Security considerations about hosting Immich from home
2026-06-11 20:05 UTC
Replies (18)
-
@avidamoeba@lemmy.ca 2026-06-11 20:19
Put it behind Tailscale/Headscale/Netbird/etc. VPN connection and don’t think about it.
-
@Svinhufvud@sopuli.xyz 2026-06-12 05:28
Do you want to have the site to be public facing? If so, I think your current setup is good. If it doesn’t need to be public facing, I would use wireguard to VPN into your LAN network, and secure it that way.
-
@keimevo@lemmy.world 2026-06-11 20:34
Plain wireguard. Or maybe Pangolin? https://github.com/fosrl/pangolin
-
@i_am_not_a_robot@discuss.tchncs.de 2026-06-11 21:26
You're already doing more than companies that charge people to host their photos.
-
@suzune@ani.social 2026-06-11 20:31
I would not expose anything to the internet, except if you want to have it public. I use wireguard as a private, self-hosted VPN. It's easy to set up.
-
@dimjim@sh.itjust.works 2026-06-12 20:59
I just use a WireGuard VPN. Makes it so much more simpler. At this point I don't think I'll ever expose anything to the public internet, seems like too much of a headache.
-
@randombullet@programming.dev 2026-06-11 20:27
I have it behind OAuth. And then a reverse proxy via NPM. I don't know what else to do on it aside from keeping it fully VPNed.
-
@possiblylinux127@lemmy.zip 2026-06-11 22:13
Is there a reason it needs to be public facing?
-
@androidul@lemmy.world 2026-06-11 20:21
assuming that you’re to expose that to the Internet, my recommendation is to deploy only - WAF solution, such as https://github.com/corazawaf/coraza-caddy - bot blocker such as https://anubis.techaro.lol/docs/admin/environments/caddy complicate the setup too much and it’s going to rather be more painful to maintain and also much easier to misconfigure. The WAF covers OWASP Top 10 so that should give you around 70% protection which is still better than nothing
-
@uuj8za@piefed.social 2026-06-12 04:31
Definitely put it behind Netbird. Also. I have a Jellyfin instance that I share with family, where I actually can't put all of their client devices behind Netbird. For that case, I used Netbird's reverse proxy feature. So technically the Jellyfin instance is exposed to the public internet. HOWEVER, Netbird allows you to block or allow certain IP addresses. So while my Jellyfin instance is technically on the public internet, it's only accessible from 1 specific public IP. Otherwise, if you're on the Netbird VPN, then the domain I have set resolves to the internal IP.
-
@irmadlad@lemmy.world 2026-06-11 21:01
Despite what some may think, I'm not a representative of Cloudflare, nor do I receive any benefit from recommending them. I just recommend what works for me. There are many avenues at your disposal. That said, Cloudflare Tunnels/Zero Trust is a winner in my book. You will need a cheap domain name that you can change the nameservers to the ones Cloudflare assigns you. After that, you install Cloudflare Tunnels/Zero Trust on your server, and connect to Cloudflare, Jacks a doughnut, Bob's your uncle. No need to fiddle with NAT, or opening ports. Cloudflare takes care of all of that. Of course you will need port 22 (ssh) to directly admin your server.
-
@Inventaser@lemmy.world 2026-06-12 21:00
The others already have a lot of material you can go through that will help protect your immuch instance. Some things I would further recommend looking into: - Keep Immich up to date. But also wait at least a bit before upgrading. Both old and very new versions can contain vulnerabilities. With immich and it's release process I wait at least a .week before upgrading a minor version (2.X.n) - Exposing publicly makes you at least as vulnerable as the exposed app. So always try to get a feeling for how aware the devs are about security. Immich already has a good stance. - Try to build some form of monitoring. I have Caddy as reverse proxy that exports metrics about the served domain where I can track and alert myself, when there is unusual activity on my immich domain.
-
@Decronym@lemmy.decronym.xyz 2026-06-12 13:10
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread: Fewer Letters | More Letters ---|--- CA | (SSL) Certificate Authority DNS | Domain Name Service/System NAT | Network Address Translation TLS | Transport Layer Security, supersedes SSL VPN | Virtual Private Network ---------------- 5 acronyms in this thread; the most compressed thread commented on today has 4 acronyms. [Thread #10 for this comm, first seen 12th Jun 2026, 13:10] [[FAQ](http://decronym.xyz/)] [[Full list](http://decronym.xyz/acronyms/selfhosted@lemmy_world)] [[Contact](https://hachyderm.io/@Two9A)] [[Source code](https://gist.github.com/Two9A/1d976f9b7441694162c8)]
-
@GuillaumeRossolini@infosec.exchange 2026-06-11 20:21
[@Maroon](https://lemmy.world/u/Maroon) FIY the security verification for my not being a bot failed
-
@Jason2357@lemmy.ca 2026-06-12 01:21
I can't recall the name, but there was at least one project that had a kind of static web proxy of shared immich albums, so you can expose that to the internet for sharing and keep Immich its self internal network only.
-
@jaschen306@sh.itjust.works 2026-06-12 13:09
I'm running immich with tailscale.
-
@ohshit604@sh.itjust.works 2026-06-13 20:35
I suggest having your setup as a deny-first approach. Meaning denying every IP and whitelist the known few, [Traefik offers a middleware for this](https://plugins.traefik.io/plugins/66fef7d4573cd7803d65cb12/ddns-allowlist). Alternatively you can blacklist by country of origin however VPN’s are a thing, I would only recommend this on low-risk applications such as Invidious instances, dashboards and such.
-
@lemmyvore@feddit.nl 2026-06-12 12:04
It supports it on the iOS client as well but last time I tried it would always lose the mTLS setting on its own after a while. I had to resort to the other method they offer, secret key in a custom HTTP header.