Last winter I finally moved family photos off Google Photos. Not for ideology, just tired of Google One getting more expensive every year.

Hardware: old Dell Optiplex 7040 (i5-6500, 16GB, 1TB SSD + 4TB HDD) in the bedroom closet, running Proxmox. LXC with Immich for photos, Nextcloud for docs, and Matrix for family chat.

It was messy. I set up Immich, told family it’s done, but forgot to set up proper backups. In January the HDD had errors and I almost lost a month of kid photos. No 3-2-1, only local copy. Wife still brings it up.

Now: Immich with daily backup to external USB, weekly rclone to B2, and Nextcloud with versioning. Matrix is still half-used because sister is on Messenger.

Cost is now about $6/mo for B2 vs $15+ for Google One family, but time cost is higher.

For those who run Immich on similar old Optiplex / small box in closet — how do you handle backups without making it a second job? And how do you keep noise/heat down? My closet is warm and wife is not happy about second heater.

Happy to share docker-compose if anyone needs.

  • Geth@lemmy.dbzer0.comEnglish
    4·
    11 hours ago

    I have raid 5 to protect against hdd failure and I run syncthing and duplicati on immich and other folders for on premise and remote backups.

    What I’m curious about is how people make stuff like Immich and nextcloud available to other people outside their network? When I need to access something remotely I vpn in. I know I don’t have the knowledge to have my server connected to the open internet in a secure manner. I don’t think someone like family members would ever want to bother with anything other than a link and a login page so only me and my partner use these services.

    • WolfLink@sh.itjust.worksEnglish
      3·
      10 hours ago

      I have my Immich instance setup with an nginx proxy for security and ssl, and that’s exposed to the internet. I have a domain for my personal website, so I just put up my Immich instance at a subdomain of that. I can now make public share links I can just copy and paste into a group chat. I haven’t added any other users yet but I’d I wanted to all they’d need to do is login via email/password.

      This is an officially supported kind of setup for Immich, so I would consider it secure: https://docs.immich.app/administration/reverse-proxy/

      I don’t have all of my homelab services exposed publicly though; I VPN in for those.

      General tips for exposing a server to the internet:

      • only expose the ports you need for services you intend to be accessible. Use a firewall and/or your router’s port forwarding settings to enable only what you need, with blocking as a default.
      • update all software regularly
      • only expose programs that are built to be exposed. For example, if you make a Flask website, they will warn you several times not to expose it directly, but to proxy it through something like nginx