3 ms·

A lot of people talking about encryption in the comment section, thought I would share my setup. I have been running Immich for family and friends on a Hetzner

by FabCH 3mo ago

A lot of people talking about encryption in the comment section, thought I would share my setup. I have been running Immich for family and friends on a Hetzner auction server for about 1.5 years now. Hetzner community provides official full-disk encryption documentation: https://community.hetzner.com/tutorials/install-debian-with-lvm-encrypted-nvme-software-raid https://community.hetzner.com/tutorials/install-debian-with-... Letsencrypt gives free reliable SSL. You can easily hide Immich behind Nginx proxy that handles SSL for you. Add cron based automated backup of the entire Immich data to a local encrypted NAS and there you go. Reliable, end-to-end, encrypted at rest setup. So far, it required exactly 0 maintenance. It’s also more secure because I just drop traffic from all but 3 geographies at the IP level. And you can also add a WAP on the Nginx proxy. It is also more more secure than Google/iCloude because the „employee of the company“ attack vector is much smaller. It’s documented that Google looks at your photos and is perfectly happy to file false police reports: https://www.eff.org/deeplinks/2022/08/googles-scans-private-photos-led-false-accusations-child-abuse https://www.eff.org/deeplinks/2022/08/googles-scans-private-... By comparison, yes it is theoretically possible for Hetzner employees to access my server physically and extract the encryption key from RAM, or setup a fake SSH server to try to steal the key, but that is far more complicated attack and hasn’t been documented yet. And it risks detection.

internet_points 3mo ago
how much storage and how much do you pay Hetzner?
- FabCH 3mo ago
  Prices have jumped considerably, but basically anything on Server Auction is good https://www.hetzner.com/sb/ https://www.hetzner.com/sb/ I pay 60/month for 50 TB with a 10 year old intel xenon.
- sva_ 3mo ago
  If you want a cheaper alternative, maybe look into ServaRica. That's where I run my Immich instance for my wife and me. 4TB for $11 per month. The servers (cpus) are not super fast, but fast enough for me.
logged4upvoting 3mo ago
I see e2e encryption over photo galleries a must since is a way of protecting yourself against misconfigured servers, future exploits or unpatched software.
TalkingCodeMonk 3mo ago
FYI the setup you mention is not "end-to-end" encrypted. E2EE means client-to-client encrypted, with the server processing encrypted bits only. Your approach is encryption in transit and at rest. At rest is relatively irrelevent for large cloud providers, as they are probably better at managing the lifecycle of disks than most businesses or people. It's unlikely someone's going to physically rob a data center or end up with a refurb drive that hasn't been thoroughly processed and wiped. It's not necessarily more secure than managed providers either, simply because you are probably not a security engineer, and have far less resources to secure your server. It does prevent Google/iCloud from scraping your data, but it certainly does not mean Hetzner can't access your data. They control the overarching hypervisor and control plane managing your servers/VM's, so there's no way to know what capabilities have been implemented. The majority of what intelligence agencies are capable of has not been leaked or documented publicly.
- FabCH 3mo ago
  I do happen to have some experience. For 99.99% of the population, does the threat model really include targeted NSA attack with higher probability than „Google’s automated system sent the police to my door“? No, no it doesn’t. It is demonstrably more secure for even a semi experienced sysop to host Immich for their family than for them to use Google/Apple. But I do agree that _some_ experience is required.
  - smallerize 3mo ago
    Hetzner has fewer employees I guess, but since your photos are decrypted there, you have basically the same problem.
    - FabCH 3mo ago
      In memory. If the police shows up and they disconnect my server to sieze it, for example, the photos are lost to them. And the Hetzner employee would need to specifically target me, because I doubt they would implement a dragnet that pierces through the bespoke random process on my bare metal server to scan the photos in memory. That is a lot more secure than „Google scans all pictures routinely and fully automatically sends the police to your door, and you have no recourse if they are wrong“ that the EFF article discussed.
sylens 3mo ago
This is not end to end encryption. There is nothing stopping you (or Hetzner) from accessing your family’s data, as one the disks are mounted to a host they are decrypted and available for use. True E2EE would be that all data on those disks is encrypted by the client your family uses, so even if you combed through the disk volume you would only see cipher text
- FabCH 3mo ago
  This is only true if you are so highly individualistic you don’t consider a family unit as a single entity. If you consider nuclear family as an entity, it’s e2ee. Practically. Putting aside the fact that yes, the server can be compromised if somebody chose to attach to the live RAM and recover keys. But practically, nobody will. Same way Google will not deliver a special compromised image of the mobile app on my phone, even though they completely can.
  - flossly 3mo ago
    It's a definition question. E2ee means in this cases that "the server" cannot decipher the data: the keys to that are only on the client and never shared with the server. This setup simply does fit the definition. And trying to say it is "e2ee practically" is a bit dishonest: there is no definition for "practical e2ee". The point of e2ee is that you do not have to trust the server (see Bitwarden for instance).
    - FabCH 3mo ago
      What is the relevant definition of client and server if they are both peer devices under roughly equal level of control of a single entity?
      - sylens 3mo ago
        The client in your family members devices has encryption keys that you do not have in your client or on the server
tomfow 3mo ago
[flagged]

by FabCH 3mo ago

internet_points 3mo ago

how much storage and how much do you pay Hetzner?

FabCH 3mo ago
Prices have jumped considerably, but basically anything on Server Auction is good https://www.hetzner.com/sb/ https://www.hetzner.com/sb/ I pay 60/month for 50 TB with a 10 year old intel xenon.
sva_ 3mo ago
If you want a cheaper alternative, maybe look into ServaRica. That's where I run my Immich instance for my wife and me. 4TB for $11 per month. The servers (cpus) are not super fast, but fast enough for me.

logged4upvoting 3mo ago

I see e2e encryption over photo galleries a must since is a way of protecting yourself against misconfigured servers, future exploits or unpatched software.

TalkingCodeMonk 3mo ago

FYI the setup you mention is not "end-to-end" encrypted. E2EE means client-to-client encrypted, with the server processing encrypted bits only. Your approach is encryption in transit and at rest. At rest is relatively irrelevent for large cloud providers, as they are probably better at managing the lifecycle of disks than most businesses or people. It's unlikely someone's going to physically rob a data center or end up with a refurb drive that hasn't been thoroughly processed and wiped. It's not necessarily more secure than managed providers either, simply because you are probably not a security engineer, and have far less resources to secure your server. It does prevent Google/iCloud from scraping your data, but it certainly does not mean Hetzner can't access your data. They control the overarching hypervisor and control plane managing your servers/VM's, so there's no way to know what capabilities have been implemented. The majority of what intelligence agencies are capable of has not been leaked or documented publicly.

FabCH 3mo ago
I do happen to have some experience. For 99.99% of the population, does the threat model really include targeted NSA attack with higher probability than „Google’s automated system sent the police to my door“? No, no it doesn’t. It is demonstrably more secure for even a semi experienced sysop to host Immich for their family than for them to use Google/Apple. But I do agree that _some_ experience is required.
- smallerize 3mo ago
  Hetzner has fewer employees I guess, but since your photos are decrypted there, you have basically the same problem.
  - FabCH 3mo ago
    In memory. If the police shows up and they disconnect my server to sieze it, for example, the photos are lost to them. And the Hetzner employee would need to specifically target me, because I doubt they would implement a dragnet that pierces through the bespoke random process on my bare metal server to scan the photos in memory. That is a lot more secure than „Google scans all pictures routinely and fully automatically sends the police to your door, and you have no recourse if they are wrong“ that the EFF article discussed.

sylens 3mo ago

This is not end to end encryption. There is nothing stopping you (or Hetzner) from accessing your family’s data, as one the disks are mounted to a host they are decrypted and available for use. True E2EE would be that all data on those disks is encrypted by the client your family uses, so even if you combed through the disk volume you would only see cipher text

FabCH 3mo ago
This is only true if you are so highly individualistic you don’t consider a family unit as a single entity. If you consider nuclear family as an entity, it’s e2ee. Practically. Putting aside the fact that yes, the server can be compromised if somebody chose to attach to the live RAM and recover keys. But practically, nobody will. Same way Google will not deliver a special compromised image of the mobile app on my phone, even though they completely can.
- flossly 3mo ago
  It's a definition question. E2ee means in this cases that "the server" cannot decipher the data: the keys to that are only on the client and never shared with the server. This setup simply does fit the definition. And trying to say it is "e2ee practically" is a bit dishonest: there is no definition for "practical e2ee". The point of e2ee is that you do not have to trust the server (see Bitwarden for instance).
  - FabCH 3mo ago
    What is the relevant definition of client and server if they are both peer devices under roughly equal level of control of a single entity?
    - sylens 3mo ago
      The client in your family members devices has encryption keys that you do not have in your client or on the server

tomfow 3mo ago

[flagged]