Depends, if you’re ok exposing an open port to the Internet then its not tricky at all, assuming you know how to port forward and are not double natted. They warn you to not do this though. I second that warning.

This page explains the 3 main options docs.immich.app/guides/remote-access/

Ideally you’d just do a reverse proxy, which is the most complex option. Tasks include getting a host, cert, and setting it up.

I went with tail scale, it was easy but requires an additional client component on every device and one in the server.