Immich is an amazing piece of software, but because it holds such personal data I have only ever felt comfortable accessing it via VPN or mTLS. This meant that I could never share any photos, which had been really bugging me.

So I built a self-hosted app, Immich Public Proxy, which allows you to share individual files or full galleries to the public without ever exposing your Immich instance. This uses Immich’s existing sharing functionality, so other than the initial configuration everything else is handled within Immich.

Why not just expose Immich publicly with Traefik / Caddy / etc?

To share from Immich, you need to allow public access to your /api/ path, which opens you up to potential vulnerabilities. It’s up to you whether you are comfortable with that in your threat model.

This proxy provides a barrier of security between the public and Immich. It doesn’t forward traffic to Immich, it validates incoming requests and responds only to valid requests without needing privileged access to Immich.

Demo

You can see a live demo here, which is serving a gallery straight out of my own Immich instance.

Features

  • Supports sharing photos and videos.
  • Supports password-protected shares.
  • Creating and managing shares happens through Immich as normal, so there’s no change to your workflow.

Install

Setup takes about 30 seconds:

  1. Take a copy of the docker-compose.yml file and change the address for your Immich instance.

  2. Start the container: docker-compose up -d

  3. Set the “External domain” in your Immich Server Settings to be whatever domain you use to publicly serve Immich Public Proxy. Now whenever you share an image or gallery through Immich, it will automatically create the correct public path for you.

For more detail on the steps, see the docs on Github.

  • just_another_person@lemmy.worldEnglish
    0·
    10 days ago

    Okay…I’m terribly confused by this project here, so maybe you can clarify some things.

    First, looking through the code, it seems you’re literally just taking input requests and replaying them to a target host. So if Immich is updated with changes that proxy doesn’t have yet, everything breaks.

    How is this adding more security than any other proxy?

    • alan@feddit.orgOPEnglish
      0·
      10 days ago

      You’re correct - it is indeed taking input requests and requesting the related data from Immich.

      How is this adding more security than any other proxy?

      To allow sharing with Immich using a normal reverse proxy like Caddy or Traefik, you need to expose public access to the Immich /api/ path, along with a few other potentially dangerous paths. Any existing or future vulnerability has the potential to compromise your Immich instance.

      This proxy is more secure as it does not allow public access to the Immich API path or to any Immich path. The only incoming requests which are honoured are requests like this:

      https://your-proxy-url.com/share/ffSw63qnIYMtpmg0RNvOui0Dpio7BbxsObjvH8YZaobIjIAzl5n7zTX5d6EDHdOYEvo

      If the shared link does not resolve to something that you have intentionally shared from Immich, it will return a 404.

      if Immich is updated with changes that proxy doesn’t have yet, everything breaks.

      The only thing which would break it is if Immich changed the format of a few select API endpoints. And if that ever happens it’s a very easy fix.

      • just_another_person@lemmy.worldEnglish
        0·
        10 days ago

        Or you could similar just block those routes in whatever reverse proxy you’d use out in front of the server?

        I don’t run Immich myself, but just trying to understand the technical issues and this particular solution. Seems like they should have a public facing /shared route that doesn’t require access to any others, so I see your point.

        • alan@feddit.orgOPEnglish
          0·
          10 days ago

          Or you could similar just block those routes in whatever reverse proxy you’d use out in front of the server?

          You can’t. You need to allow public access to your Immich instance’s /api/ path to use Immich’s built-in sharing.

  • markstos@lemmy.worldEnglish
    0·
    10 days ago

    A simpler way to protect a private service with a reverse proxy is to only forward HTTP GET requests and only for specific paths.

    It’s extremely difficult to attack a service with only GET requests.

    The security of which URLS are accessible without authentication would be up to immich.

      • markstos@lemmy.worldEnglish
        0·
        8 days ago

        Good example. It’s true that an even a GET request not designed to mutate data might still fail to validate input, allowing a SQL injection attack or other attack that escalates to the privileges that the running app has.

    • elvith@feddit.orgEnglish
      0·
      10 days ago

      I don’t know the Immich API, but I’ve seen several REST APIs that used the usual pattern of

      GET /api/v1/user/<id> - read user
POST /api/v1/user/ - create user
...

      but also allowed

      GET /api/v1/user/<id> - read user
GET /api/v1/user/?action=create - create user
...
      • davad@lemmy.worldEnglish
        0·
        10 days ago

        Yup, also some APIs use GET for everything. It’s a pain. And it means that filtering by verb only helps if you’re intimately familiar with the API. And even then, only if you keep up with changes as they happen. So really, only if you’re developing the API yourself.

        • davad@lemmy.worldEnglish
          0·
          9 days ago

          (another pet peeve of mine is “rest” APIs that use 200 response codes for everything)

          • Atemu@lemmy.mlEnglish
            0·
            10 days ago

            Ahhhhh whyyyyy, you’ve got all of these standard response codes made for you, why would you blatantly ignore them like that?!

    • alan@feddit.orgOPEnglish
      0·
      9 days ago

      The security of which URLS are accessible without authentication would be up to immich.

      This is exactly the risk I’m wanting to mitigate. Immich is under heavy active development, and I want to abstract away from needing to worry whether the no-auth API URLs are safe to expose publicly.

      At the end of the day I feel safer knowing that there is zero public access to any part of my Immich instance, which for me is what really matters.

      • markstos@lemmy.worldEnglish
        0·
        9 days ago

        Immich has a whole set of end-to-end automated tests to ensure they don’t accidentally make public any URLs they went to be private:

        https://github.com/immich-app/immich/tree/main/e2e/src/api/specs

        As a popular open source project, that would be e glaring security hole.

        Using this proxy puts the trust in a far less popular project with fewer eyeballs on it, and introduces new risks that the author’s Github account is hacked or there’s vulnerability in he supply chain of this docker container.

        It’s also not true that you “never need to touch it again” . It’s based on Node whose security update expire every two years. New image should be built at least every two years to keep to update with the latest Node security updates, which have often been in their HTTP/HTTPS protocol implementations, so they affect a range of Node apps directly exposed to the internet.

        • alan@feddit.orgOPEnglish
          0·
          9 days ago

          All good points, and Apple has some of the most skilled engineers in the world and The Fappening still happened.

          It’s not possible for me to audit everything that’s happening security-wise in Immich, but I can fully understand what’s happening in this small codebase to my own satisfaction. At the end of the day I feel safer knowing that there is no public access to any part of my Immich instance.

          It’s also not true that you “never need to touch it again”

          I meant that you don’t need to use it to share photos, not that you never need to update your docker containers! 😱 Thanks, I have clarified that.

  • Tippon@lemmy.dbzer0.comEnglish
    0·
    10 days ago

    You can see [a live demo here](https://immich-demo.note.sx/share/ffSw63qnIYMtpmg0RNvOui0Dpio7BbxsObjvH8YZaobIjIAzl5n7zTX5d6EDHdOYEvo), which is serving a gallery straight out of my own Immich instance.

    Sorry, off topic, but is this what Immich looks like out of the box, or have you used any other plugins?

    Immich Public Proxy looks like exactly what I want for my family photos, but I haven’t looked into Immich yet. The demo looks beautiful, and is simple enough for the grandparents to use 🙂

  • Atemu@lemmy.mlEnglish
    0·
    10 days ago

    Pretty cool!

    Have you thought about whether this could also be used for limited write access? A common use-case for abusive image gallery services that you cannot ordinarily fulfil with Immich is shared albums where multiple people that e.g. attended the same event can collect pictures in without complex authentication (just a single shared secret or even just the link to the album).

  • Appoxo@lemmy.dbzer0.comEnglish
    0·
    9 days ago

    Thank you very much for the work. I pondered a few times how I could do that safely as I don’t feel like hosting it that publicly.
    I run Jellyfin publicly behind Authelia but there arent any personal files inside so if they breach it, it would give them only movies, music and tv shows…

  • atzanteol@sh.itjust.worksEnglish
    0·
    10 days ago

    You seem to understand neither security nor privacy.

    I get to give you access to all my photos so that you can just proxy calls to my server?

    Just share your own damn server people, this “I’m behind 7 proxies” bs is getting tiring.

    • alan@feddit.orgOPEnglish
      0·
      10 days ago

      I get to give you access to all my photos so that you can just proxy calls to my server?

      This is a self-hosted app… The only person who has access to your photos is you - that’s the entire point of using this. It lets you share photos/videos/albums from Immich without giving anyone access to any part of your Immich server, thus significantly increasing your privacy and security.

      It doesn’t forward any traffic to Immich, it creates essentially a WAF between the public and Immich. It validates all incoming requests and answers only valid requests, without needing privileged access to Immich.

      • Appoxo@lemmy.dbzer0.comEnglish
        0·
        10 days ago

        Couldnt this in theory also be handled by using cloudflares WAF and disallowing every entry to protected end-points?

        • alan@feddit.orgOPEnglish
          0·
          10 days ago

          You’d still need to allow access to the /api/ path, and even public endpoints could potentially expose you to a vulnerability. It’s entirely up to your threat model.

          Knowing what happened in 2014 with iCloud, I’m not prepared to take that risk. Especially as Immich is under heavy development and things can often change and move around. At least this way I know that it will either safely fetch the data or simply fail.

    • lemmeBe@sh.itjust.worksEnglish
      0·
      10 days ago

      For anyone else reading this completely unjustified and ill-intentioned criticism of the OP’s work: atzanteol obviously has no clue about security and therefore cannot comprehend the value of this library.

      • atzanteol@sh.itjust.worksEnglish
        0·
        10 days ago

        Do you often recommend people running single-developer maintained software that has existed for about a fortnight for “security purposes”?