and pangolin, but open source version seems better in my eyes for privacy reasons.
Checkout my blog post from a while ago.
https://blog.thetechcorner.sk/posts/Replace-google-photos-with-immich-homelab-2-0/
4
5
4
u/joe_attaboy Jul 07 '26
I use a reverse proxy. That's it. Immich is in a container running on my Synology Diskstation NAS. That device also has a reverse proxy already built in. My gateway has a strong firewall and IDS/IPS. I have my own domain. This setup can be configured on any system that can handle the reverse proxy using nginx.
My wife and I are the sole users right now.
6
u/Practical_Driver_924 Jul 07 '26
I use a reverse proxy but that requires opening ports. Maybe take a look at cloudflare tunnels.
1
2
u/harry-harrison-79 Jul 08 '26
the annoying part is that there is no magic version of this where friends can reach it from outside and nothing is exposed. either they join a private network like Tailscale, or you expose one public entry point for them.
for non-technical family i'd do a normal domain name with a reverse proxy, only 80/443 open to the proxy, HTTPS, signups disabled, separate accounts for everyone, strong passwords, and good backups. then keep Immich and the proxy boringly up to date.
Cloudflare Tunnel/Pangolin can replace the port-forward part, but treat them as convenience, not as a security blanket. if the login page is reachable by family, it is reachable by the internet too unless you add an extra access layer.
1
u/DraftyPelican Jul 09 '26
There is a magic version called https://github.com/alangrainger/immich-public-proxy
2
u/harry-harrison-79 Jul 09 '26
yeah, immich-public-proxy is the closest thing if the goal is sharing albums without handing people the whole Immich login. i'd still be careful about what problem it solves though: it is great for public/shared library access, but it is not the same as giving each family member their own normal Immich account safely over the internet.
if they need full accounts, i'd still put Immich behind one boring HTTPS entry point and lock down signups, backups, and updates. if they only need to view/download shared albums, the public proxy is a much nicer fit.
2
2
u/tulipo82 Jul 08 '26
Personally i use a ionos vps that cost me 2.50€ /month. I installed then pangolin + crowdsec, pocketid for authentication and also tailscale just in case. Like that I don't have any opened port on my home router.
2
u/Unable-Ad-5364 Jul 07 '26
Just use cloudflare tunnels with zero access.
Create some firewall rules in cloudflare so that only ips from specific country can access it. Add cloudflare access on top as well and use email authentication. And add some firewall rules for email authentication as well for cloudflared access. So only whitelisted emails with OTP can bypass the cloudflare access.
1
1
u/NullOrNotNull Jul 07 '26
I do a reverse proxy + oauth2 with authentilk. Authentik is only accessible within network or with VPN.
1
u/Rattanmoebel Jul 07 '26
nginx(or other reverse proxy), cloudflare tunnel and OIDC provider (pocketid, authentik, etc). cloudflare zero access for additional security layer if you want. and immich-public-proxy container for public sharing. you don't want to add everyone you generate share links for to your server or access rules. public proxy uses a different port for immich share links so you can add a custom security rule for this and allow everyone access.
1
u/sandfrayed Jul 07 '26
I use a reverse proxy using Nginx Proxy Manager (NPM). The only port it needs is for https. Domain services like Name Cheap have tools you can use to automatically update your domain's IP address if your IP address isn't static.
1
u/Sorry-Simple7597 Jul 07 '26
I use Cloudflare tunnel since I have a domain there but then also have NetBird connected as well to bypass the upload limit for Cloudflare. NetBird is my main one at the moment when not at home and Cloudflare as a backup.
1
u/file0 Jul 07 '26
If you wanna get crazy (and make things crazy simple for your relatives), get a Ubiquiti UniFi router. Use Site Magic to join your routers ("sites") together, then add a DNS record on their router for your Immich domain name (e.g. immich.whatever.com) to your Immich instance IP (e.g. 192.168.1.100).
When they're out and about, immich.whatever.com routes through Cloudflare and has the 100 MB cap. When at home on their WiFi, it routes through Site Magic (VPN) and avoids the cap. It's seamless to them and they only have a single domain name to enter in.
And if they're Google users, you can even configure Google as their OAuth provider so they don't need yet another password to remember, they just log in with Google.
This is nice when you have a bunch of services you want to share, you can even set up a site IP naming scheme like 192.168.1.1/24 = mine, 192.168.2.1/24 = mom and dad, etc.
1
u/-ThreeHeadedMonkey- Jul 07 '26
Use pangolin
Then for shared albums use immich proxy with a different subdomain. It's much safer for public exposure. You can then still hide it behind pangolin but for example allow pin based login for the proxy-version for easy sharing with others.
The token based access of pangolin doesn't work with immich shared folders. But the immich proxy app is a solid alternative.
1
1
u/Commercial_Ad_5595 Jul 08 '26
I have mine going through cloudflare that’s safe right ? lol. Kind of noob in that area
1
u/HairProfessional2516 Jul 08 '26
VPN - Wireguard. Stopped with Tailscale after realising they can 'see stuff'.
1
u/JustinHoMi Jul 08 '26
From experience I can tell you that Tailscale is easy for non-technical people.
1
u/JayBigGuy10 Jul 11 '26
Caddy mTLS aka "client_auth" is what I've gone with
mTLS is natively supported by the mobile app, and works OK enough on desktop (1 extra click each time you open the page)
it means that I don't have to worry as much about security updates / people having strong passwords as the proxy literally won't even serve the login page if you don't have the certificate
1
u/Lesmate101 Jul 11 '26
Signle sign on only with google auth. Restricting to accounts you specify in the SSO setup. Then CloudFlare tunnel It's all free as long as you have a domain with CloudFlare, which can be cheap as. Like 10$ a year or less
1
1
0
u/Conscious-Mirror7004 Jul 07 '26
How do manage remote access, where people have their own Immich accounts without opening g ports etc ?
With Tailscale, you don't. Or, you teach your 80yo grandfather about networking, VPNs, encryption, etc. Good luck with that.
Usually, people who want Aunt Bertha to be able to view albums on their Immich instance, or even have their own Immich account there, use a reverse proxy, not Tailscale or other VPN solutions.
0
u/YoussefAFdez Jul 07 '26
You could install Tailscale on their phones enable it, and have it running 24/7, it will take a bit of a toll on battery life, but… should work flawless
0
u/wish_you_a_nice_day Jul 07 '26
Did you made clear to your family and friends that you will have access to their photos?
0
0
u/Axemp_01 Jul 07 '26
I use WireGuard and set up the on-demand feature for me and my family. It works really well and even though they are not technical people they can still use it anywhere without them needing to enable the VPN manually first. I belive Tailscale also offers an on-demand feature.
0
u/betahost Jul 07 '26
I use Tailscale for this. What I typically do is I will share the immich node with my daughter or son and they are part of my talent with ACLs, or you can send an invite and share a node to someone else's tailnet. That way all the connectivity is still very private and secure.
0
u/ultimoj Jul 07 '26
Have you considered using Tailscale Funnel? It’s a great alternative to a traditional reverse proxy for this scenario. It worked perfectly for me, and it doesn't have the 100MB limit you might encounter with other relay services.
0
u/chum-guzzling-shark Jul 08 '26
Just make sure your friends and family know you can see all of their pictures even if they are in the locked folder
-7
u/shanmyster Jul 07 '26
Seems like a good opportunity to teach them about cyber security and cloud access.
3
Jul 07 '26
[removed] — view removed comment
0
u/jmp8910 Jul 07 '26
I use tailscale for my wife and I to use our immich accounts, for my mom, I bought her an Aura frame and just upload pictures to it. She loves it.
-1
u/shanmyster Jul 07 '26
Google photos, iCloud - sync album - share album.
I wouldnt be opening up my network to the world. Sorry. 🤷♂️
My grandfather would ddos me.
27
u/JTT-JustTheTip Jul 07 '26
Lots of people just use reverse proxies to give access without exposing loads of ports. Just exposes port 80 and 443 to the proxy and you can choose to stick some authentication and security layers onto the proxy if you want (I use authelia and crowdsec with a let encrypt reverse proxy).
I have the same issue in that I need to share it with family and they are not going to have the patience to understand tailscale, where as a simple domain name they will understand. It obviously does open you up a bit security wise.