I have not shared it with many people. But one of my most wanted feature is to completely share by photos with my partner. None of the services I tried (Plex, Synology Photos) had it. In Immich, it’s just a flip of a button.

Ugreen has it. It has conditional albums in which one can setup rules like person, file type, location, anniversary and more and share a live album. Or leave all params empty and simply mirror the entire library.

> In Immich, it’s just a flip of a button.

Flip a switch and then what, are you getting a isolated public URL to share? Or you have your infrastructure exposed to the internet and the shared URL is pointing to your actual server where the data is hosted?

> you have your infrastructure exposed to the internet and the shared URL is pointing to your actual server where the data is hosted

I think the previous commenter misunderstood your question, this is the answer (you can also put it behind something like cloudflared tunnels).

Immich is a service like any other running on your server, if you want it exposed to the internet you need to do it yourself (get a domain, expose the service to the internet via your home ip or a tunnel like cloudflared, and link that to your domain).

After that, Immich allows you to share public folders (anyone with the link can see the album, no auth), or private folders (people have to auth with your immich server, you either create an account for them since you're the admin, or set up oauth with automatic account creation).

I will explain my use case. We use iPhones in our family. We have a 2TB iCloud plan, but we have around 8TB of media from our phones. So I started using boredazfcuk/docker-icloudpd to download iCloud photos daily and keep only the past 2 years of media on our phones for iCloud features.

I wanted a separate app to view these TBs of media on my phone, tried many services, and settled on Immich. Whenever my wife and I want to share photos, we usually have to create albums and send links or share media through messages. That is a very painful way to view each other's media. I wanted a service to just share all our photos with each other so that they would be in the same timeline. There was none available, and I had seen people complain about that on HN.

Immich has that feature, where you can select who to share the whole library with. Enabling that I can see all my photos and my wife's photos in the same timeline and same for my wife. Immich lets everyone log in with their own credentials, and it's hosted on Coolify with a Cloudflare Tunnel.

You get a link and you can set read or write permissions on it.

Whoever gets that link can browse it in a web browser.

I've used this to share albums of photos with gatherings of folks; it works very well. It does assume you have your Immich installation publicly available, however. (Not open to the public, but on a publicly accessible web server)

OK. Then you concede your security, as I can't imagine any single person self-hosting can be better at keeping their public service more secure than engineers at Google can. Especially with limited time.

I mean, if you’re confident about security best practices, have a moderate amount of networking experience, and are a seasoned web developer, it’s not too scary at all. I realize that’s a lot of prerequisites though.

it’s not a fair comparison with Google because Google has a much bigger target on their back. There are millions of users of Google, so the value of hacking Google is very high. The value of hacking a random Immich instance is extremely low.

You definitely have a dull imagination. If the software itself is secure, containerized version of Immich behind a containerized version of nginx proxy manager is probably as secure as you can get. Also google security tends to be mainly leaning towards securing google and less towards securing google's (non paying) customers.

If you're not Cloudflare averse...

Setup immich VM or docker container with a cloudflare tunnel

Front access with Cloudflare Access (ZeroTrust) for free.

Set "can only be accessed by users with email = xyz@myuser”

Done.

Now assuming this is the same user email as the one you shared photos with, there is a base level of security keeping the riffraff away.

Home IP is never exposed either, because it's proxied through the cf tunnel.

I dont need that. I use wireguard to connect to my LAN. I meant risk of getting your data stolen either through physical breakup or some security vulnerability

How safe is that to set up for novice it people? I have a pi with pi-hole on it and am thinking about putting immich on it but the fact that it exposes itself outside my LAN frightens me.

I have it set up in a container that I keep updated. Then it's reverse proxied by another container which runs nginx proxy manager, which keeps the HTTPS encryption online. So far, the maintenance has only been checking whether a new version has been released and docker pulling the images, then restarting the containers.

If you are worried about that then I can highly recommend https://github.com/alangrainger/immich-public-proxy

I keep that running on a VPS, but with with proper firewalling you could probably run it on the same machine.

If you want to share with family, you can permanently add them as users to your Immich instance. Otherwise, you can create a link that they can use.