Immich with Tailscale serve without exposing any Ports

[A4alli]

Hello immich community. I have created immich server with Tailscale and serve that is running perfectly without exposing any Ports. Try it and if need amendments please do so:

compose.yaml

services:
  immich-tailscale:
    image: tailscale/tailscale:latest
    container_name: immich-tailscale
    cap_add:
      - net_admin
    hostname: immich
    environment:
      - TS_AUTHKEY=tskey-xyz (change to the one you have generated)
      - TS_AUTH_ONCE=true
      - TS_SERVE_CONFIG=/config/serve.json
      - TS_STATE_DIR=/var/lib/tailscale
    networks:
      - immich
    restart: always
    volumes:
      - immich-tailscale-data:/var/lib/tailscale
      - ./serve_config/tailscale:/config
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:release
    volumes:
      - /mnt/data/photos/images:/photos/images:ro #full
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
    networks:
      - immich
    depends_on:
      - immich-tailscale
      - redis
      - database
          restart: unless-stopped

  immich-machine-learning:
    container_name: immich_machine_learning
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    volumes:
      - /mnt/data/appdata/immich/model-cache:/cache
    env_file:
      - .env
    networks:
      - immich
    depends_on:
      - immich-tailscale
    restart: unless-stopped
 
  redis:
    container_name: immich_redis
    image: redis:6.2-alpine@sha256:70a7a5b641117670beae0d80658430853896b5ef269ccf00d1827427e3263fa3
    networks:
      - immich
    restart: unless-stopped

  database:
    container_name: immich_postgres
    image: tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
    env_file:
      - .env
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      PG_DATA: /var/lib/postgresql/data
    networks:
      - immich
    volumes:
      - /mnt/data/appdata/immich/db:/var/lib/postgresql/data
    restart: unless-stopped

networks:
  immich:

volumes:
  immich-tailscale-data:

.evn First in host sudo mkdir .env

# You can find documentation for all the supported env variables at https://immich.app/docs/install/environment-variables

# The location where your uploaded files are stored
#UPLOAD_LOCATION=/mnt/data/photos/uploads

# The Immich version to use. You can pin this to a specific version like "v1.71.0"
IMMICH_VERSION=release

# Connection secrets for postgres and typesense. You should change these to random passwords
TYPESENSE_API_KEY=(change as per your desire)
DB_PASSWORD=(change as per your desire)

# IMMICH_WEB_URL=http://immich-web:3000
# IMMICH_SERVER_URL=http://immich-server:3001

# The values below this line do not need to be changed
###################################################################################
DB_HOSTNAME=immich_postgres
DB_USERNAME=postgres
DB_DATABASE_NAME=immich

REDIS_HOSTNAME=immich_redis

Serve.json:

{
  "TCP": {
    "443": {
      "HTTPS": true
    }
  },
  "Web": {
    "${TS_CERT_DOMAIN}:443": {
      "Handlers": {
        "/": {
          "Proxy": "http://immich-server:2283"
        }
      }
    }
  }
}

Goodluck

[kommandantredundant]

Thanks a lot for sharing!
I am trying to replicate your approach but I cannot reach immich in the end.
I have adjusted your /mnt/... paths to my needs, inserted my auth key, changed postgres password and fired everything up.

I successfully started all containers, immich gets registered in my tailnet but I cannot manage to access immich. I suppose something is wrong with my tailscale serve. Would you mind sharing your serve.json?

[A4alli]

sure. and sorry for being late. my apology. see above, I have updated it

[kommandantredundant]

I have been fiddling around with this for SO LONG. It just worked - thank you!

[A4alli]

you are welcome. see my other guide for ente photos and auth.
https://github.com/ente-io/ente/blob/main/docs/docs/self-hosting/guides/Tailscale.md
just add museum.yaml in the same directory cd docker/ente with the following

 # HTTP connection parameters
http:
    # If true, bind to 443 and use TLS.
    # By default, this is false, and museum will bind to 8080 without TLS.
    # use-tls: true

# Specify the base endpoints for various apps
apps:
    # Default is https://albums.ente.io
    #
    # If you're running a self hosted instance and wish to serve public links,
    # set this to the URL where your albums web app is running.
    public-albums: https://ente.xyz.ts.net

# SMTP configuration (optional)
#
# Configure credentials here for sending mails from museum (e.g. OTP emails).
#
# The smtp credentials will be used if the host is specified. Otherwise it will
# try to use the transmail credentials. Ideally, one of smtp or transmail should
# be configured for a production instance.
#
# username and password are optional (e.g. if you're using a local relay server
# and don't need authentication).
#smtp:
#    host:
#    port:
#    username:
#    password:
#    # The email address from which to send the email. Set this to an email
#    # address whose credentials you're providing.
#    email:

s3:
    are_local_buckets: true
    b2-eu-cen:
        key: test # change me
        secret: testtest # change me
        endpoint: https://minio.forest-gentoo.ts.net
        region: eu-central-2
        bucket: b2-eu-cen
        
# Add this once you have done the CLI part
internal:
    admins:
        - 1580559962386440

i forgot that in guide. I will add that

[LounaCodes]

Hello,
I seem to have the same Issue: The containers work fine and Tailscale is connected to my Tailnet. There seems to be an issue with serving. I have some questions:

• Do I put the serve.json file in the serve_config directory?
• What's up with this part ".evn First in host sudo mkdir .env" What exactly do you wante me to do? Do I make a .env directory and put .evn in there?
• Is it just me or is line 33 restart: unless-stopped incorrectly indented, because docker is giving me an error
• Shoulde these two lines in .evn be uncommented?

# IMMICH_WEB_URL=http://immich-web:3000
# IMMICH_SERVER_URL=http://immich-server:3001

Thanks for your help

[mmomjian]

Hello, thanks for posting. Please remove the "ignore mount check errors" from your example. This is not good to have in a guide.

[bo0tzz]

I've taken the liberty of editing the post as that's a dangerous setting to have in there.

[A4alli]

Whats the drawback. Can you explain it please. Moreover, once I run 'ignore mount check errors' how can rebuild without loosing all data and also orphan packages.

[bo0tzz]

The mount check is a safety feature. If it errors, that means there are files missing. If you ignore it, you will lose data.

[A4alli]

All rght. But changing file sometime miss behave and thats why I used ignore mount check errors. Anyway, thankyou for correction.