Immich Public Proxy

Share your Immich photos and albums in a safe way without exposing your Immich instance to the public.

This does not need an API key, or any privileged access to Immich. Setup takes less than a minute, and you never need to touch it again as all of your sharing stays managed within Immich.

See a Live demo gallery serving straight out of my own Immich instance.

About this project

Immich is a wonderful bit of software, but since it holds all your private photos it's best to keep it fully locked down. This presents a problem when you want to share a photo or a gallery with someone.

Immich Public Proxy provides a barrier of security between the public and Immich, and only allows through requests which you have publicly shared. It is stateless, needs no API key, and knows nothing about your Immich instance beyond what you have shared.

Read more in the Introduction, including why not just expose Immich's /share/ path.

Visitors can optionally add their own photos and videos to a share, for example guests at a wedding. See Let visitors send photos back.

Quick start

1. Download the docker-compose.yml file.
2. Set IMMICH_URL to the local (not public) URL of your Immich server, and PUBLIC_BASE_URL to the public URL of IPP.
3. Run docker-compose up -d and check that https://photos.example.com/share/healthcheck responds.
4. In Immich's Server Settings, set the "External domain" to your IPP URL. Every link Immich generates from now on points at the proxy.

If you use Cloudflare, set your /share/video/* path to Bypass Cache or videos may not play.

Full instructions, including Kubernetes: Installation.

Documentation

Everything is at docs.ipp.nz:

• Installation and Sharing from Immich
• Configuration: downloads, gallery layout, lightbox, metadata privacy, error responses
• Guides: let visitors send photos back, single domain with Immich, redirect your root domain to a share, securing Immich with mTLS
• Troubleshooting

Feature requests

You can add feature requests here.

IPP has read-only access to Immich and stores nothing: anything that needs an API key, modifies Immich, or would require storing a share key won't be considered. Visitor uploads are the one write path, and they live in their own optional container. See CONTRIBUTING.md for the full list.

Thanks

The gallery lightbox, with its zoom, swipe and keyboard navigation, is PhotoSwipe by Dmytro Semenov. It is a superb piece of work, MIT licensed, and IPP would be a much poorer viewer without it. If you find it useful, consider sponsoring the project.