Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Self-hosting my photos with Immich

michael.stapelberg.ch

Post reply on HN
Print view View original

371–380 of 384 posts

Re: Self-hosting my photos with Immich

#371

Post by conradev »

ivanjermakov wrote: post #91
Dedime wrote: post #72

Earlier quoted context omitted.

My problem with NixOS is the second you try to go "outside the guardrails", the difficulty increases 100x

Kind of the same for docker? Plopping a docker compose file and setting up few environment vars vs writing dockerfiles from scratch.

I have found Nix and NixOS to be able to absorb any amount of complexity I throw at it with grace.

If a Docker image truly is the best way to use a bit of functionality (like Home Assistant), then I will just configure NixOS to run it in podman as a systemd service with host networking.

I have not come across something that I could not package. The trick is that Nix composes functionality in a way that Dockerfiles or docker-compose configs cannot, because it's one language, one system, one abstraction.

Re: Self-hosting my photos with Immich

#372

Post by UltraSane »

lucb1e wrote: post #365
UltraSane wrote: post #360

Earlier quoted context omitted.

Yes, NAT traversal is used widely. It is only needed at the start of the connection to get both firewalls to open ports. The encrypted wireguard tunnel is point to point

What I find crazy is that people describe "not self hosting" as a "like magic" solution to self hosting

You can run your own DERP server if you really want to

docker run -d --name derper -p 443:443 -p 3478:3478/udp \ ghcr.io/tailscale/derper:latest

Re: Self-hosting my photos with Immich

#373

Post by conradev »

cromka wrote: post #93
ivanjermakov wrote: post #91

Earlier quoted context omitted.

Kind of the same for docker? Plopping a docker compose file and setting up few environment vars vs writing dockerfiles from scratch.

Not really. No. You can easily checkout repo containing the Dockerfile, add a Dockerfile override, change most of the stuff while maintaining the original Dockerfile instact and the ability to use git to update it. Then you change one line in docker-compose.yaml (or override it if it's also hosted by the repo) and build the container locally. Can't imagine easier way to modify existing docker images, I do this a lot…

I find the granular nature of dependency sharing in NixOS to be really nice. In particular, I like systemd as my hypervisor. With systemd I can still isolate and lock down processes, but they can still, for example, share memory pages of `glibc`. It is certainly less "secure", and with Docker at least you're sharing the same kernel. It's also hard to share resources between Docker containers. Getting 4 Docker containers to use the same instance of Avahi, for example, requires explicit configuration.

Docker containers also don't have a "standard" for where to put binaries (outside of CMD/ENTRYPOINT), how to configure users/uids (many still run as root?), whether to put multiple services in one container or separate containers, where to put user data, etc. NixOS coordinates this centrally like any distro, assigning paths and UIDs and ports.

Re: Self-hosting my photos with Immich

#374

Post by AnonC »

lucb1e wrote: post #299
AnonC wrote: post #11

Earlier quoted context omitted.

Not GP. My guess is that they’re self hosting this at home (not on a server that’s on the internet), and Tailscale easily and securely allows them to access this when they’re elsewhere.

I host at home and can access the things at home just fine by having the server as DMZ in the router, or whatever it is called these days. This doesn't really answer what Tailscale does more than port forwarding. If it punches NAT, that sounds like it actually makes you rely on a third party to host your STUN, i.e. you're not self hosting the Tailscale server?

Yes, it does NAT traversal. If you don’t trust Tailscale servers, you can host the open source equivalent, Headscale (headscale.net) and use the open source Tailscale clients.

Re: Self-hosting my photos with Immich

#375

Post by neurostimulant »

lucb1e wrote: post #364
neurostimulant wrote: post #359

Earlier quoted context omitted.

I think you can disable machine learning stuff in the settings. And yes, you can control when the sync happen, or even have it only triggered manually and never automatically. My instance when not running any photo/video processing job: - immich server: cpu: 0.51% ram: 753MiB - immich redis: cpu: 0.48 ram: 19.64MiB - immich machine learning: cpu: 0% ram: 209.3MiB

That's not little RAM, I wonder if it keeps the model on stand-by, but ~1GB is definitely more reasonable than 4-6! Thanks for sharing!

Forgot to add immich_postgres which uses ~222 MB of ram. If you already has a postgres running somewhere, you might be able to reuse it as long as its version >= 14 with pgvector installed.

Re: Self-hosting my photos with Immich

#376

Post by Sanzig »

sva_ wrote: post #369
iAMkenough wrote: post #269

Earlier quoted context omitted.

Even more trivial with Tailscale, so why wouldn’t I use Tailscale to configure wireguard for me?

I'm a bit skeptical that I don't have full control of my keys, but it does seem convenient.

You can have full control over your keys if you want: https://tailscale.com/kb/1226/tailnet-lock

Re: Self-hosting my photos with Immich

#377

Post by Sanzig »

lucb1e wrote: post #302
tjpnz wrote: post #33

Earlier quoted context omitted.

Tailscale gives me access to my home network when I'm not at home. I can be on a train, in another country even, and watch shows streamed off the Raspberry Pi in my home office.

That's called a VPN Is this like "Band-Aid" that used to be a brand name but now people just use it generically?

Tailscale is a bit more than a VPN. It operates in a mesh configuration rather than a traditional VPN concentrator setup. Tailscale's control plane orchestrates NAT traversal for devices on the Tailnet (through techniques like UDP hole punching) and allows them to establish direct Wireguard tunnels between them. That way, there's no VPN concentrator bottleneck because there's no concentrator at all, every device establishes tunnels to every other device.

Re: Self-hosting my photos with Immich

#378

Post by riedel »

DrammBA wrote: post #316
riedel wrote: post #127

Earlier quoted context omitted.

I remember that Immich has a mode to not use cryptic hashes but folders for storage. When I used it it was somehow deprecated due to some problems, but supported. I actually stopped using Immich because newer versions run the keep alive via socket.io with a Prostgres notify, which does constant empty WAL flushes, triggering empty page writes on idle.

Storage template is not deprecated https://docs.immich.app/administration/storage-template/ Also according to https://immich.app/cursed-knowledge the notify issue was fixed July 2024.

Great news! I triggered the discussion with WAL at the time but lost interest. Great to see that deva understood the problem! Kudos. Will give it another try asap!!

Re: Self-hosting my photos with Immich

#379

Post by cromka »

esseph wrote: post #255
cromka wrote: post #97

Earlier quoted context omitted.

OK. Then you concede your security, as I can't imagine any single person self-hosting can be better at keeping their public service more secure than engineers at Google can. Especially with limited time.

If you're not Cloudflare averse... Setup immich VM or docker container with a cloudflare tunnel Front access with Cloudflare Access (ZeroTrust) for free. Set "can only be accessed by users with email = xyz@myuser” Done. Now assuming this is the same user email as the one you shared photos with, there is a base level of security keeping the riffraff away. Home IP is never exposed either, because it's proxied through t…

I dont need that. I use wireguard to connect to my LAN. I meant risk of getting your data stolen either through physical breakup or some security vulnerability

Re: Self-hosting my photos with Immich

#380

Post by sva_ »

Sanzig wrote: post #376
sva_ wrote: post #369

Earlier quoted context omitted.

I'm a bit skeptical that I don't have full control of my keys, but it does seem convenient.

You can have full control over your keys if you want: https://tailscale.com/kb/1226/tailnet-lock

That's pretty cool, thanks for the info! I've been looking into Tailscale the past few days since it actually seems pretty convenient.

I've seen they offer to use Mullvad as an exit node for devices which is very cool. Sadly it seems like for this to work, you have to have them manage your Mullvad keys, which to me kind of defeats the purpose of Mullvad in some ways. But I can see how it makes sense to them from a business-perspective.

Post reply on HN