Docudjeex
Cloud Drive & Photos

Immich

Install Immich, a self-hosted alternative to Google Photos and iCloud with face recognition, geolocation, and multi-device sync.

Immich is a self-hosted photo and video management solution that replaces cloud services like Google Photos or iCloud. It offers powerful features like face recognition and geolocation.

Installation

  • /
    • srv
      • docker
        • immich
          • library
          • compose.yaml
          • .env

Deploy the stack

Open Dockge, click on compose, name the stack immich, then copy and paste the latest docker-compose.yml published here.

Warning: Do not add the Watchtower label to the Immich stack. Immich evolves rapidly, and automatic updates may break your installation.

Set your environment variables

Configure the .env file by copying the latest version from here and follow the comments in the file.

If you're using a NAS or a network-shared drive via Samba to store your data, replace the value of UPLOAD_LOCATION with the path to your shared folder.
✨ Tip: If your CPU/iGPU/GPU supports it, Immich can use hardware acceleration for video playback and image recognition. This can triple performance. Learn more about Transcoding and Machine Learning.

Deploy the container. You can connect and follow the setup instructions at http://yourserverip:2283.

Done !

Exposing Immich with SWAG

The main benefit of this setup is being able to access Immich remotely on all your devices. We'll expose Immich using SWAG.

📋 Before you begin:

We assume that you have a subdomain immich.yourdomain.com with a CNAME pointing to yourdomain.com in your DNS zone. Also, unless you're using Cloudflare Zero Trust, make sure port 443 on your router is forwarded to port 443 on your server via NAT rules.

Add Immich's network to SWAG

In Dockge, open the SWAG stack and edit the compose file to add Immich's network:

compose.yaml
---
services:
  swag:
     container_name: # ...
      # ... 
     networks:            # Connects the container to the custom network 
      # ...           
      - immich            # Network name defined in the stack
    
networks:                 # Defines the custom network
  # ...
  immich:                 # Network name defined in the stack
    name: immich_default  # Actual external network name
    external: true        # Indicates it's an external network
We're assuming Immich's network is named immich_default. You can check connectivity by visiting the SWAG dashboard at http://yourserverip:81.

Restart the stack by clicking "deploy" and wait for SWAG to fully initialize.

Create the subdomain.conf file

In the SWAG folders, create a file named immich.subdomain.conf.

✨ Tip: You can use File Browser Quantum to navigate and edit your files instead of using terminal commands.
Terminal
sudo nano /srv/docker/swag/config/nginx/proxy-confs/immich.subdomain.conf

Then paste the following configuration:

immich.subdomain.conf
## Version 2023/12/19

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name immich.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    #if ($lan-ip = yes) { set $geo-whitelist yes; }
    #if ($geo-whitelist = no) { return 404; }
    if ($geo-blacklist = no) { return 404; }

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    #include /config/nginx/authelia-server.conf;

    # enable for Authentik (requires authentik-location.conf in the location block)
    #include /config/nginx/authentik-server.conf;

    location / {
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        #include /config/nginx/authelia-location.conf;

        # enable for Authentik (requires authentik-server.conf in the server block)
        #include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app immich_server;
        set $upstream_port 3001;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }

    location ~ (/immich)?/api {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app immich_server;
        set $upstream_port 3001;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }
}

Press Ctrl+O, then Enter to save, and Ctrl+X to exit.

Done !

That's it! Immich is now accessible from the internet. Don’t forget to install the iOS / Android apps to sync your devices.

Protecting Immich with Pocket ID

Immich supports OIDC natively, so you can require a Pocket ID login before letting anyone into your photos, instead of (or alongside) the app's own accounts.

Register Immich as an OIDC client

Register an OIDC client in Pocket ID named immich, with these three callback URLs:

https://immich.yourdomain.com/auth/login
https://immich.yourdomain.com/user-settings
app.immich:///oauth-callback

The third URL is what lets the mobile app log in too.

Enable OAuth in Immich

In Immich, go to Administration > Settings > Authentication Settings > OAuth, enable it, and fill in:

FieldValue
Issuer URLPocket ID's OIDC discovery URL
Client IDThe client ID copied from Pocket ID
Client SecretThe client secret copied from Pocket ID

Done !

✨ You can use Authentik instead of Pocket ID:
  1. In Authentik, create an application and an OAuth2/OpenID Connect provider named immich, with the same three redirect URIs as above (type Strict).
  2. Note the provider's Client ID, Client Secret, and Slug.
  3. In Immich's OAuth settings, set the Issuer URL to https://authentik.yourdomain.com/application/o/<slug>/, then fill in the Client ID and Client Secret.
Contributor:Djeex

Automation

Automate media downloads with the Servarr stack, Radarr, Sonarr, Bazarr, Prowlarr, and Seerr, for movies and TV shows.

Nextcloud

Install Nextcloud to self-host your files, photos, and calendar, a privacy-friendly alternative to Google Drive, OneDrive, and iCloud.

Copyright © 2026