Immich

Related articles
Nextcloud
Nginx
VPN
Immich
is a high-performance self-hosted photo and video management solution that allows users to back-up, organize, search, and share personal media libraries. The project is actively developed and positions itself as a leading open-source, self-hosted Google Photos and iCloud (photo/videos only) alternative. See the
official documentation
for more.
Data sovereignty is a core principle: complete control of your photos and videos. Break free from proprietary (and potentially privacy-intrusive) services such as Google Photos.
Immich can be deployed on a live system or container by docker or by snap image. This article gives specific steps to deploy it on a live system.
Installation
The main package to
install
is
immich-server
AUR
. Optionally,
immich-machine-learning
AUR
enables Google-Photos-like intelligence including: the ability to use natural language search terms to find photos, facial recognition, and people group, duplicate detection, and optical character recognition (OCR).
PostgreSQL setup
Immich uses
PostgreSQL
for database activities. Manual setup of the admin user and of the database is required. Below is a baseline example configuration, the steps of which have been summarized from
PostgreSQL
.
Note
The following needs to be
run as
the postgres user to keep permissions correct. For example, using
runuser
from
util-linux
:
runuser -u postgres --
command
, where
command
is one of the commands below that should be run as the postgres user.
Initialize the database:
[postgres]$ initdb --locale=C.UTF-8 --encoding=UTF8 -D /var/lib/postgres/data --data-checksums
Edit
/var/lib/postgres/data/postgresql.conf
by adding:
shared_preload_libraries = 'vchord.so'
Start/enable
the
postgresql.service
.
Interactively create the
immich
user. For a typical install, answer
immich
for the role name, then
n
for the remaining superuser/createdb/createrole prompts.
[postgres]$ createuser --interactive
Create the
immich
database:
[postgres]$ createdb immich
Edit the password for the admin user, replacing
strongpassword
with your desired password:
[postgres]$ psql
ALTER USER immich WITH ENCRYPTED PASSWORD 'strongpassword';
\q
Reverse proxy setup
Immich requires a reverse proxy to handle TLS termination, load balancing, traffic flow, and other advanced features. While the project officially supports
Nginx
,
Caddy
,
Apache
, and
traefik
, the AUR package provides a pre-configured nginx drop-in. To configure any of the other supported daemons, refer to the
documentation
.
Nginx setup
Edit
/etc/nginx/nginx.conf
by inserting the following inside the
http {}
block:
include /etc/nginx/conf.d/*.conf;
types_hash_max_size 4096;
Create a
conf.d
directory and populate it with the package template:
# mkdir /etc/nginx/conf.d
# cp /usr/share/doc/immich/examples/nginx.conf /etc/nginx/conf.d/immich.conf
Firewall configuration
By default the external tcp port 8080 will redirect to the immich default 2283. Update the firewall to allow 8080/tcp.
For example with ufw allowing traffic only from the LAN:
# ufw allow from 192.168.1.0/24 to any port 8080 proto tcp
Note
For WAN access consider gating traffic with a
VPN
such as
WireGuard
. Hardening the nginx server and the system itself with security best practices is beyond the scope of this article.
Usage
Start
and optionally
enable
the following services:
nginx.service
and
immich-server.service
. If the ML packages are installed, start
immich-machine-learning.service
.
To setup users, service defaults, trigger jobs, etc. browse to
http://127.0.0.1:8080
or to
http://immich.hostname:8080
See also
Official documentation