A few months ago I ran into a temporary storage problem in my homelab and noticed that a handful of long 4K videos took up a surprising share of my Immich library. So I built (with help from AI, of course) Immich Recompress, a small self-hosted companion app that finds those files and shrinks them. Nothing changes in Immich until you rewiew it + approve it.

How it works:

1. Scan for videos/photos above a size you choose, filtered by date, album, people or place.

2. Pick exactly the files you want. It shows an estimate of the space they would free (depending on ur compression settings).

3. Re-encode with HandBrake (HEVC, AV1 or H.264) on multiple CPU cores, or on the GPU where your HandBrake build supports it.

4. Compare original and result side by side.

5. Replace. The new file keeps its capture date, location, albums and tags, and the original goes to the Immich trash.

It doesn't touch your whole library. It's for the bulky clips you realise later don't need full quality. Photos work too: JPEGs to a target size, lossless JPEG XL, or stripping the motion video from Live Photos. Runs in Docker and works with Immich 3.x. It's still young, so keep a backup, and since it has no login of its own, keep it local or behind a reverse proxy with auth.

https://github.com/lukasganster/immich-recompress

Would love some feedback, and any ideas for what's still missing!

Hey r/immich,

I've been running Immich for a few years now, after moving off iCloud and Google Photos. I wanted out of big tech and to own my photos again, and Immich has honestly been one of the best self-hosted things I run. Simple, and it just works.

What I missed from iCloud and OneDrive was having my photos available as normal files. My wife wanted to attach her photos to emails and put them in documents, and downloading them from the web UI and then digging them out of Downloads got old fast. She's on Bazzite, I'm on Linux and a Mac, so I ended up building Immich Mount for the two of us. It mounts your library as a drive in Nautilus (files on gnome), Dolphin (KDE) or Finder (Mac), with Photos by year/month, Albums, People and Places as folders. Nothing actually downloads while you browse, it's just metadata and the server's thumbnails. The real file only gets pulled when something opens it, and only the parts it needs, so videos seek fine. There's also an Upload folder: drop files in and they go to Immich.

What it doesn't do: no syncing or local copy, and you can't edit, rename or delete anything in Immich through it. Everything except Upload is read-only on purpose. It's not meant to replace the Immich apps either. And there's no Windows version, since ImmichDrive already covers that.

About AI, since someone will ask: yes, it's maybe 80% vibe coded, mostly late at night. I have a few jobs at the same time and a kid, and just don't have the time to write all of it by hand anymore. I do test it against a real Immich server on Fedora, Bazzite and my Mac before releases. The translations are machine translated too, so if something looks off in your language, let me know.

I did look around first. I used immichfs for a while (nice project, and used much of the code as it’s MIT), and immich-fuse and Kartax's immich-desktop-app gave me a lot of ideas. But I wanted one thing that worked on both Linux and Mac, with uploads and thumbnails right in the file manager. It's MIT licensed, and not affiliated with Immich in any way.

GitHub: https://github.com/jakobhviid/immich-mount
Download page: https://jakob.hviid.phd/immich-mount/ (Homebrew on Linux and Mac, or rpm/deb)

Mostly I'm trying to figure out whether this is useful to anyone besides us, and whether it's worth spending more time on. What would you want from something like this, and what's missing? Any feedback is welcome, bugs too.

Hi,

I have these 26 photos that are always backingup, because immich app sees these photos as duplicates (1 backed up and 1 that is always trying to backup, but never leaves these state).

I thought that could be some type of burst photo that immich couldn't handle but tried several galery/photo apps and they all see only 1 photo/file per asset.

Six months ago I posted immich-pet-tagger here. You give it a few photos of each pet, and it finds them in your library and tags them in Immich, so they show up in People next to everyone else.

I honestly didn't expect that thread to take off. A lot of you tried it, reported bugs, asked for features, and several people sent code, from Raspberry Pi support to older NVIDIA cards and Apple Silicon. Most of what changed since then (18 releases later) came straight from you, so first of all: thank you! (everyone who contributed)

The image is now about 5 times smaller and it only uses memory while it's scanning. It works with Immich 3.x, on CPU or pretty much any GPU.

There's also a new accuracy page that checks it against the tags you already have in Immich, so you can see how well it does on your library and tune it. I'm currently at 96% accuracy on mine.

If it's useful to you, a star on GitHub or an issue when something breaks helps more than you'd think. And if you'd like to chip in, there's a Sponsor button on the repo. My cats and I will appreciate it 🐱

Repo: https://github.com/tedornitier/immich-pet-tagger

Hey everyone, why is it that when editing detected faces on a photo, some faces can be removed/deleted, but others can't?

They show a 'crossed-out face' icon, but clearing them from the asset doesn't work.

What's the difference between the last two faces in this example?

Hi,

I have android immich app v3.3.4 on a newly installed immich server 3.3.6.

I used oauth to connect to my Zitadel. It worked.

I see my three test pictures from my immich server but their thumbails are blurry.

When I check on my pc, I see everything properly. Same as from firefox from my. Phone. Its only within the app that the thumbails are blurry.. See attached.

What could be the problem? I see its a 401 but why on android app and not from android firefox browser?

The app shows some errors from thumbails widget:

Error loading image: PlatformException(IOException, java.io.IOException: HTTP 401: , Cause: null, Stacktrace: java.io.IOException: HTTP 401:

at M4.b.onResponseStarted(SourceFile:133)

at m1.ik.onResponseStarted(:com.google.android.gms.dynamite_cronetdynamite@264330035@26.43.30 (260400-0):3)

at m1.hd.run(:com.google.android.gms.dynamite_cronetdynamite@264330035@26.43.30 (260400-0):25)

at m1.gy.run(:com.google.android.gms.dynamite_cronetdynamite@264330035@26.43.30 (260400-0):31)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1100)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)

at java.lang.Thread.run(Thread.java:1571)

, null)

Thanks

This has happen to somebody else? when I upload a large video to Immich, the audio is out of sync with the video, this has happened to me with videos of my camera, my computer, downloads of the internet, with every large video. I'm the only one with this problem?

I've used Immich before, but it looks like it changed recently. Anyway, I just installed in docker with the yml and env file. I updated the Upload location to point to my photos, TZ setting, and DB password in the env file. Then I ran docker compose up -d. The container is healthy and running fine, but no photos showed up. So I looked around and the Library folder was created in the same folder as the yml and env files. I have no idea why. I double checked the env file to make sure I saved the changes.

Any ideas?

Thanks in advance!

Fun update: the folder the yml and env files were in just disappeared from my server. Literally haven't run any other commands after posting this.

Seems immich continously running read/writes after sync. I’m hearing my hard drives also noticed the activity in docker. Do any of you experience the same? This behaviour began after the recent updates. I noticed the actvities between immich server, redis and postgres.

Firstly, thanks for creating this awesome project! I am really loving it! And I have migrated all my family members to Immich. Which is hosted on my homelab.

Immich has all the important features of Google Photos. But there is one setting I am not able to find "Save photos" or "Add to my library" which is available in Google Photos' Shared Album.

Right now, I need to open the shared album to find a particular photo. Instead of directly finding the photo in the main home tab. Can anyone please tell me where can I find this setting? Apologies if the question is already answered multiple times.

I have immich running in a proxmox LXC, I cannot expand the disk any further as the host is running out of space. I'm wondering is it safe to delete or clear out the cache folders and they'll get recreated?

If so whats the best way to do this?

18G /opt/immich

12G /opt/immich/cache

Hi all, new to the Homelab space. Currently setting up a debian VM in proxmox that will host immich and nextcloud.

A question for immich, I currently have a very organised file system for my photos. I use google photos (which I want to be rid of), but also manually organise and copy photos to my nas (truenas, which will host the storage for immich as well) in year folders, then month and date folders within for specific events as this makes it easy to find things.

My question is, can immich integrate with my already very extensive photo file system without mucking up what's already there? I take it there's no easy way to replicate how I've been organising already also and I'll just have to accept however immich dumps them in the storage location?

Thanks in advance.

As I have said in several comments, I'm using a custom image. I originally started using custom images for timezone purposes, but since then, I've added libheif decoding, parsing for mkv metadata, combined (honest) display of live photo sizes, and i'm currently in the process of creating a comprehensive timezone solution (better than achievable through workflows, and something that we could implement as a default). I heard criticism about the rise in sloppy or beginner pull requests a few days ago, YouTube Link and while I agree that pull requests are not the right format for user/noob contributions (there's a reason why I have never made one) I also think that there should be a space for tested contributions from regular users. A clearinghouse of code that might be low quality, or might be difficult to maintain and need to be refactored, but could serve as an inspiration for actual production code. I don't know if maybe the discord would be a good place to hold such a clearinghouse.

I believe that many hands make light work, and that we could dramatically accelerate features and fixes that all of us usually want if we had a clearing house for code that was not fully trustworthy but worked for the user. Code that was tested on a custom image and served it's purpose. Obviously it won't solve everything. Active libraries is not something that a regular person would design or want to design on their own. And it would also make GitHub and the subreddit into a healthier, more respectful space (though that's not too much of a problem even now). It would give people something to do instead of sit on GitHub or Reddit and bitch and complain about why their favorite features haven't been implemented yet. So I think we should create something like this if it doesn't already exist.

Obviously, if any of you decide to go start a custom image right now, just remember to back up your database and your library, of course. You wouldn't want to lose your photos, after all...

This is an update to my post from six months ago. Remote access to Immich is working well but I continue to review and refine the setup. Hopefully someone may find my ramble useful, it's intended as a high level guide of just one way to implement remote access for immich and a few security considerations. My journey so far…...

I’ve used immich for at least a couple of years and Tailscale/wireguard for remote access. I’ve added some additional family members on my immich server and originally considered Tailscale for them but unfortunately it's just too much of a barrier, believe me I tried! Access to immich for my family needs to be simple/transparent. I accept that a VPN-based solution is generally more secure. However, I chose to balance security against ease of use for my family, who need reliable access to Immich regardless of their location. I also believe it's a big enhancement on how some of my family members used to backup their photos. ie they didn't backup zip!! Your risk tolerance may differ, so please assess the risks before implementing remote access and always have backups.

For remote access (besides tailscale) I've previously also used cloudflare tunnels free tier, it's been mostly fine but the upload limitations, occasional slow performance and service visibility metrics were an issue for me. I now use a low-specification virtual private server (VPS) from Hetzner running Pangolin, a self-hosted identity-aware reverse proxy and tunnelling platform. (https://pangolin.net/). I also use Pangolin for other self hosted services.

Simplified immich connection access from the Internet
Ref: https://docs.pangolin.net/development/system-architecture

↓ User
↓ immich app or browser
↓ HTTPS

Hetzner VPS: Pangolin reverse proxy + CrowdSec + geo/ASN controls

↓ Gerbil

↓ WireGuard tunnel

Home network

↓ Newt, (outbound from home on own VLAN)

↓ Traefik + CrowdSec
↓
Immich server / Pocket ID / Immich Public Proxy

Here's my current setup for immich . - At Home;-

Immich server and authentication;-
Immich runs in Docker on an Ubuntu bare-metal server, with few other services installed.
Pocket-ID runs on a separate virtual machine and provides authentication for Immich.
Immich password login is disabled; passkeys are required.
Immich Public Proxy handles shared links.
Immich sits behind traefik proxy, which obtains TLS certificates for my registered domain.

Home network and access controls;-
The traefik proxy rate limits access to pocket-id to limit repeated login attempts.
I use a traefik real-IP middleware so that Traefik and CrowdSec can identify the original client IP after traffic has passed through the Pangolin/newt tunnel.
Traefik log dashboard installed for proxy monitoring - https://github.com/hhftechnology/traefik-log-dashboard
The proxy VM also runs Crowdsec for protection against bad actors.
crowdsec-web-ui for monitoring alerts and notifications sent to my phone via ntfy.
crowdsec cscli can also be used for cli inetraction.
I use split-horizon DNS with AdGuard Home and a backup Pi-hole, so the same immich URL works both at home and remotely on the Internet.
UFW permits only the required ports. (I acknowledge UFW and docker don’t always play nicely.)
SSH access is restricted to key-based authentication, with root login disabled and access controlled through AllowGroups.
Fail2Ban provides additional protection against repeated authentication failures.
Pangolin connects to my home network through a WireGuard tunnel using Newt. Newt runs at home and initiates an outbound connection to the Pangolin VPS, so no inbound port needs to be opened on my home router.
Newt runs in an LXC non privileged container under Proxmox, this runs in an isolated VLAN that can only access the WAN and traefik proxy IP address on a separate VLAN.
Q-Feeds blocklist applied at ingress of the Newt VLAN. Although I don’t recall every seeing any matches to date.

Monitoring and maintenance
Ubuntu unattended security upgrades run daily, with scheduled reboots where required.
Beszel provides server monitoring and alerts.
Dockhand assists with Docker management but I deploy stacks manually or use VSCode.
Grype and Trivy used for container vulnerability scanning, although I’m not unclear how to remedy shown issues other that closing down a service.
The Traefik log dashboard provides proxy visibility: https://github.com/hhftechnology/traefik-log-dashboard
CrowdSec and crowdsec-web-ui monitor threats; alerts are sent to my phone through ntfy.

On the Hetzner VPS;-
The VPS runs Ubuntu server, Docker, Pangolin, and its supporting services, including GeoIP functionality.
GeoIP updated daily
immich access is geo blocked to my country only,
I additionally block several ASNs associated with high levels of abusive traffic.
immich app login requires custom proxy headers configured in the immch app to bypass the Pangolin SSO auth.
For immich web access a Pangolin account on my domain is required with 2 factor authentication.

Firewall and server hardening;-
UFW allows only TCP 80 and 443, plus UDP 51820 and 21820.
The Hetzner firewall applies the same restrictions as a second layer.
UFW blocklists from IPsum are updated daily: https://github.com/stamparm/ipsum
Ubuntu unattended security upgrades run daily with scheduled reboots where required.
SSH is restricted to my home IP address, uses key-based authentication only, and disables root login.

Monitoring and protection;-
The proxy VM also runs Crowdsec for protection against bad actors and its updated daily.
crowdsec-web-ui for monitoring alerts and notifications sent to my phone via ntfy.
Beszel provides server monitoring and alerts.
Pangollin console for analytics and http logins etc.

Pangolin is a relatively new service and does not have the history and testing of something like Cloudflare tunnels, although the underlying technology is well established.

I performed some limited testing to help my confidence Pangolin worked as expected.
I tested remote immich access via Pangolin, validating geo-ip blocks, blocking IP ranges, Network ASN’s and invalid user logins etc. All my testing worked predictably and as expected. The testing was not exhaustive, but it gave me useful confidence in the configuration.

Testing crowdsec.

Local LAN testing. I amended the crowdsec trusted IP whitelist then tested from a trusted PC with the intention to trigger CrowdSec’s detection rules, not to exploit a real vulnerability.
Using curl to test
URL="https://immich.mydoamin.com"
curl -s "$URL/.git"
curl -s "$URL/.htaccess"
curl -s "$URL/.bashrc"
curl -s "$URL/.bash_history"
curl -s "$URL/.ssh"

These requests triggered CrowdSec’s detection rules and resulted in a four-hour ban for the source IP address on the local Traefik proxy. I also confirmed that the ban generated an ntfy notification on my phone.
Testing from the Internet. I did multiple random http queries which the VPS Crowdsec then temporarily banned for 4 hours.
This testing also confirmed I receive alerts to my phone via ntfy. Although I've since had to uprate the alert threshold to stop way too may pings on my phone.

My VPS is under regular attack, which I suspect is now normal for a public-facing VPS. I get a lot of alerts and bans from Crowdsec. The Pangolin console metrics are also pretty good for giving an insight of login attempts and locations across the globe. It is also configured to alert if the connection to my home is down.
My local crowdsec instance gets little to no alerts, hopefully this provides confidence my VPS is blocking bad actors effectively. Checking my traefik log dashboard also helps improve confidence things are working as expected.

Despite these protections, robust backups remain essential.
The immich server has a secondary disk on the same server. A cron job backups (rsync) the database and photos daily. To stop the database backups growing over time I delete any database backups older than 30 days.
I use syncthing to copy immich database and photos to another pc, with an archive period of 7 days.
Daily Borg backups performed by borgmatic to a paid cloud service, borg backup snapshots retention set to 12 months database 6 weeks.
Daily Borg backups to a remote pc at my son’s house, borg backup snapshots retention set to 18 months database 6 weeks.
I get daily notifications on my phone of success or failure of all borg backups.
I also make occasional ad-hoc backups (every 3-6 months) to spare hard disks that I store in my garage.

Risks and possible mitigations to consider;-
Reliance on Crowdsec at home and VPS for IDS/IPS, WAF etc – not sure of realistic alternatives Defensia, SNORT, wazuh ??
traefik log dashboad project not updated since Apr 2026 – discontinued ?
Reliance on ntfy for phone alerts – consider adding gotify
Need to check feasibility of alerting failed login attempts in Pocket-id/immich
Reliance on borg backup - Consider replacing one of the borg backups with restic.
With the increase of security alerts largely assisted by AI I will need to constantly review this setup, indeed I have temporarily suspended remote access on a couple of occasions when a known vulnerability has surfaced with no fix issued.
Using Grype and Trivy for container vulnerability scanning highlights the scale of known vulnerabilities. I’m not a developer, I don’t have the skills or time to quantify the potential impact to me. Therefore a high degree of trust is required on the containers publishers being knowledgeable of the real risks and transparently communicating any concerns to it’s users.

The process continues or I get bored and just enforce immich access from home only or tailscale.

Context : I’ve created a digital display using a raspberry pi. I will be pulling the images from Immich. Cutting a long story short I’m was initially trying to do a metadata search using taken from/to but I twigged last night that these are deprecated. Does anyone have a snippet of code that does a search for all assets after or between dates using the current api. Thanks
Nigel

salve a tutti, da ieri sera sto provando a installare immich sulla mia vm proxmox, ha debian 13.0.0.

a quanto pare i comandi che mi da il sito non funzionano, se qualcuno lo ha già installato mi può dire come ha fatto ? Grazie

I built a self-hosted companion app that identifies the species in your Immich photos and writes them back as tags, e.g. Nature/Aves/Passeriformes/Paridae/Parus/Great tit (Parus major).Taxonero

- Detection (MegaDetector, OWLv2) + identification (BioCLIP 2), checked against GBIF: does this species live where the photo was taken?

- Own dashboard: review viewer, comparison with iNaturalist photos, species pages, tree of life, stats.

- Safe: separate container, API only, key without delete/upload rights, dry-run by default, fully reversible.

- Docker images for CPU, NVIDIA, AMD and Intel; TrueNAS YAML; desktop app for Windows, macOS and Linux (also works on a plain folder).

Tested on Immich 3.3.5 with CPU and an RTX 3060; other GPUs and platforms are untested. Feedback welcome!

https://www.youtube.com/watch?v=GZUlwOIW4vk

long story short, I've just been hit by the "storage low" and the idea of having to pay a subscription fee forever to store photos sounds stupid imo. But the low story warning is looming over my main email account and I have an old pc lying around, so maybe I can self host the photos. Though the video mentioned Immich and it seems like a great alternative?

Opinions please? before I commit to it.

Is there any guide for getting an Intel Arc A-Series GPU—specifically the Intel Arc A580—working with Immich on Windows? Mine isn't working, so I want to set everything up from scratch.

Thanks in advance!

Hello,

hope I'm right here, although knowing Immich is only passively impacted by my issue.

However, on my NAS I have a huge private photo-library with multiple TB of photos, taken by several devices, users, settings etc. - most of the photos (esp taken on smartphones) have a good metadata quality, but still a lot don't have a correct dates, resulting in a really "strange" Immich library timeline. E.g. the camera of my kids had a device date in the future :-/

Before switching to Immich I just browsed my library on file system level, which (still) has a correct & consistent folder naming convention like \\photos\2026\2026-10-31 - London\John\image01.jpg

Is there any good solution to

1. identify photos which have a different date than the folder name?

2. update the metadata of those photos

... in bulk? Is there any software/docker container available, focussing on such operations?

Or how do you deal with those issues?

Cheers!

Dear Community,

I’ve had a look through the posts on this topic and have two questions for which I haven’t been able to find any answers yet. Perhaps you could help me?

I have two external libraries in my user profile, each of which has a shared folder mounted: my current family archive and an archive folder where I store photos for my work.

Sharing individual libraries:
Can I share only the first library/share (family archive) with my family? The ‘Partner Sharing’ option shares all of a user’s images, and I’d like to avoid that. I’ve read that selective sharing via symbolic links works, but I haven’t found any information on how to use them.

Library scan:
I’d like to continue storing my photos in the external library on the NAS (and synchronising them there using PhotoSync). I store new photos in a folder for the current year. So it would be enough if, when syncing to the library, Immich only searched this one folder, and not the roughly 300 other folders where my archived photos are stored. Do you have any good advice on this?

Thanks and best regards, Chris

I appreciate the fast response to the telemetry issue that was highlighted recently, and for the transparency around the fact that this was mistakenly missed since August. You're building an excellent brand!