I wanted to keep photos from my phone and my girlfriend’s phone on a device we own, rather than with a cloud provider. But I wanted the ease of iCloud Photos or Google Photos for backing them up, browsing them, and sharing them with friends and family.

For sharing, the idea was to give friends and family access to an album and let them add their own photos, without opening up our entire library.

A NAS was not enough

Storing files on a NAS only covers part of the need. You still have to send photos from your phones, find them easily, and share an album with someone outside your home.

Immich gives me automatic phone backups, a timeline, and photo search. It is what we use to manage the library on the NAS.

One question remained: how could I open an album to friends without exposing Immich, the NAS, or the home network to the Internet?

A simple interface for friends and family

For friends and family, sharing comes down to a link and a password. They open the gallery in their browser and download the photos they want. There is nothing to install and no account to create.

The image at the top of this article shows a demo gallery from immich-public-proxy. This is the component that displays albums to visitors.

Once the installation is configured, I open a share with this command:

immich-share open "Weekend with friends" --ttl 48h --for "Friends"

The command returns the link, password, and expiry date. Here is an example:

Link     : https://photos.example.com/share/<temporary-key>
Password : <locally-generated-password>
Expires  : <expiry-date>

I send the link through one channel and the password through another. When the share expires, the link is revoked and its public route disappears.

An Infomaniak VPS for sharing

For the public server, I chose Infomaniak, an independent Swiss hosting provider with data centres in Switzerland. This fits my preference for sovereign infrastructure and less dependence on large American providers. The photo library stays on the NAS; the VPS makes shares accessible over the Internet.

Here is the path the photos take:

Phones
    |
    v
Immich on the NAS, primary photo library
    ^
    | local filter and outbound WireGuard tunnel
    |
Infomaniak VPS, HTTPS and temporary routes
    ^
    |
Guests' browsers, link and password

The NAS establishes a WireGuard tunnel to the VPS. I do not need to open any ports on my home router. On the NAS, a filter blocks requests by default and only allows those needed for sharing. Protection of access to Immich stays at home.

When no share is active, the portal behaves as if nothing exists. When an album is opened, only the paths required for that share become reachable. The VPS never receives the Immich API key.

Receive other people’s photos without opening the library

To collect photos from friends and family, I added an optional upload service. I did not want an Internet-facing service to be able to write directly to Immich.

This service uses another tunnel, another network, and a separate quarantine area:

Browser -> upload invitation -> VPS -> dedicated tunnel -> NAS quarantine

Quarantine -> local review -> manual import into Immich

Received files wait in quarantine. Reviewing them and importing them into Immich are local operations that must be started separately. The upload service has no access to the photo library, the Immich API key, or control of Docker.

What the VPS can still see

HTTPS encrypts traffic between the browser and the VPS, then WireGuard encrypts the path between the VPS and the NAS. But HTTPS terminates on the VPS: it decrypts the data before forwarding it through the WireGuard tunnel.

Photos therefore pass through the VPS memory in clear text. Bulk downloads also create temporary ZIP archives on its disk, with size limits and automatic deletion. The provider can technically access these data while they are present. Choosing Infomaniak lets me choose whom I trust; it does not remove that technical access.

One option would be to move the public proxy to the NAS. HTTPS encryption would then run directly from the browser to the NAS, without decryption on the VPS. The VPS would only relay encrypted traffic: it would still see IP addresses, timing, and traffic volume, but no longer photo contents or passwords.

Immich on the NAS would still be able to read the photos. This would protect their transport all the way home, rather than encrypting the files with keys held only by users’ devices.

This would also require moving the certificate, HTTP filtering, rate limits, and ZIP cache to the NAS. Certificate issuance would need to be secured to prevent a compromised VPS from impersonating the sharing service. That architecture is not implemented yet.

With Immich to manage our photos and Immich Share to share them, I am getting closer to the experience I wanted: a photo library on our own hardware that is easy to browse and share with friends and family. Setting it up takes more work than iCloud Photos or Google Photos.

The code and installation instructions are available on GitHub.