Share your Immich photos and albums in a safe way without exposing your Immich instance to the public.

This does not need an API key, or any privileged access to Immich. Setup takes less than a minute, and you never need to touch it again as all of your sharing stays managed within Immich.

See a Live demo gallery serving straight out of my own Immich instance.

Immich is a wonderful bit of software, but since it holds all your private photos it's best to keep it fully locked down. This presents a problem when you want to share a photo or a gallery with someone.

Immich Public Proxy provides a barrier of security between the public and Immich, and only allows through requests which you have publicly shared. It is stateless, needs no API key, and knows nothing about your Immich instance beyond what you have shared.

Read more in the Introduction, including why not just expose Immich's /share/ path.

1. Download the docker-compose.yml file.
2. Set IMMICH_URL to the local (not public) URL of your Immich server, and PUBLIC_BASE_URL to the public URL of IPP.
3. Run docker-compose up -d and check that https://your-proxy-url.com/share/healthcheck responds.
4. In Immich's Server Settings, set the "External domain" to your IPP URL. Every link Immich generates from now on points at the proxy.

If you use Cloudflare, set your /share/video/* path to Bypass Cache or videos may not play.

Full instructions, including Kubernetes: Installation.

Visitors can add their own photos and videos to a share, for example guests at a wedding. This needs a second, optional container, immich-public-proxy-upload, and the "Allow public user to upload" option on the share in Immich. The IPP container itself stays read-only. See Let visitors send photos back.

Everything is at docs.ipp.nz:

• Installation and Sharing from Immich
• Configuration: downloads, gallery layout, lightbox, metadata privacy, error responses
• Guides: let visitors send photos back, single domain with Immich, redirect your root domain to a share, securing Immich with mTLS
• Troubleshooting

You can add feature requests here, however my goal with this project is to keep it as lean as possible.

IPP has read-only access to Immich and stores nothing: anything that needs an API key, modifies Immich, or would require storing a share key won't be considered. Visitor uploads are the one write path, and they live in their own optional container. See CONTRIBUTING.md for the full list.