Expose Immich to the internet using a reverse proxy

Expose Immich to the internet using a reverse proxy

Note

This guide is based on the quadlet files in main.

We recommend using this in conjunction with an OIDC provider with Passkeys or 2FA. For example, we have a guide for PocketID.

Caddy

1. Create a Caddyfile (literally just call it Caddyfile) and put it wherever you want

   your.domain.name {
       reverse_proxy systemd-immich-server:2283
   }
   

Note

If you do not own a domain name that points to your server the setup won't be as simple as replacing your.domain.name with your static IP address as the certificates won't be trusted by the Immich mobile app unless you root every smartphone that should run Immich and manually add your Caddy root certificate to the System Certificate Store (user certificates are ignored by the Immich app). To obtain publicly trusted IP certificates you need to use a different reverse proxy than Caddy. If you do not even own a static IP address you may use a dynamic DNS service like No-IP (free in some cases) which requires yet more setup.

2. Create a caddy.container file:

   [Unit]
   Description=Caddy Reverse Proxy
   
   [Container]
   #AutoUpdate=registry
   Pod=immich.pod
   Environment=XDG_DATA_HOME=/home/
   Environment=XDG_CONFIG_HOME=/home/
   
   #pin Caddy to a major version to prevent updates that break your setup
   Image=docker.io/caddy:${CADDY_VERSION}
   
   Volume=${CADDY_STORAGE_LOCATION}:/home/:z
   Volume=${CADDYFILE_LOCATION}/Caddyfile:/etc/caddy/Caddyfile:ro
   

3. Replace the ${} variables according to your setup. Inside of the directory at ${CADDY_STORAGE_LOCATION} Caddy will create a caddy subdirectory and store its configuration there.

4. Move the caddy.container file to wherever your other .container files are. Either to /etc/containers/systemd/immich or ~/.config/containers/systemd/immich depending on whether you're running rootless podman.

5. Change the port to be published in your immich.pod file or publish it in your caddy.container

   - PublishPort=2283:2283
   + PublishPort=443:443

Note

This is the default HTTPS port that Caddy can be reached from outside the containers. Both Immich traffic and TLS certificates will land here. If you want Immich traffic to arrive on a different port you should still leave port 443 reachable for the TLS-ALPN challenge unless you want to go through the hassle of setting up a DNS challenge. Don't forget to add the port for Immich after your.domain.name: and before { in the Caddyfile.