Comment - FBXL Lotide

Comment on Finally moved family off Google Photos to Immich on a closet Optiplex 7040 — almost lost a month of kid photos in January

Geth@lemmy.dbzer0.com ⁨7⁩ ⁨hours⁩ ago

I have raid 5 to protect against hdd failure and I run syncthing and duplicati on immich and other folders for on premise and remote backups.

What I’m curious about is how people make stuff like Immich and nextcloud available to other people outside their network? When I need to access something remotely I vpn in. I know I don’t have the knowledge to have my server connected to the open internet in a secure manner. I don’t think someone like family members would ever want to bother with anything other than a link and a login page so only me and my partner use these services.

original

Sort:hotnew top

WolfLink@sh.itjust.works ⁨6⁩ ⁨hours⁩ ago
I have my Immich instance setup with an nginx proxy for security and ssl, and that’s exposed to the internet. I have a domain for my personal website, so I just put up my Immich instance at a subdomain of that. I can now make public share links I can just copy and paste into a group chat. I haven’t added any other users yet but I’d I wanted to all they’d need to do is login via email/password.

This is an officially supported kind of setup for Immich, so I would consider it secure: docs.immich.app/administration/reverse-proxy/

I don’t have all of my homelab services exposed publicly though; I VPN in for those.

General tips for exposing a server to the internet:

only expose the ports you need for services you intend to be accessible. Use a firewall and/or your router’s port forwarding settings to enable only what you need, with blocking as a default.

update all software regularly

only expose programs that are built to be exposed. For example, if you make a Flask website, they will warn you several times not to expose it directly, but to proxy it through something like nginx
original