I personally would be hesitant to host Immich publicly until they’ve done a security audit. The risk of accidentally exposing my photos publicly is too big for me.
That’s why I recommend using Tailscale or Wireguard directly. Personally I’m using Wireguard for me and Tailscale for other people I want to easily access my services.
The global IPv6 address is usually not directly reachable from the internet for incoming traffic. There’s still the router with a firewall which blocks all incoming connections, so having an IP for each device doesn’t make a difference for security.
With IPv6 ports still have to be forwarded on consumer routers by default, the main difference is that it doesn’t have to be translated to a different IP.
This also means I can have multiple hosts on my home network listening on the same ports, because their public IP’s are different.
Immich has breaking changes too often, so I disabled auto updates for the server and phone app. Updating every few months with backup beforehand is a good tradeoff for something as important as images.
Reading patch notes is especially important with some Immich releases requiring minor admin intervention, e.g. running an extract metadata job.
Whether a device is wired or on wifi matters on some routers, because some routers have wifi and wired devices on different subnets by default. It’s unlikely, so I wouldn’t worry, unless you notice accessing it only works wired.
Iirc Plex supports transcoding for downloads, while Jellyfin only allows downloading the original file. But I’ve heard transcoding downloads is broken on Plex, so ymmv.
Intro skip is only available as a plugin on Jellyfin.
Also, Findroid has a better ui and supports downloads, while the official app has more features (ie. settings/admin panel).
Or simply set up wireguard.
At least I suffered from terrible battery life with Tailscale, while 24/7 wireguard isn’t even showing on the battery stats.
Wireguard is awesome and doesn’t even show up on the battery usage statistics of my phone.
With such a small attack surface I don’t have to worry about zero days for vaultwarden and immich.
The DNS-01 challenge [1] allows for issuing SSL certificates without a publicly routable IP address. It needs API support from your DNS provider to automate it, but e.g. lego [2] supports many services.
I personally leave my Wireguard VPN always on, but as its only routing the local subnet with my services, it doesn’t even appear in my battery statistics.
[1] https://letsencrypt.org/docs/challenge-types/#dns-01-challenge
Unless the container follows semver and only auto updates minor versions.
Edit : Which Immich isn’t.
Never used Plex, but if being open source is a feature Jellyfin is better than Plex.
Not requiring an external authentication server is the biggest drawback of Plex. I don’t want Plex to have my watch history and info about my media library.
With Findroid supporting the intro skip plugin I’m fine since I don’t need many platforms.
As long as it’s set to keep copies. Else it’s just a way to sync accidental file deletions.
Thanks for mentioning desec.io! I’ve read about it in c’t a few years ago, but didn’t find it a few months ago.
I’m behind CGNAT with months between IPv6 prefix changes. Having a separate publicly routable IP for each host is awesome.
Tailscale causes heavy battery drain on my phone (Pixel 4a GrapheneOS) so I’m now on always on plain Wireguard, which only needs 1% of my battery.
Sadly my mother doesn’t have IPv6, so accessing e.g. Jellyfin is not possible.
Thank you, I didn’t know that they’ve changed their pricing to include a free plan.
Hopefully this change actually helps Element to make money. It was always a problem how entangled Matrix and Element are, simply because Element finances most of Matrix. This seems to change now with the Matrix Foundation having an employee.
It’s mostly a north american problem as far as I know. In Germany more than 80% of the people use WhatsApp. Almost no one uses sms anymore.
If the alternative is sms I understand why people like iMessage so much.
Edit: Some more data, it seems like iMessage has about as many users as Signal, according to https://www.statista.com/statistics/867539/top-active-social-media-platforms-in-germany/
Beeper’s software stack is partly open source. They develop the mautrix bridges for WhatsApp, Signal, Discord and many more as open source.
What they keep closed source is their clients (and probably infrastructure).
The documentation to host their bridges is great [1] and the bridges works with most server implementaions (I know of Synapse, Dendrite & Conduit).
I’m running signal and whatsapp bridges for years now without problems, but it’s definitely simpler to pay for Beeper.
The problem with these bridges is that they have to decrypt messages and encrypt them again with matrix. This means anyone who controls the server running bridges has access to your messages. Self-hosting means I’m still in control of my data.
Conduit is also licensed under Apache 2.0, so it could also be taken closed source at any point in time. The reason this wouldn’t impact Conduit as much is that there’re other contributors, whilst Synapse and Dendrite are almost exclusively developed by Element.
The CLA is necessary since Element funds the development of their servers by contracting with companies, governments and institutions which have special needs. Publishing those patches might be against their customers wishes.
The AGPL ensures no one else can make proprietary changes but Element because of their CLA. This makes it unattractive for companies and volunteers to contribute to Element’s servers, which isn’t a problem because those contributors didn’t exist in the first place.
As I understand it, the people who feel strongly about this change feel like their trust was betrayed by Element. The others are probably corporation’s like reddit who don’t want to contribute anyway but are now not able to profit off of Elements work.
My opinion is split. On the one hand I like the change to AGPL, since it forces forks to continue to be foss. On the other hand, Element continues to be allowed to license the code differently, so it doesn’t really change that the code could be closed off at any point in time.
The most important question is whether this change will benefit Element. Status quo is companies taking without giving back. Now corporations and volunteers won’t contribute code because of the CLA and AGPL. This means Element hopes those corporations will contract with Element to get access to differently licensed code for a monetary contribution.
I think reddit will just develop their own server, but maybe smaller companies (like in the health care sector) will pay Element.
This is awesome. I’ve been looking into DNS servers with ad blocking and this seems to be a perfect fit. And it is packaged for Nix, so I’ll definitely give it a go.
Immich recently changed license from MIT to AGPL. As far as I understand they can’t sinply relicense to a non-free license unless they redo a good chunk of code from the last half a year.
If they still used the MIT license I’d be worried too.