5 ms·

I really tried my best with Immich, but because I didn't want to open a port on my home firewall it made syncing kind of a pain. I ended up going with Ente and

I really tried my best with Immich, but because I didn't want to open a port on my home firewall it made syncing kind of a pain. I ended up going with Ente and have been pretty happy with it.

TranquilMarmot 1y ago
I host Immich in Hetzner (VPS w/ attached 1TB storage box) and connect to it using Tailscale which works pretty flawlessly on my phone. It's great, although the VPS is pretty slow and I might move to a home server at some point. I might also just switch over to Ente so I don't have to deal with the self-hosting. Price for Ente is about equivalent for what I'm paying Hetzner right now.
- dsvf 1y ago
  You could keep the Hetzner VPS with storage for faster online serving of assets and connect a second immich instance only for machine learning on your home server. That way you'd get the best of both worlds: fast media serving and higher performance. That would mean that images are uploaded to the Hetzner server, but the compute-intensive image classification takes place on your home server.
  - TranquilMarmot 1y ago
    A friend suggested this as well. My desktop has a 2080 which is decent enough for machine learning.
- thehamkercat 1y ago
  Immich didn't have encryption last time i checked, do you trust hetzner with your photos? I also use Immich, but on a local server (using tailscale to reach it from outside)
  - QuantumNomad_ 1y ago
    I’m personally wary of uploading too much private data to any host. I am also a customer of Hetzner, and rent a couple of bare metal servers. But I mostly use it to store data that it wouldn’t be that big of a deal if it was stolen by someone. I’ve previously experimented a bit with encrypted volumes that I manually decrypt over ssh, and even full disk encryption that I manually decrypt over ssh. My experience with Hetzner has been good. It is really rare that the servers go down on their own. Reboots are usually my own doing, so I am already “around” to decrypt encrypted volumes. I have experienced critical, unrecoverable hardware failure on Hetzner servers a couple of times over the years. But I’ve had offsite backups in place since day one, so I never ultimately lost any important data. Had to deprovision the broken server, reprovision a new one and restore from my offsite backup. Which is a bit of a hassle, but no biggie because the only one that relies on my servers is mostly myself. A few days of downtime because I am too busy to set up a new server right away is therefore also ok for me, with how infrequently it has happened. A single Hetzner server should never be the only place hosting a copy of all your photos or other data you cannot afford to lose. But that applies to any host really. Not unique to Hetzner.
    - thehamkercat 1y ago
      > A single Hetzner server should never be the only place hosting a copy of all your photos Hetzner (or any vps provider) should not be a place at all to store ANY copy of your photos, unencrypted. I agree that they respect privacy a lot, they're probably the best of all the service providers when it comes to your data and that there are data protection laws in place etc etc but in the end, it's your personal photos, I wouldn't be willing to upload it to any provider unencrypted, good that you're encrypting Also, check this out (not my project): https://github.com/rfjakob/gocryptfs https://github.com/rfjakob/gocryptfs
    - n4bz0r 1y ago
      > I have experienced critical, unrecoverable hardware failure on Hetzner servers a couple of times over the years How do they handle such situations?
      - QuantumNomad_ 1y ago
  - TranquilMarmot 1y ago
    > do you trust hetzner with your photos? No, it's really a temporary solution. My ideal setup will be having it on a local server w/ encrypted backups to Hetzner (or Backblaze or whatever) but I need to acquire the hardware for it and got fatigued with de-Googling so I put the project on hold as "good enough" for now. If anybody does manage to get a hold of all of my photos... I won't be too heartbroken about it. It would be creepy for somebody to have them but there's nothing incriminating in there and it's literally 90% pictures of dogs and cats (and 9% landscapes/flowers, 1% people)
walthamstow 1y ago
Tailscale solves the open port thing for me
- mcny 1y ago
  I seriously dislike adding a package source for a single application. It feels dirty to me. I can't explain it but it makes me feel like I need to take a shower. I don't use arch but this looks cleaner than whatever Debian or fedora (both of which I use) have going on https://tailscale.com/kb/1036/install-arch https://tailscale.com/kb/1036/install-arch
  - xd1936 1y ago
    Alternatively, I feel much better when the upstream vendor is the one packaging and signing the software I install, instead of a (possibly malicious) volunteer from my distro's repository team.
- jcul 1y ago
  Tailscale works great, but it's annoying to have to have an always on VPN on android for it. I need to switch tailscale off if I need to switch to another VPN. Also when I have it on my private DNS stops working, which to be fair I haven't put a huge amount of effort into solving yet. I love it for things like ssh to a server at home, but for things like hosting a service I prefer something like cloudflare tunnel or a self hosted reverse proxy. Though tailscale funnel looks promising.
kakokiyrvoooo 1y ago
Tailscale is what I use to solve such issues.
- brewtide 1y ago
  Same here for all of the 'self hosted' things. I've also just realized that my UDM has a wireguard implementation titled 'teleport' that seems to do basically the same thing. This is nice because sometimes the server at home that is hosting tailscale breaks, and the UDM will let me into the network at the router level. Knock on wood, that's yet to crash.
skwee357 1y ago
Wireguard is the answer. That's how I use it
- amelius 1y ago
  Interesting. Not OP, but I'm looking for something that can punch through corporate firewalls so I can use this (and other) software at work.
  - viraptor 1y ago
    ZeroTier? https://www.zerotier.com/ https://www.zerotier.com/
63stack 1y ago
Oh my god, the syncing requires opening a port??? The amount of hoops these applications require us to jump through nowadays
- into_ruin 1y ago
  It's not the technical difficultly, it's the increased risk.
  - 63stack 1y ago
    What's the risk in allowing a port through a firewall to an application you already trust? How do other applications solve this without a need for an open port?

I really tried my best with Immich, but because I didn't want to open a port on my home firewall it made syncing kind of a pain. I ended up going with Ente and have been pretty happy with it.

TranquilMarmot 1y ago

I host Immich in Hetzner (VPS w/ attached 1TB storage box) and connect to it using Tailscale which works pretty flawlessly on my phone. It's great, although the VPS is pretty slow and I might move to a home server at some point. I might also just switch over to Ente so I don't have to deal with the self-hosting. Price for Ente is about equivalent for what I'm paying Hetzner right now.

dsvf 1y ago
You could keep the Hetzner VPS with storage for faster online serving of assets and connect a second immich instance only for machine learning on your home server. That way you'd get the best of both worlds: fast media serving and higher performance. That would mean that images are uploaded to the Hetzner server, but the compute-intensive image classification takes place on your home server.
- TranquilMarmot 1y ago
  A friend suggested this as well. My desktop has a 2080 which is decent enough for machine learning.
thehamkercat 1y ago
Immich didn't have encryption last time i checked, do you trust hetzner with your photos? I also use Immich, but on a local server (using tailscale to reach it from outside)
- QuantumNomad_ 1y ago
  I’m personally wary of uploading too much private data to any host. I am also a customer of Hetzner, and rent a couple of bare metal servers. But I mostly use it to store data that it wouldn’t be that big of a deal if it was stolen by someone. I’ve previously experimented a bit with encrypted volumes that I manually decrypt over ssh, and even full disk encryption that I manually decrypt over ssh. My experience with Hetzner has been good. It is really rare that the servers go down on their own. Reboots are usually my own doing, so I am already “around” to decrypt encrypted volumes. I have experienced critical, unrecoverable hardware failure on Hetzner servers a couple of times over the years. But I’ve had offsite backups in place since day one, so I never ultimately lost any important data. Had to deprovision the broken server, reprovision a new one and restore from my offsite backup. Which is a bit of a hassle, but no biggie because the only one that relies on my servers is mostly myself. A few days of downtime because I am too busy to set up a new server right away is therefore also ok for me, with how infrequently it has happened. A single Hetzner server should never be the only place hosting a copy of all your photos or other data you cannot afford to lose. But that applies to any host really. Not unique to Hetzner.
  - thehamkercat 1y ago
    > A single Hetzner server should never be the only place hosting a copy of all your photos Hetzner (or any vps provider) should not be a place at all to store ANY copy of your photos, unencrypted. I agree that they respect privacy a lot, they're probably the best of all the service providers when it comes to your data and that there are data protection laws in place etc etc but in the end, it's your personal photos, I wouldn't be willing to upload it to any provider unencrypted, good that you're encrypting Also, check this out (not my project): https://github.com/rfjakob/gocryptfs https://github.com/rfjakob/gocryptfs
  - n4bz0r 1y ago
    > I have experienced critical, unrecoverable hardware failure on Hetzner servers a couple of times over the years How do they handle such situations?
    - QuantumNomad_ 1y ago
- TranquilMarmot 1y ago
  > do you trust hetzner with your photos? No, it's really a temporary solution. My ideal setup will be having it on a local server w/ encrypted backups to Hetzner (or Backblaze or whatever) but I need to acquire the hardware for it and got fatigued with de-Googling so I put the project on hold as "good enough" for now. If anybody does manage to get a hold of all of my photos... I won't be too heartbroken about it. It would be creepy for somebody to have them but there's nothing incriminating in there and it's literally 90% pictures of dogs and cats (and 9% landscapes/flowers, 1% people)

walthamstow 1y ago

Tailscale solves the open port thing for me

mcny 1y ago
I seriously dislike adding a package source for a single application. It feels dirty to me. I can't explain it but it makes me feel like I need to take a shower. I don't use arch but this looks cleaner than whatever Debian or fedora (both of which I use) have going on https://tailscale.com/kb/1036/install-arch https://tailscale.com/kb/1036/install-arch
- xd1936 1y ago
  Alternatively, I feel much better when the upstream vendor is the one packaging and signing the software I install, instead of a (possibly malicious) volunteer from my distro's repository team.
jcul 1y ago
Tailscale works great, but it's annoying to have to have an always on VPN on android for it. I need to switch tailscale off if I need to switch to another VPN. Also when I have it on my private DNS stops working, which to be fair I haven't put a huge amount of effort into solving yet. I love it for things like ssh to a server at home, but for things like hosting a service I prefer something like cloudflare tunnel or a self hosted reverse proxy. Though tailscale funnel looks promising.

kakokiyrvoooo 1y ago

Tailscale is what I use to solve such issues.

brewtide 1y ago
Same here for all of the 'self hosted' things. I've also just realized that my UDM has a wireguard implementation titled 'teleport' that seems to do basically the same thing. This is nice because sometimes the server at home that is hosting tailscale breaks, and the UDM will let me into the network at the router level. Knock on wood, that's yet to crash.

skwee357 1y ago

Wireguard is the answer. That's how I use it

amelius 1y ago
Interesting. Not OP, but I'm looking for something that can punch through corporate firewalls so I can use this (and other) software at work.
- viraptor 1y ago
  ZeroTier? https://www.zerotier.com/ https://www.zerotier.com/

63stack 1y ago

Oh my god, the syncing requires opening a port??? The amount of hoops these applications require us to jump through nowadays

into_ruin 1y ago
It's not the technical difficultly, it's the increased risk.
- 63stack 1y ago
  What's the risk in allowing a port through a firewall to an application you already trust? How do other applications solve this without a need for an open port?