Afaik immich is generally safe to publicly expose. Otherwise, I’d just use http basic auth. Supported by every server and client, should be secure enough to hold off attacks in case immich’s login/auth mechanisms fail, and I don’t see a usecase where this wouldn’t work.

If you don’t have a public IP or need IPv4, get a 4€/Month VPS (cheaper than even a Pi’s energy usage I suppose) and put headscale on it.