Security basic help for a Raspberry Pi with Immich
reddit / selfhosted

----------------------------------------------------------------------
Zealousideal_Top4988 · 2023-09-27 14:57

Hello, first post here.


I found this sub after being warned that my Google account is nearly
full (with photos), and so I wanted to go down the route of self-
hosting something similar to Google Photos. Cue, Immich.


I have a Raspberry Pi 4, with Immich installed.


Whilst I don't want to reinvent the wheel, are there any useful
documents / READMEs out there which advise on the security aspect of
hardening your Raspberry Pi?


I'd like to access / backup photos through my iPhone, which Immich has
an app for, but I don't want my photos being leaked to the outside
world.


Any advice, tips and tricks would be appreciated. Thank you.

----------------------------------------------------------------------
Eirikr70 · 2023-09-27 15:29

[https://documentation.immich.app/docs/features/bulk-
upload](https://documentation.immich.app/docs/features/bulk-upload)

Plus https://documentation.immich.app/docs/guides/machine-learning

----------------------------------------------------------------------
Zealousideal_Top4988 · 2023-09-27 15:48

Thank you for your reply, but I don't think these links are related to
hardening the security of the Raspberry Pi device though.

----------------------------------------------------------------------
Franvcg · 2023-09-27 19:30

You should setup wireguard VPN server on your home network (mine is on
my router) so you can connect to the VPN through your phone and access
Immich and other self-hosted stuff without the risk of exposing the
actual services through port-forwarding. In order to connect to
wireguard you need to exchange keys between the client and server (you
do that by scanning a QR code with your phone) so there is no password
for hackers to try to brute force or exploit.

----------------------------------------------------------------------
CoderDanUK · 2023-09-27 22:34

Agree with this post, VPN will be the most reliable way to make sure
nothing is leaked. You can of course also look at setting up [NGINX
Proxy / forwarders](https://www.studytonight.com/nginx-guide/how-to-
forward-http-request-to-another-port-or-service-in-nginx-reverse-proxy
#:~:text=How%20to%20Use%20NGINX%20to%20Forward%20Request%20to,to%20mul
tiple%20%28node%29%20services%20to%20load%20balance.%20) combined with
[IP Whitelisting](https://www.purevpn.com/blog/how-to-whitelist-ip-in-
nginx/#:~:text=How%20to%20Whitelist%20IP%20in%20Nginx%20in%202023,34.4
6.12.32%3B%20%2E%2E%2E%203%203.%20How%20to%20Restart%20Nginx) if you
wanted to allow access from your work address / other family homes etc

----------------------------------------------------------------------
Eirikr70 · 2023-09-28 14:40

I'm afraid you might be right. My wrong.

I personally use a reverse proxy (Swag) with an intrusion detection
system (Crowdsec).

----------------------------------------------------------------------
Zealousideal_Top4988 · 2023-10-03 18:53

Thank you. I've taken your advice and kept it only accessible within
my local network. VPN is required to talk to it outside of this.