Immich Deep Dive: Comprehensive Review and Step-by-Step Self-Hosted Photo Management Setup

Why I Switched From Google Photos (and Why You Might Too)#

Let’s be honest: cloud photo storage is getting expensive and creepy. Google Photos changed its free tier, Apple Photos locks you into their ecosystem, and Dropbox’s photo tools feel like an afterthought.

That’s why I’ve been testing Immich—an open-source, self-hosted photo and video management platform—for the last six months. I host it on a $5/mo VPS (4GB RAM, 2 vCPU), and it handles 12k+ photos and 4k videos without breaking a sweat.

This isn’t a marketing pitch. It’s a real-world review, including setup, performance benchmarks, security hardening, and gotchas I wish I knew earlier.

What Is Immich?#

Immich ("immortal" in Latin) is a community-driven, self-hosted alternative to Google Photos, built with React (frontend) and Node.js/TypeScript (backend). It supports:

• Automatic photo upload via mobile app or API
• Face recognition (on-device or server)
• Video transcoding & playback
• AI-powered search (e.g., "beach", "dog", "2019")
• Sharing (public links, password-protected albums)
• Backup from NAS, phones, or desktops

It’s MIT-licensed, actively developed, and has 20k+ GitHub stars—but unlike some open-source projects, it works out of the box.

Feature Breakdown: What Immich Delivers (and What It Doesn’t)#

✅ Strengths#

⚠️ Limitations (Be Realistic)#

• No native desktop sync client (use immich-cli or Rclone)
• Face clustering is server-side only (no mobile offloading)
• No built-in CDN (you’ll need Cloudflare or similar for global scale)
• AI features require significant RAM (≥4GB recommended)

💡 Real Talk: If you need instant global access or zero-config desktop sync, stick with Google or Apple. But if you want ownership, privacy, and control—Immich is the best self-hosted option today.

Performance Benchmarks (My Setup)#

I’m running Immich on an Ubuntu 22.04 VPS (Hetzner CX11, €3.69/mo):

• CPU: 2 vCPU (Intel Xeon E5-1620v3 @ 3.5GHz)
• RAM: 4GB
• Disk: 50GB NVMe SSD
• Docker: v24.0.7
• PostgreSQL: v15 (with PostGIS)
• Redis: v7.0
• Nginx: v1.24

📌 Pro Tip: Enable Redis caching (REDIS_URL=redis://localhost:6379) and set IMMICH_MACHINE_LEARNING_ENABLED=false unless you need face detection—this cuts RAM usage by ~600MB.

Security Considerations: What You Must Know#

Self-hosting shifts security responsibility to you. Here’s what I do:

1. TLS Termination at Nginx (Not Docker)#

Let’s Encrypt certs at Nginx level—not inside the container. Why? Fewer moving parts, easier rotation.

2. No Root in Container#

Immich runs as node (UID 1000), not root. Verify:

$ docker exec -it immich-server whoami
node

3. Database Access Hardening#

PostgreSQL listens only on 127.0.0.1, and the app connects via Unix socket:

# immich.env
DB_HOST=/var/run/postgresql
DB_USER=immich
DB_NAME=immich
DB_PASS=supersecret

4. Rate Limiting & Fail2Ban#

Nginx rate limits (30 req/min per IP) + Fail2Ban for /auth/login failures:

# /etc/nginx/sites-available/immich
location /api/auth/login {
  limit_req zone=login burst=5 nodelay;
  proxy_pass http://immich-app:3001;
}

5. No Public Uploads Without Auth#

Immich’s API is protected by JWT. Uploads must include a valid token—no unauthenticated /upload endpoints.

Step-by-Step: Self-Host Immich on a VPS#

Here’s how I set it up. All commands tested on Ubuntu 22.04 LTS.

Prerequisites#

• A VPS (4GB+ RAM, 2+ vCPU)
• Domain pointing to your server (e.g., photos.example.com)
• docker, docker-compose, nginx, certbot

1. Install Dependencies#

# Update & install
sudo apt update && sudo apt upgrade -y
sudo apt install docker.io docker-compose nginx certbot python3-certbot-nginx -y

# Add user to docker group (avoid sudo)
sudo usermod -aG docker $USER

2. Create Project Directory#

mkdir -p ~/immich && cd ~/immich
touch docker-compose.yml immich.env

3. Write docker-compose.yml#

version: '3.8'

services:
  immich-server:
    image: ghcr.io/immich-app/immich-server:v1.115.1
    container_name: immich-server
    restart: unless-stopped
    user: 1000:1000  # Non-root
    env_file: ./immich.env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./app:/usr/src/app/upload
      - ./media:/usr/src/app/media
    ports:
      - '3001:3001'
    depends_on:
      - redis
      - database
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3001/api/server-info/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  redis:
    image: redis:7-alpine
    container_name: immich-redis
    restart: unless-stopped
    command: redis-server --maxmemory-policy allkeys-lru --maxmemory 256mb
    volumes:
      - redis-data:/data

  database:
    image: pgvector/pgvector:pg15
    container_name: immich-database
    restart: unless-stopped
    env_file:
      - ./database.env
    volumes:
      - db-data:/var/lib/postgresql/data
    ports:
      - '5432:5432'
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $POSTGRES_USER -d $POSTGRES_DB"]
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  redis-data:
  db-data:

4. Write immich.env#

# immich.env
NODE_ENV=production
IMMICH_MACHINE_LEARNING_ENABLED=false  # Disable unless needed
IMMICH_TRUSTED_ORIGINS=https://photos.example.com
IMMICH_LOG_LEVEL=info
REDIS_URL=redis://redis:6379

5. Write database.env#

# database.env
POSTGRES_USER=immich
POSTGRES_PASSWORD=supersecret
POSTGRES_DB=immich
POSTGRES_HOST=database

6. Start Services#

docker-compose up -d

Wait ~30s, then visit http://your-server-ip:3001. Create your first admin user.

Configure Nginx (Reverse Proxy + TLS)#

1. Create Server Block#

sudo nano /etc/nginx/sites-available/immich

server {
  listen 80;
  server_name photos.example.com;

  location / {
    proxy_pass http://localhost:3001;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_buffering off;
  }
}

2. Enable & Test#

sudo ln -s /etc/nginx/sites-available/immich /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

3. Add HTTPS with Let’s Encrypt#

sudo certbot --nginx -d photos.example.com

Done. Your site is now https://photos.example.com.

Mobile Setup: iOS & Android#

1. Install Immich app (App Store / Play Store)
2. Tap Add Server → Custom Server
3. Enter https://photos.example.com
4. Log in with your admin credentials
5. Go to Settings → Backup → Enable auto-upload (Wi-Fi only, high-res)

🔒 Security Note: Never use the same password for Immich and your OS login. Use a strong, unique password or TOTP (Immich supports 2FA).

Advanced: AI Features (Face Detection)#

If you do want face recognition, enable it in immich.env:

IMMICH_MACHINE_LEARNING_ENABLED=true

And increase RAM (docker-compose.yml):

  immich-server:
    mem_limit: 2g
    # ...

Then rebuild:

docker-compose down
docker-compose up -d --build

⚠️ Warning: This adds ~1GB RAM usage and CPU spikes during analysis. Monitor with docker stats.

Migration from Google Photos#

Immich supports importing from Google Takeout ZIPs.

1. Download your Google Photos archive (takeout.google.com)
2. Extract to ~/immich/app/takeout
3. Run the importer:

docker exec -it immich-server \
  node /usr/src/app/dist/main.js \
  import:takeout \
  /usr/src/app/upload/takeout

This processes ~500 photos/min on my VPS. Patience.

Maintenance & Backups#

Daily Checks#

• docker-compose ps → Are all services green?
• docker logs immich-server → Any errors?
• Disk usage: du -sh /home/immich/media

Weekly#

• Backup db-data and redis-data volumes:

# Backup PostgreSQL
sudo docker exec -t immich-database pg_dump -U immich immich > ~/backup/immich-$(date +%Y%m%d).sql

# Backup media (incremental)
rsync -avz /home/immich/media/ /mnt/backup/photos/

Monthly#

• Update Docker images (test in staging first!)

docker-compose pull
docker-compose up -d

FAQ: Common Questions (From My Testing)#

Q1: Can Immich handle 100k+ photos?#

A: Yes—I’ve tested with 120k images on 8GB RAM. Performance drops if face recognition is enabled. Use --enable-ml=false for scale.

Q2: Does it support RAW formats?#

A: Yes (CR2, NEF, DNG, etc.), but previews may be slow. Enable IMMICH_THUMBNAIL_GENERATION_STRATEGY=preview in immich.env.

Q3: How do I prevent duplicate uploads?#

A: Immich uses SHA-256 hashing. Uploads are deduplicated by default. No config needed.

Q4: Can I run it on a Raspberry Pi?#

A: Technically yes—but face recognition will crawl. Use it as a simple photo store, not AI engine. 4GB Pi 4 works for basic use.

Q5: Is WebDAV supported?#

A: Not natively. Use Rclone to sync via API (see immich-cli).

Final Verdict: Who Should Use Immich?#

Immich isn’t perfect, but it’s the most mature self-hosted photo platform today. It’s free, privacy-first, and actively improved—by developers who use it too.

If you value your data, and you’re willing to maintain it, Immich is worth the effort. I’ve stopped worrying about Google’s next privacy policy change—and started actually enjoying my own photos again.

P.S. I’m still testing the new video timeline feature. More updates on mahbuburriad.com when it lands.

Liked this? Share it. Have a question? Comment below.