[Feature] Support base url on the web app #1679
Replies: 30 comments 50 replies
-
|
I think the problem here is that you have |
Beta Was this translation helpful? Give feedback.
-
|
Do you mean that Immich-web can run only in root path? Another files are downloaded properly. The problem is only in Web-app, and is related only to |
Beta Was this translation helpful? Give feedback.
-
|
hey @usikpavel you mention that you were able to get the mobile app /photosImmich/api working correctly? Can you share what proxy rewrite rules you used to accomplish this? I am using apache however if I know what URLs to redirect I can translate from your IIS config. I have tried something like this: but it doesn't work. I get an TLS/SSL communcation failed: POST /oath/config error |
Beta Was this translation helpful? Give feedback.
-
|
Exactly. The API works fine with url rewrite, at least I didn't see any HTTP error from nginx reverse proxy while using the iOS app. The webapp keeps pulling assets from fixed url regardless the base url. |
Beta Was this translation helpful? Give feedback.
-
|
I might have the wrong assumptions. I think what you do is fine, it seems the proxy is working fine as well. I am not sure why that file isn't loaded correctly. Let me do some digging. At the mean time, can you try to pull |
Beta Was this translation helpful? Give feedback.
-
|
All containers are up-to-date: |
Beta Was this translation helpful? Give feedback.
-
|
@usikpavel Immich web can not work perfectly with path prefix now because of web framework config. You'd better use mobile only if you still wanna use path prefix, or use subdomain instead. I hope immich team will @alextran1502 I have a small test with web, Svelte kit not support base url perfectly because |
Beta Was this translation helpful? Give feedback.
-
|
I have problem using HAProxy as SSL termination using something like https://domain.com/immich
I added ACL to manage /immich and /fonts/*** but does not work. |
Beta Was this translation helpful? Give feedback.
-
|
Wanting run Immich under a path using a duckdns address, I am running into this issue as well. I believe this is the related Svelte issue |
Beta Was this translation helpful? Give feedback.
-
|
I ran into this issue when I tried to publish Immich using Tailscale Funnel, which currently doesn't support subdomains. It'd be great if Immich could support this. |
Beta Was this translation helpful? Give feedback.
-
|
I ran into the same issue and would like it if it was possible to run immich under a subpath |
Beta Was this translation helpful? Give feedback.
-
|
I need to use a baseurl this is really the only choice I have but luckily every single other app I want to host has supported this. I thought it was a pretty basic feature after all every app can't take the root of the server. Is it true that immich cannot do this: I will not be able to use immich until this is supported. Can anyone confirm that immich does not support base url and that there are no plans to support it in the futture before I invest more time into looking for a solution. |
Beta Was this translation helpful? Give feedback.
-
|
@ioogithub yes that is correct that we are not supporting sub path |
Beta Was this translation helpful? Give feedback.
-
|
Please feel free to look into a solution, we will be happy to integrate if it works |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for confirming. It sounds like @usikpavel as the mobile working with the /api url. The documentation just mentions to use the mobile app you need to use this url: http://:2283/api. Does this page redirect to something else such as http://:2283/oath/config? I am trying to add proxy rewrite rules to add a base url like this: https://domain.com:2283/immich/api but nothing is working. If I can get just the mobile working that would likely be good enough for now but without further documentation on how this /api URL works its difficult. |
Beta Was this translation helpful? Give feedback.
-
|
Is it still not supported? |
Beta Was this translation helpful? Give feedback.
-
|
This is exactly what I need, as well. Been trying all kinds of Traefik tricks, but it would seem the config needs to be set a a lower layer. Hoping someone has figured that out. |
Beta Was this translation helpful? Give feedback.
This comment was marked as off-topic.
This comment was marked as off-topic.
-
|
Jason actually one of the main maintainer of the project. We invoke questions to help articulate thoughts and answers, if you find that offensive, that would be unfortunate. As of right now, we don't support subpath, only subdomain and we are not planning to support subpath |
Beta Was this translation helpful? Give feedback.
-
|
@ctp-tCG You’re being rather rude in this thread. The maintainers of this project don’t work for you. They are beholden to you in no way. You are free to implement the feature you want in a Pull Request. Otherwise, respect the people who put in the massive amount of work to create and maintain a project like this. |
Beta Was this translation helpful? Give feedback.
-
|
FWIW - we have already looked into supporting subpath (and would like to in the future), but the web framework we use does not support it out of the box so it is quite complicated and involved to get it working at the moment. Since a subdomain works just fine for just about everyone that is the current recommend way to use it with a domain. If you cannot or are unwilling to use a subdomain, feel free to look elsewhere. The discussion will be updated when/if subpath is supported. |
Beta Was this translation helpful? Give feedback.
This comment was marked as off-topic.
This comment was marked as off-topic.
-
|
Alright, that is it |
Beta Was this translation helpful? Give feedback.
-
What a measured and mature response. It’s refreshing from developers, certainly devs working for free. You just made a fan for life! |
Beta Was this translation helpful? Give feedback.
-
|
Not to lessen how well that was handled, I want to highlight that sometimes the harsher comments developers and maintainers of open source projects should be taken with a grain of salt. Many open source projects are a labor of love, made to fulfill a personal need or scratch an itch and share what they made with others to who may have a similar need. These devs are often have families, careers and other stressors that consume a majority of their time. With the little time they can devote to their projects that share, if it is meet with entitled demands, arguments and sass over and over, I can forgive the dev for being short or even crass in a reply. I do not know what else they are dealing with in their lives, I do not know if there is a language or cultural barrier where flat text has a different tone than intended, and I do not know if they will try to correct it when cooler heads prevail. There are devs who are known for being jerks and be so adversarial to their communities that the project is forked (FreeRSS comes to mind). If a user disagrees with those in charge of an open source project, they usually have the right to fork the project to fit their own needs. What they do not have the right to do is demand or bark orders to those who have donated their time. Burn out a very high in open source projects because of situations like this. Again, if you disagree, fork the project and create a pull request or just do it on your own. This is a feature I want as well however, I do not have the time to commit to it given my other obligations. My apologies for this rant and know it is off topic. Please feel free to mark it as such, I wanted to highlight that we all try to be both measured and mature in our responses, there can be more to a response than just the words that are contained with in it. |
Beta Was this translation helpful? Give feedback.
-
|
Is this still not supported by Sveltekit? I am in the same boat (trying to setup Immich+Caddy behind tailscale) and just cannot get it to work. The docs seem to imply that it is doable, but maybe I am misreading? (see also sveltejs/kit#595) Would appreciate if you could take another look at this, beacuse I am kinda stuck. ❤️ |
Beta Was this translation helpful? Give feedback.
-
|
Adding my 2 cents here. This feature would be very useful to lots of people, including me i guess. I cannot (don't know how) add this myself, so i hope somebody can chime in. |
Beta Was this translation helpful? Give feedback.
-
|
Hi, |
Beta Was this translation helpful? Give feedback.
-
|
I'm running Immich on the LAN, hence I can't create a subdomain. an environment variable such as |
Beta Was this translation helpful? Give feedback.
-
|
If you are running it on the LAN, is there a reason you can't run Immich on a different port and access it by the root? |
Beta Was this translation helpful? Give feedback.
-
|
I'm casing all of my services behind a reverse proxy (nginx) and using a single SSL certificate. I wish there's something similar to Quartz's configuration. It's really smooth, it provides |
Beta Was this translation helpful? Give feedback.
-
|
@ahmedelq why can’t you create a subdomain on LAN? All you need to do is get a wildcard SSL cert (which you can do even for a self signed cert) and add a DNS entry. For example, let’s say your server DNS is server.internal. You can generate a cert for *.server.internal, add a DNS entry for Immich.server.internal, and then add an entry in nginx using the servername directive to proxy it to Immich. |
Beta Was this translation helpful? Give feedback.
-
|
I think it will provide better security when you use subpath with ssl. |
Beta Was this translation helpful? Give feedback.
-
|
Hackers won't know the domain either if you use a wildcard cert. Even if the domain was known, this is a very poor example of security through obscurity. |
Beta Was this translation helpful? Give feedback.
-
|
I've created an nginx config for those who need this to work now: But this is no long term solution of course, it would be great if immich would support this out of the box. It shouldn't be that hard to implement because Sveltekit already supports base urls, in fact the nginx config rewrites the Sveltekit config and sets the base path. |
Beta Was this translation helpful? Give feedback.
-
|
Feel free to open a PR to implement the feature 👍 |
Beta Was this translation helpful? Give feedback.
-
|
it is much cleaner to have the reverse proxy handle stripping path prefix before routing requests to a server considering how common this requirement is. This allows upstream servers to remain unaware that they are being reverse proxied, rather than requiring code changes |
Beta Was this translation helpful? Give feedback.
-
|
But then it might be necessary to change the reverse proxy server config for each app update. |
Beta Was this translation helpful? Give feedback.
-
|
No other apps does it this way. The reverse proxy approach is always a workaround when the app is reticent to support it. Don't get me wrong.... Do it anyway it's best for Immich, its just kind of expected and preferred to have it the way everybody else does. |
Beta Was this translation helpful? Give feedback.
-
|
To properly support reverse proxies that change the base url we could implement the |
Beta Was this translation helpful? Give feedback.
-
|
It works! Maybe it can be added to the immich documentation while waiting for the discussion to reach a consensus? |
Beta Was this translation helpful? Give feedback.
-
|
We'd like to support it, however it is not on the priority list. So we leave this open for the community's contribution |
Beta Was this translation helpful? Give feedback.
-
|
Iwas referring to add the nginx setup to immich docs |
Beta Was this translation helpful? Give feedback.
-
|
Does |
Beta Was this translation helpful? Give feedback.
-
|
The mobile app already works with base urls (atleast on ios, have not tried android yet) |
Beta Was this translation helpful? Give feedback.
-
|
Hi, I'm using ngin reverse proxy manager with already a home assistant instance using my root path + a specific custom location aka subpath config for a overseerr instance pointing to domain/overseerr. I'd love to see this base url feature make it at some point! |
Beta Was this translation helpful? Give feedback.
-
|
My use case was highlighted earlier on in this post, but I will reverberate it for clarity: Using tailscale funnel is a convenient way for me to expose my Immich server to the internet. However, you have no control over the domain part ( This forces you to use path qualifiers (such as |
Beta Was this translation helpful? Give feedback.
-
|
Since you are a tailscale user, this guide could be of interest to you. Especially the option of creating a container per app, so it gets its own domain in your tailnet ;) |
Beta Was this translation helpful? Give feedback.
-
|
Having a quick look at the relevant code when creating the server, this feature might be a matter of simply patching this code to be base-path aware. Calling app.setGlobalPrefix(`${customBasePath + '/'}api`, { exclude: excludePaths });and then it is a matter of patching the other paths served. The main problem might be The more trivial solution might be just to create a Nest middleware to rewrite responses. |
Beta Was this translation helpful? Give feedback.
This comment has been minimized.
This comment has been minimized.
This comment was marked as off-topic.
This comment was marked as off-topic.
-
|
Hi all, I’ve come up with a workaround to host Immich with a predefined prefix. I am not an expert in web developing, so please feel free to point out mistakes if there's any! ;) TL;DRThe core idea is to ensure that "routing actions" are handled by SvelteKit, which appends the base path to internal URLs. The solution requires YOU pre-defining the prefix, compiling the code, and hosting the web app on an external HTTP server. The modified web app runs alongside the official Docker image, and these two parts are put together by an Nginx server. Steps:
/** @type {import('@sveltejs/kit').Config} */
const config = {
kit: {
paths: {
base: '/immich',
},
},
};
location /immich/ {
root /usr/share/nginx/html/;
try_files $uri /immich/index.html;
location ~ /immich/api(.*) {
client_max_body_size 0;
proxy_request_buffering off;
proxy_buffering off;
proxy_pass http://immich_server:3001;
rewrite /immich/(.*) /$1 break;
# Reverse proxy settings from Immich
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_redirect off;
# Timeout settings
proxy_read_timeout 600s;
proxy_send_timeout 600s;
send_timeout 600s;
}
}However I couldn’t find a good solution for a dynamic prefix (i.e., one defined before compiling or generated on the fly). There are too many restrictions in the Immich codebase and the SvelteKit framework. I also found a potential solution if we can make some further adjustments, but it may conflict with the maintainers’ intent. I’m happy to share if anyone is interested! :) Web App SideStatic Assets:Immich is built as a client-side rendered single-page app (SPA), and SvelteKit won’t generate relative links for SPAs, which affects the URLs for static assets. From the SvelteKit documentation:
According to discussions from other SvelteKit projects, partly rendering the file at the server side could help. However, since the Immich web app is built as a static file bundle, the best we can do is define the base URL before compiling. Relevant issues of SvelteKit: #595, #9569, and #10235 OpenAPI Base URL:API URLs are defined in the OpenAPI SDK with the base URL specified in the same file: immich/open-api/immich-openapi-specs.json Lines 7401 to 7405 in aa0097b Since exported methods rely on this base URL, you can either define the value before compiling, or set it dynamically in The latter approach avoids modifying the OpenAPI configuration and IMO is more suitable for a dynamic base URL (if that becomes possible in the future). URL Routing:This is the tricky part. The routing paths are defined by the immich/web/src/lib/constants.ts Lines 14 to 51 in aa0097b These route links are used in these 3 actions but none of them handle the
The This function handles the Server SideThere are nothing to do with the server since the nginx can handle the proxying very well at this moment. What we have to do is just fix some bugs that caused by the transparent proxying. For example, the logout API returns a hard-coded 302 which won't integrate with the client-side URL: immich/server/src/services/auth.service.spec.ts Lines 183 to 221 in aa0097b |
Beta Was this translation helpful? Give feedback.
-
|
Also — we won’t merge this because it only works statically defined. It still doesn’t support end user configuration of a subpath. I’m not even certain that we would accept a PR for that at this time, though. |
Beta Was this translation helpful? Give feedback.
-
This is inaccurate. If anything, subdomains are more secure than paths on a shared hostname, as browsers' cross-site protections operate on a hostname level. With paths, the various applications could read eachother's authentication cookies and make requests to eachother's APIs, to give an example. |
Beta Was this translation helpful? Give feedback.
-
|
While it's true that subdomains are much more secure than subpaths, there are situations where subpaths are preferred, depending on your setup. I have a dozen subdomains and quite a few subpaths too, much depends on how you want to aggregate stuff. While i agree that something like Immich do benefit from a subdomain, this is not always the case and where possible, the option to be hosted on a subpath is always nice to have. to OP of comment chain, again, obscurity is not security and you should hide all your subpaths behind a reverse proxy anyway. |
Beta Was this translation helpful? Give feedback.
-
I agree with you. If we are going to use subpaths, the code for setting cookies should also be modified. The immich_access_token should be scoped to your subpath, which can help minimize the risk of leakage. However, keep in mind that guessing subpaths is harder than guessing domain names, because when guessing a domain, you might not receive any notifications, but path guessing can be blocked by a simple fail2ban and you can get notified. I will try to find some ways to address the subpath compatibility issue soon. |
Beta Was this translation helpful? Give feedback.
-
Hi Matthew, I absolutely agree this solution should not be merged. Also, for me it is also very difficult to maintain since it is changing everywhere in the code. |
Beta Was this translation helpful? Give feedback.
-
|
It seems to me that making this path configurable is not the right solution. Why not rename the path for everyone? This is enough to keep everyone happy and avoid unnecessary headaches... |
Beta Was this translation helpful? Give feedback.
-
|
Has anyone considered using the hash routing method? |
Beta Was this translation helpful? Give feedback.
-
If you're interested, you can check out https://github.com/Boc-chi-no/immich-sub-path/releases I really like this project, and I'll probably update it with every version while trying to find a better way to solve this issue. |
Beta Was this translation helpful? Give feedback.
-
|
The former solution provided by zhuyuhui97 were rejected because the sub path url is not dynamically definable. But this is a different one, being very clever and promising to bypassing the svelte restrictions. Please consider to merge this! @mmomjian |
Beta Was this translation helpful? Give feedback.
-
|
@Boc-chi-no Do you think there is any blocker for this to be merged to upstream? (Other than breaking existing share links which to be honest is not that big of a problem, immich is still in beta after all). |
Beta Was this translation helpful? Give feedback.
-
|
Hi Bocchi chan, this is absolutely a better approach! I would really like to test this soon. Hope this will get merged soon! |
Beta Was this translation helpful? Give feedback.
-
|
I tested with v1.135.3, now sveltekit complains during compilaion: I guess the service worker improvement broke the code, so your approach which involves patching generated files does not work anymore. Do you have any idea? |
Beta Was this translation helpful? Give feedback.
This comment has been minimized.
This comment has been minimized.
-
|
Here's a partial workaround that may be useful for others which does not require any changes to immich, so I've been able to use the immich docker images without having to compile anything with custom paths. Use a reverse proxy to forward these paths to the immich server. For me these seemed to have been enough so far, but I've barely started using it, so likely missed a few others. This works because the immich SvelteKit frontend mostly interacts with |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the workaround. It's not very elegant but it works. With Traefik, I'm using the following config: - traefik.http.routers.immich-server.rule=Host(`my-domain.com`) && (PathPrefix(`/photos`) || PathPrefix(`/_app`) || PathPrefix(`/albums`) || PathPrefix(`/api`) || PathPrefix(`/auth/login`) || PathPrefix(`/service-worker.js`) || PathPrefix(`/share`) || PathPrefix(`/sharing`))
- traefik.http.routers.immich-server.service=immich-server
- traefik.http.routers.immich-server.entrypoints=websecure
- traefik.http.routers.immich-server.middlewares=immich-server-stripprefix
- traefik.http.middlewares.immich-server-stripprefix.stripprefix.prefixes=/photosfor anyone who encounter this issue. |
Beta Was this translation helpful? Give feedback.
This comment has been minimized.
This comment has been minimized.
and others
Uh oh!
There was an error while loading. Please reload this page.
-
Describe the bug
Immich server is deployed using default docker-compose.yml on the private host (Windows10) at
http://192.168.3.3:2283/It is accessible via reverse proxy (Windows Server 2019, IIS 10) at public url http://pavelusik.ru/photosImmich/
Main page is loaded successfully, but is not working. The reason is that
/_app/immutable/start-a8372751.jsfile relative path is wrong:and therefore error 404 occured.
All other files (css, js, json, favicon, etc) are loaded successfully by their correct relative addresses
/photosImmich/...path...Task List
docker-composefile..envfile.To Reproduce
Steps to reproduce the behavior:
Expected behavior
/photosImmich/...path...System
v1.25.0_35-devonWindows 10running indockerWindows Server 2019,IIS 10 (with modules URL Rewrite 2, Application Request Routing 3.0)Additional context
docker-compose and env.zip
Beta Was this translation helpful? Give feedback.
All reactions