# Immich - Container 109 ## ๐Ÿ“ธ Overview Immich is a self-hosted photo and video backup and management system, designed as a privacy-friendly and high-performance replacement for Google Photos. - **Purpose**: Central photo archive and backup system - **Migration**: In progress from Google Photos - **Source of Truth**: Yes โ€” Immich will become the authoritative media repository --- ## ๐Ÿงพ Service Details - **Container ID**: 109 - **Proxmox Host**: proxmox04 - **IP Address**: 192.168.1.48 - **Exposed Domain**: `photos.wtfsolutions.cc` (planned via Cloudflare Tunnel) - **Authentication**: - Immich internal login - Cloudflare Access (planned) - **Credentials**: - Stored in Bitwarden under `homelab/immich` (planned) --- ## ๐Ÿ–ฅ๏ธ Hosting & Deployment - **Environment**: LXC container on Proxmox - **Provisioning Script**: [community-scripts/immich](https://github.com/community-scripts/ProxmoxVE/blob/main/ct/immich.sh) - **Deployment Method**: Installed via Git and built from source - **Service Manager**: systemd ### Systemd Services - `immich-web.service` โ€“ Web frontend - `immich-ml.service` โ€“ Machine learning (faces, labels) - PostgreSQL and Redis run inside container --- ## ๐Ÿ“‚ Storage & Volumes | Container Path | Host Mount Path | Purpose | |---------------------------|------------------------------------------|----------------------| | `/mnt/immich/library` | `/zfs_pool/immich/immich_library` | Photos and videos | | `/mnt/immich/database` | `/zfs_pool/immich/immich_database` | PostgreSQL DB data | --- ## โš™๏ธ Configuration ### Environment File Path: `/opt/immich/.env` ```env TZ=America/New_York IMMICH_VERSION=release NODE_ENV=production DB_HOSTNAME=127.0.0.1 DB_USERNAME=immich DB_PASSWORD=REDACTED DB_DATABASE_NAME=immich DB_VECTOR_EXTENSION=vectorchord REDIS_HOSTNAME=127.0.0.1 IMMICH_MACHINE_LEARNING_URL=http://127.0.0.1:3003 MACHINE_LEARNING_CACHE_FOLDER=/opt/immich/cache IMMICH_MEDIA_LOCATION=/mnt/immich/library ``` Only the `immich` user has read access to this file. DB credentials are vaulted in Bitwarden. --- ## ๐Ÿ”„ Update Procedure Immich is built from GitHub source. Updates require manual pulls and rebuilds: ```bash # Inside the container systemctl stop immich-web.service systemctl stop immich-ml.service cd /opt/immich git pull npm install --force npm run build systemctl start immich-ml.service systemctl start immich-web.service ``` Optional: snapshot the container before updates (`pct snapshot 109`) --- ## ๐Ÿ” Security - **Public Exposure**: Not yet live โ€” planned behind Cloudflare Tunnel (LXC 111) - **Access Control**: Will enforce Cloudflare Access for external logins --- ## ๐Ÿ” Backup & Recovery | Data Location | Method | Frequency | |--------------------------|------------------------|---------------| | `/mnt/immich/library` | ZFS snapshot or rsync | ๐Ÿ”„ Planned | | `/mnt/immich/database` | ZFS snapshot or `pg_dump` | ๐Ÿ”„ Planned | Restore plan: rollback snapshot or import Postgres SQL dump. --- ## ๐Ÿ“Š Logs & Monitoring | Service | Log Path | |---------------------|------------------------------| | Web Frontend | `/var/log/immich/web.log` | | Machine Learning | `/var/log/immich/ml.log` | | Systemd | `journalctl -u immich-web.service` | --- ## ๐Ÿ“ Notes & To-Do - [ ] Complete Google Photos migration - [ ] Expose Immich at `photos.wtfsolutions.cc` - [ ] Enforce Cloudflare Access - [ ] Configure off-site backup or replication - [ ] Enable monitoring (e.g., Healthchecks or Prometheus) --- ## ๐ŸŒ Network & Integration - Immich runs in **LXC container 109** on `proxmox04`, with local IP `192.168.1.48`. - Public access is planned through **Cloudflare Tunnel** using LXC 111 (`cloudflared`). - Tunnel domain: `photos.wtfsolutions.cc` (not yet live) - DNS and access control will be managed via **Cloudflare Zero Trust**. - Immich will follow a pattern similar to existing services (Nextcloud, Collabora). --- ## ๐Ÿ” Security Practices - **Credentials** (DB password, Immich admin login) are stored in **Bitwarden** under `homelab/immich`. - Once public, Immich will be protected via: - Cloudflare Access (email/domain-restricted auth) - Immich internal login (admin account) - `.env` and secrets are only readable by the `immich` system user. --- ## ๐Ÿ“ฑ Mobile Sync Strategy - Mobile apps (iOS and Android) will be configured to auto-upload once public access is enabled. - Sync will occur through `photos.wtfsolutions.cc` without needing a VPN. - Immich will fully replace Google Photos for ongoing uploads. --- ## ๐Ÿ—‚๏ธ Media Management - All media is stored in `/mnt/immich/library`, backed by ZFS. - Immich ML service provides face and object recognition. - Map view and clustering will be enabled to support timeline and geo search. - Immich is the **single source of truth** for all photo and video content going forward. --- ## ๐Ÿ› ๏ธ Roadmap / To-Dos - [ ] Finalize migration from Google Photos - [ ] Set up Cloudflare DNS for `photos.wtfsolutions.cc` - [ ] Enable Cloudflare Access policies - [ ] Configure mobile app auto-uploads - [ ] Enable map-based search and facial clustering - [ ] Add ZFS snapshot + `pg_dump` automation - [ ] Evaluate long-term off-site backup (e.g., S3, B2) - [ ] Consider exposing read-only album for family/guests --- ## โš™๏ธ Container Configuration Immich runs in LXC container `109` with the following Proxmox configuration: | Setting | Value | |------------------|------------------------------------------| | Cores | 4 | | Memory | 8192 MB | | Swap | 512 MB | | Arch | amd64 | | Root Filesystem | `vm_data:subvol-109-disk-0` (64GB) | | On Boot | โœ… Yes (`onboot: 1`) | | Nesting Enabled | โœ… Yes (`nesting=1`) | | Keyctl Enabled | โœ… Yes (`keyctl=1`) | | Unprivileged | โœ… Yes | | Hostname | `immich` | | Bridge | `vmbr0` | | IP Address | `192.168.1.48/24` | | Gateway | `192.168.1.1` | | Tags | `community-script;photos` | --- ## ๐Ÿง  Machine Learning & GPU Access Immich ML service uses GPU acceleration inside the container: - GPU Devices passed through: - `/dev/dri/card1` (group ID 44) - `/dev/dri/renderD128` (group ID 104) - Facial recognition and object detection performance are enhanced by this setup - ML service runs under `immich-ml.service` with logs at `/var/log/immich/ml.log` --- ## โš™๏ธ PostgreSQL Status Although the container includes PostgreSQL as a dependency: - `postgresql.service` is loaded but **inactive** (`ExecStart=/bin/true`) - Immich may use a direct embedded instance, or external service - DB volume is mounted at `/mnt/immich/database` โ€” contains live data --- ## ๐Ÿ‘ค User Account Management - Admin account created at setup; account recovery is **local only** - No external auth (OIDC, SAML) is currently configured - Self-registration is likely **disabled**; users must be manually added by admin - Mobile apps will authenticate using internal credentials