Immich is an amazing piece of software, but because it holds such personal data I have only ever felt comfortable accessing it via VPN or mTLS. This meant that I could never share any photos, which had been really bugging me.
So I built a self-hosted app, Immich Public Proxy, which allows you to share individual files or full galleries to the public without ever exposing your Immich instance. This uses Immich's existing sharing functionality, so other than the initial configuration everything else is handled within Immich.
Why not just expose Immich publicly with Traefik / Caddy / etc?
To share from Immich, you need to allow public access to your /api/ path, which opens you up to potential vulnerabilities. It's up to you whether you are comfortable with that in your threat model.
This proxy provides a barrier of security between the public and Immich. It doesn’t forward traffic to Immich, it validates incoming requests and responds only to valid requests without needing privileged access to Immich.
Demo
You can see a live demo here, which is serving a gallery straight out of my own Immich instance.
Features
- Supports sharing photos and videos.
- Supports password-protected shares.
- Creating and managing shares happens through Immich as normal, so there's no change to your workflow.
Install
Setup takes about 30 seconds:
-
Take a copy of the docker-compose.yml file and change the address for your Immich instance.
-
Start the container:
docker-compose up -d -
Set the "External domain" in your Immich Server Settings to be whatever domain you use to publicly serve Immich Public Proxy. Now whenever you share an image or gallery through Immich, it will automatically create the correct public path for you.
For more detail on the steps, see the docs on Github.
Then what's the fucking point? I'm "exposing" my own server either way! And now I'm adding a new system to the mix which can have vulnerabilities of its own.
This is stupid.
Put it on a different server then. It prevents your Immich server from ever needing to be exposed publicly. That's the entire point.
You seem to understand neither security nor privacy.
This is stupid.
Repeat after me - proxies are not used for security.
This is a cargo-cult believe in this community. There's a weird sense that it's "dirty" to have a server exposed "directly" to the internet. But if I put it behind something else that forwards traffic to the server then that's somehow safe!
Security is something you do not something you have. The false sense of security with proxy bullshit like this crappy project is not giving you anything. You're taking a well supported community project (immich) and installing another app in front of it which appears to be some dude's personal project and telling me that is more secure. As though that project is better written?
Install immich. Forward ports to it (or proxy it with nginx if needed for hostname routing (but don't expect this to be more secure)), and keep it up to date and use good passwords.
If you believe this, you are extremely uninformed at best. Proxies are routinely used for security in situations like this and are used to secure many of the apps that you use on the public internet today.
Thank you OP for creating this app! Please ignore any negativity from ignorant detractors.
Proxies are not used for security by anyone but morons. Firewalls, WAFs, etc. all provide some sort of benefit. What is this application doing that is of use? Just "not exposing your server directly"? Well, it is being exposed directly now - so it's a very secure application written by a security professional then? Or should I put it behind another proxy just to be sure? Maybe 7 proxies are enough?
OP is well meaning - but this was a waste of time for anyone else to use. It's a solution in search of a problem.
You have clearly not understood what it does. It basically acts as a basic WAF by blocking the access to various paths that are required by the default sharing feature but not by this "proxy".