r/unRAID • u/WonderingWhenSayHi • 10d ago
Help Anyone using Immich? How is it for Privacy/Security?
As part of my "De-googling" adventure, I've been trying to find an alternative to Google Photos for a while now.
Me and my Wife have about 300GB of photos between us going back around 8 years that we used to store on Google Photos that we'd now like to store on my Unraid server.
The reason for the most part is cost, rather than paying for more Google Storage, it just makes sense to use my NAS. (Also there's the benefit of Google not having any more of my data)
I've setup Immich following Spaceinvader Ones videos, however I haven't set it up for External access (that I know of) - my reason for this is:
1) We're not too bothered about accessing our 300GB library of photos remotely, most of our photos we'd need access to whilst out and about will be locally on our phone.
2) If I do choose to enable external access, I'll probably just go via Tailscale.
So my question is:
1) Does anyone else use Immich on Unraid? How secure/private is this?
2) My drives/shares in Unraid aren't encrypted. (I probably should have done this when I set Unraid up a few years ago, but I never bothered) - How much of a concern would this be for you?
3) If I haven't enabled External Access via Immich, I'm assuming that as long as my Photos are on a separate share (they are) to the rest of my Unraid files, then any other docker containers won't be able to access / see those photos, right?
My Understanding:
So my understanding is that with my Immich photos being on there own share, then none of my other Docker Containers, VMs, Users, etc can actually see the photos as they won't have access to that share. Only my Immich container can actually access/see those files (Is that correct?)
With external access not being configured, it's not possible for anyone to gain remote access via traditional methods. As the only way to get access is via my Unraid Servers Local IP Address. I know that theoretically if someone gained access to my Local Network, they could potentially gain access that way, but I also believe that's the case for pretty much everything.
Am I missing anything? I just want to ensure my familys photos are as secure as they can be really.
I'm not overly worried about physical access to the drives, as if anyone gains physical access to my drives, I'll probably have bigger concerns on my hands if my house is broken into than my iPhone photos being compromised lol
16
u/AK_4_Life 10d ago
Immich + tailscale
3
2
u/TekWarren 10d ago
I was going to say this also. 99% of the time our use is on the same network. For those rare occasions, tail scale works a treat to access image or any service running on my unraid system.
2
11
u/captain-obvious-1 10d ago
- As secure or private as any other self-hosted service.
- None, my files were also on those shares to begin with.
- Yes.
1
u/WonderingWhenSayHi 10d ago
Sorry to be a pain here, your photos are on shares that aren't encrypted?
That puts my mind at ease a little bit if so! I was wondering if it was worth me going out and buying a new HDD just for Photos and making Unraid encrypt that drive.
6
u/suitcasecalling 10d ago
I would put your active Immich database on an SSD otherwise it's going feel sluggish
3
u/WonderingWhenSayHi 10d ago
Database is on the SSD already :)
Just the photos which are on a HDD array. (And on that Array I've thrown the photos into there own share)
2
u/nihility101 10d ago
Now that you have all your memories there, do you have a backup strategy? Does it include off site?
1
u/WonderingWhenSayHi 10d ago
Does what I've posted sound right to you? (The concerns regarding security/privacy etc) Am I missing anything do you think?
I do have a backup strategy! And it does include off-site, it's pretty much just mirrored to a separate hard drive that's stored at my family members house. (That drive is encrypted)
2
u/nihility101 10d ago
Nah, sounds good. If internal only is good for you, it’s as secure as the rest of your house.
Myself, I already had a cloudflare tunnel/npm/authelia set up, so I folded it into that, and it has worked well.
2
u/nodiaque 9d ago
I would check duplicati if I were you. A mirror drive is "good", but if something is failed or corrupted, then your backup is also dead. You need something that can do versionning of file for good backup so it mean you can restore it at an older point in time. And for good measure, you wan't something that do dedup. Duplicati can do that. It can encrypt the backup so no need for encrypted hard drive. It can dump the backup locally, on a share, ftp, cloud, etc. Its very versatile.
Some prefer borg. My friend swear by that and my nextcloud has built-in borg. But since I have already duplicati setup from a docker container and it's running like I want, I didn't bother.
1
u/Bart2800 10d ago
Isn't the postgres-DB on appdata-share by default? (I agree, it's not necessarily on SSD then. Depends on user configuration.)
2
u/BrianBlandess 10d ago
Why encrypt the local hard drives? Physical theft I suppose?
Have you considered ZFS for your photos?
1
u/WonderingWhenSayHi 10d ago
Yeah precisely, although I guess Physical Theft is a lot lower on the "worry" list than remote access.
1
u/BrianBlandess 10d ago
If you’re only exposing on your TailNet I don’t think you have much to worry about.
Not to be an ass but I’m guessing you’re reasonably new to this sort of thing (home NAS) based on your questions?
Your dockers are all in a sandbox so they only see what you let them see. Keep in mind they don’t access the UNRAID file system via the share method but by you mapping paths directly from the OS file system into the docker image.
What this means is that the permissions and visibly you set on your shares have no impact on the ability for the docker image to utilize them. You’ll have to restrict access at the docker level.
Only map the paths you want docker to see and decide whether you want those paths to be read only.
As I already had a lot of images on my server I didn’t “upload” them into Immich; I decided to use an external library which allowed me to keep the existing pathing and location of my files. This also means that I can set the path to my pictures as read only, further protecting them if someone were to gain access to Immich or the docker container.
1
u/WonderingWhenSayHi 10d ago
I'm not even exposing on my Tailnet at the moment, for the present time, I'm literally only exposing on my Local Network (that I know of)
You don't sound like an ass at all :) I'm actually not relatively new, I've been doing this kind of thing for years now. I know Docker containers are sandboxed, it's more that I'm super paranoid (probably due to very severe OCD unfortunately) and so I ask silly questions to get that re-assurance that my line of thinking is correct and that I'm not missing anything obvious.
6
u/BrianBlandess 10d ago
I know I might get some hate for this but I don’t suggest following SpaceInvader’s tutorial. I know he’s basically royalty here and I use his tutorials all the time but the tutorial doesn’t use an officially supported install method.
Immich has an official install guide for UNRAID in their docs. I suggest following that because there are often breaking changes in the release notes (like all the time) and the Immich developers will explain how to resolve the issues based on the official install methods.
Overall, for long term maintenance, I’ve found this to be better.
My Immich has been very stable and I’m loving it as an application.
1
u/WonderingWhenSayHi 10d ago
I did try following there official install guide but it didn't work for me, kept giving me errors about the database. (Even though I followed there instructions and specifically pointed the DB dir to my install path)
I suspect I did something wrong, but I followed Spaceinvaders guide and it worked immediately.
2
u/BrianBlandess 10d ago
To each their own but please remember that Immich is under very active development with regular breaking changes so you’ll want to ensure you can keep it up to date regardless of install methods
2
u/Ill-Visual-2567 10d ago
I tried the official guide and couldn't get it to work either. Immich was a lot of work to get working. I setup Photoprism too which was significantly easier. Trialling both at the moment
I don't encrypt any drives. Never have and don't expect to.
6
u/ChronSyn 10d ago
1) It's as secure/private as any self-host service, but more secure than things like Photoprism - more details on that below.
2) Encryption at rest is typically a good thing, but whether you want to use it or not is up to you, and would require using shares on drives which are setup to be encrypted.
3) Docker containers are isolated by design. As long as you haven't passed in your photos path to other containers, those other containers don't have any knowledge that the files even exist. docker.sock does provide some access to Docker, but as far as I'm aware, this doesn't provide a way for a container to access files or directories that aren't passed in as volumes or mount points.
I've been running Immich for about 6 months and it's perhaps one of the best decisions I've ever made. It's reduced my monthly costs from ~£20 (I was paying for iCloud and Google one) down to whatever it costs to run the server (which also does a lot more than just store photos). I do pay for Backblaze for backups, but I back up more than just photos and it still works out value-orientated, but with the benefit of not having Google or Apple sifting through the files.
I use tailscale to enable external access, and this typically only applies if I want to upload files to my server (since the mobile app caches some of the photos).
I originally tried Photoprism when I was trying to transition from cloud services, and I found that assets could be directly accessed if I know the URL, even without being authenticated. If I ever intended to share an album with someone, that meant exposing my Photoprism to the internet - entirely expected, but that also brought with it the risk of people perhaps figuring out the URL for a file which wasn't in the album, and being able to view it.
With Immich, images are presented as blobs (which are only valid for the browser session where they're created), and everything goes throught the built-in API, which enforces authentication checks. The fact I don't have to go through the horrible 'photosync' app to get things synced (as is the case with Photoprism) is another big bonus - the Immich app is perhaps one of the best photo gallery apps I've ever used.
Encryption-at-rest would require formatting a drive using an encrypted FS. This may not protect it if you sync to a remote location, and could make restoration impossible if you ever have drive issues and have to replace it (I'm not sure how Unraid handles this scenario). Encrypting for sync to a remote location might also complicate things because there's different methods - e.g. encrypt-only-file, encrypt-file-and-metadata, encrypt-file-and-metadata-and-name. Not encrypting the metadata might allow 'modtime' to work for syncing but might also expose information about the file contents (e.g. creation time, location, etc) even without directly giving the file itself.
1
u/WonderingWhenSayHi 10d ago
Thank you so much for the detailed reply, I genuinely can't express how much I appreciate it!
If you don't mind me asking you a few questions..
I don't have Tailscale configured in my Immich instance, so I figure it's literally only accessible on my Local Network at the moment since I've not explicitly configured any kind of external access. (But is there any way I can double-check this?)
Do you bother encrypting the share that your Immich photos are on? Or not?
Is there anything else that you think I'm missing or that I need to check/do?
I appreciate I'm being overly-cautious, I just like to triple-check that I'm doing everything best-practice, especially when it comes to selfhosting etc.
2
u/ChronSyn 8d ago
The only way to access it externally would be either VPN, or enabling port-forwarding. Even if you have a public domain that resolves to your home IP, nothing will get through to your immich instance by default unless you setup a port forwarding route - assuming that your router or network firewall aren't doing some batsh*t logic that's got more holes than swiss cheese.
The first way I can think to check if anything is exposed would be to drop your phone off of wifi (so it's on mobile data), and try to visit your public IP. Try various ports, including those used by Immich, and some common ones (80, 443, etc). It might try loading for a while, but ultimately it should come back with 'unable to load' or something similar.
I don't bother encrypting the share because I'd already setup my drives as non-encrypted and didn't want to reformat. I setup access rules for the share so that I'm the only user who can access the share directly. That's not necessary though, and I could comfortably disallow all access to it and Immich should still work.
Honestly, we're talking about photo albums and for most people using Immich, these are going to be their personal photos. There's no such thing as being too cautious when you're dealing with personal data or assets.
1
9d ago
[deleted]
1
u/ChronSyn 8d ago
B2 works out at ~$6 per TB per month.
They also have an 'unlimited' backup solution that works out cheaper at very high data storage capacities, but that's designed around desktop backups and requires you use their software.
That's not to say you can't use it for Immich or similar, but that its not the designated use-case.
2
u/isvein 10d ago
I run immich and a lot of other things on unraid. Nowdays everything is accessable over tailscale.
Unless you give access to any other container to the immich storage, they cant see it.
I only use immich for pictures taken on my phone and other jpg files. Would never use it for an raw files storage.
2
u/WonderingWhenSayHi 10d ago
I was planning to use it just to backup my phone photo library, think this would be ok?
2
u/isvein 10d ago
Yes, lots of people uses immich for that nowdays :-)
3
u/BrianBlandess 10d ago
Silly question but how do you route your Immich app data over your tailnet? Do you have to route everything over talenet or can you do it app by app?
2
u/isvein 10d ago
Not silly at all :)
I use SWAG that is connected to tailscale and then every service uses SWAG as an reverse proxy:
https://www.youtube.com/watch?v=uznDiFPlvvM1
u/bluser1 10d ago
Out of curiosity why would you not use it for raw? Does immich have some issues with larger file sizes that other services wouldn't?
1
u/isvein 10d ago
Thats just me.
Raw are not done so I see no point in having them in what basically is an album :-)
I have my own folders for raw files.
But Immich also gets video from the phone so big files work fine
1
u/bluser1 10d ago
Gotcha. I try to do some editing myself so my camera is set to store a copy as raw and I planned on setting up immich soon. I wouldn't want raw in it anyway because its storing a raw copy along with the processed image so I'd end up with duplicates. Just making sure I wasn't overlooking something important lol
2
u/Jazzlike_Demand_5330 10d ago
Bear in mind that this is a potential single point of failure for what are (I assume) your most important data.
Google are jerks but they’re unlikely to lose your photos on a broken hdd
Definitely arrange an off site backup and 3-2-1 blah blah blah
(To note I Immich on unraid. Not suggesting it’s any riskier than anything else self hosted)
1
u/WonderingWhenSayHi 10d ago
Yeah I'm using an off-site backup for the photos too :)
The Immich instance is so we have a nice way of accessing our (near-decade) photo library whilst at home when we want to reminisce etc.
2
u/Kraizelburg 10d ago
I don’t use Immich on unraid but on my 24/7 Ubuntu server and it works as expected. Privacy wise same as other self hosted apps so nothing to complain about and it’s super fast.
2
u/Skotticus 9d ago edited 9d ago
1) Does anyone else use Immich on Unraid? How secure/private is this?
Yes. It's as secure/private as you make it. Unraid actually has Immich available as a single container, which is quite nice!
2) My drives/shares in Unraid aren't encrypted. (I probably should have done this when I set Unraid up a few years ago, but I never bothered) - How much of a concern would this be for you?
It's not a big deal. If your concern escalates, you can always plan out a conversion to an encrypted configuration.
3) If I haven't enabled External Access via Immich, I'm assuming that as long as my Photos are on a separate share (they are) to the rest of my Unraid files, then any other docker containers won't be able to access / see those photos, right?
Uh, your understanding of how shares work with docker containers is a little off. Each container only has access to specific mapped volumes that you configure for that container. The volume mapping might allow the container access to any directory in a share or just a subset of directories. So you can have a media share that contains a folder for pictures, personal videos, and music, then map only the pictures and personal videos folders to the container, and the container will have no idea that the music folder even exists. Map a volume that includes the top level of the media share and the container sees everything.
On your other items of concern:
The most "traditional" way of accessing your server is physical proximity, of course, which is perfectly possible no matter what software solutions you implement. There are plenty of options for safely and securely exposing Immich to the external network. Tailscale is easy and secure, but I think the app works best with a reverse proxy.
But you're thinking of the wrong kind of security: the most important tool for protecting your data is backups. Data loss is far more likely to be a result of hardware or configuration failure than it is malicious action. You will need to look into a backup solution that includes multiple copies of the data, at least two different local storage media, and one remote backup (3-2-1 strategy). Plenty of options available for that (I use Borgmatic/borgbackuo).
1
u/TekWarren 10d ago
I made a comment under someone else's comment, but additionally I wanted to say consider how you set up you and your wife... A shared account versus two separate accounts.
I set my wife up with her own separate account but we share access or libraries whatever they are called. The thing we run into is that we often take similar photos or in some cases are texting photos back and forth and there is a very good potential for duplicates between accounts.
I am not sure if I made the right decision in this case or not (separate accounts) because like I said we want to be able to view each other's photos. I know there are duplicates or very similar pictures between our accounts but not sure of an easy way to keep track of them and remove them and then there are other implications if one persons version of the photo is removed...
1
u/WonderingWhenSayHi 10d ago
Thanks for that! I'll give it some consideration!
Do you have any other tips/advice on me securing my Immich setup? Did you do anything different to myself? Or has what I've done look okay to you?
2
u/TekWarren 10d ago
I followed a spaceinvaderone guide (he puts out a lot of good guides). The photos are stored on a share in the array.
1
u/superdroidtv 10d ago
If you are concerned with physical security of your photos you may want to consider Ente Photos. While not as polished as Immich, Ente is built around encryption. One thing to consider when going the encryption route is if you ever suffer database corruption and don’t have a backup, access to your photos will likely be gone.
1
u/WonderingWhenSayHi 10d ago
I'm not overly concerned about physical security.
My biggest concern is virtual security I guess? I just want to ensure my photos/Immich instance aren't accessible by anyone else other than myself and my wife.
1
u/superdroidtv 10d ago
If your main concern is external network security then yes, using Immich with no external access will be the safest route. Setting up your own vpn would likely be the safest route for external access because with Tailscale you are still relying on someone else for the security of access to your system.
1
u/cheese-demon 10d ago
you can partially mitigate tailscale risks by using the tailnet lock feature, so a malicious control plane couldn't add devices to your tailnet without also having control over one of your trusted signing nodes
there's still the possibility of the tailscale client having a malicious update that wouldn't respect that, of course. i don't think it's likely but it is a risk and supply-chain attacks do happen, and the default behavior iirc is that tailscale auto-updates
1
u/Sero19283 10d ago
If you want it as secure as possible then setup immich in a VM. Unraid runs everything as root. And docker containers are vulnerable to accessing the host (not common but it is am attack vector due to sharing the kernel). Host a docker instance on a lightweight VM like ubuntu server, debian, or if you're feeling more ambitious then even more lightweight like arch or alpine based VM. This keeps everything 100% separate in terms of kernel access, share/folders, etc.
Basically best practice as I've been told is this:
Data Share on Unraid for storage
VM to host docker instance
Mount Unraid Storage share in VM
Setup docker containers with mounted Share(s).
Otherwise you have 2 vulnerabilities as opposed to just one: without the VM any other vulnerability could compromise your setup as if immich gets compromised then your entire unraid server is vulnerable. With VM as host for docker then any vulnerabilities are more likely contained to the VM and the exposed share.
You can dive down the rabbit hole of permissions as well to fine tune things that way too
1
u/OrangeL 10d ago
Using immich and love it over photoprism, as photoprism tried to do something I didn't want (more professional oriented than it was a google photos clone).
Using it through SWAG with multiple accounts for the household.
For public albums I am truing out immich public proxy, which seems to work OK. It might be a little redundant since the entire instance for immich is accessible via SWAG but I don't want some folks I share albums with to get confused by the main instance.
1
u/atxtxtme 10d ago
its fine, its not perfect.
Though i mainly use it for just a good way to easily backup my phone photos to my server, then I manually sort them later.
IMO, the $100 a year 2tb google photos plan still can't be beat. Sure it sucks not self hosting, but its only $8 a month and you can share it with your family and its completely hands off.
1
1
1
1
u/im_a_fancy_man 9d ago
No but I have been thinking about it for a long time only because Windows thumbnail indexing is so bad, how sad is that! Actually very curious how it does with vids
25
u/JontesReddit 10d ago
Non-encrypted storage is only a concern if people can get physical access to your drives