Self-Hosting Your Photos with Immich

Introduction

By now our home lab has a solid spine: a Docker host and, from part 3, network-wide DNS plus a Caddy reverse proxy handing out tidy *.home.arpa addresses. Time to put something genuinely useful on it - something you’d otherwise pay a subscription for.

This post sets up Immich (source on GitHub): a self-hosted photo and video manager that’s a remarkably close replacement for Google Photos. Auto-backup from your phone, albums, search, face recognition - but the photos live on your disk, in your house, with no monthly fee and nobody scanning them. By the end you’ll have it running at http://photos.home.arpa, with the phone app backing up automatically and the Intel N100’s GPU doing the heavy lifting for search.

It’s also a milestone for the series: Immich is our first multi-container application, so it’s the perfect moment to see how several containers cooperate as one service.

What Immich Looks Like (Four Containers, One App)

Everything we’ve run so far - Portainer, AdGuard, Caddy - was a single container. Immich is four, and they each have a job:

• immich-server - the web app and API you actually interact with. This is the one Caddy talks to.
• immich-machine-learning - the brains behind search and face recognition. It runs AI models locally; nothing leaves your network.
• database (PostgreSQL) - stores all the metadata: albums, faces, locations, who’s who. Note it’s a special Postgres image with vector extensions baked in, which Immich needs - don’t swap it for plain postgres.
• redis (Valkey) - a fast in-memory cache and job queue.

This is where the two-network idea from part 3 really earns its keep. The server joins two networks: reverse-proxy (so Caddy can reach it) and a private immich network (so it can reach the database, redis, and ML). The other three join only the private immich network - they never need to be reachable from the proxy or the outside world. Clean separation, by design.

Step 1: The Compose File

Following our convention, Immich gets its own folder:

1
mkdir -p ~/apps/immich

Create ~/apps/immich/docker-compose.yml. It’s longer than anything we’ve written so far, but every block is one of the four services above:

1
services:
2
  immich-server:
3
    container_name: immich
4
    image: ghcr.io/immich-app/immich-server:v2.7.5
5
    volumes:
6
      - ./library:/data # where your photos and videos live
7
      - /etc/localtime:/etc/localtime:ro
8
    ports:
9
      - 2283:2283 # published for the mobile app - explained in "Back Up Your Phone" below
10
    env_file:
11
      - .env
12
    depends_on:
13
      - redis
14
      - database
15
    restart: unless-stopped
16
    devices:
17
      - /dev/dri/renderD128:/dev/dri/renderD128 # hardware acceleration
18
    networks:
19
      - reverse-proxy # so Caddy can reach it
20
      - immich # so it can reach the db / redis / ml
21

22
  immich-machine-learning:
23
    container_name: immich_machine_learning
24
    image: ghcr.io/immich-app/immich-machine-learning:v2.7.5-openvino
25
    env_file:
26
      - .env
27
    restart: unless-stopped
28
    devices:
29
      - /dev/dri/renderD128:/dev/dri/renderD128
30
    dns:
31
      - 127.0.0.11 # Docker's internal DNS...
32
      - 8.8.8.8 # ...with a public fallback so it can download models
33
    networks:
34
      - immich
35

36
  redis:
37
    container_name: immich_redis
38
    image: docker.io/valkey/valkey:9
39
    healthcheck:
40
      test: redis-cli ping || exit 1
41
    restart: unless-stopped
42
    networks:
43
      - immich
44

45
  database:
46
    container_name: immich_postgres
47
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
48
    environment:
49
      POSTGRES_PASSWORD: ${DB_PASSWORD}
50
      POSTGRES_USER: ${DB_USERNAME}
51
      POSTGRES_DB: ${DB_DATABASE_NAME}
52
      POSTGRES_INITDB_ARGS: "--data-checksums"
53
    volumes:
54
      - ./postgres:/var/lib/postgresql/data
55
    shm_size: 128mb
56
    restart: unless-stopped
57
    networks:
58
      - immich
59

60
networks:
61
  reverse-proxy:
62
    name: reverse-proxy
63
  immich:
64
    name: immich
65
    driver: bridge

A few things worth pointing out:

• ./library is where your actual photos and videos end up. It’s a folder right next to the compose file - easy to find, easy to back up.
• depends_on tells Docker to start redis and the database before the server.
• Pinned versions everywhere, same habit as the rest of the series. Updating Immich is a deliberate bump of these tags, never a surprise.

Step 2: The .env File

The compose file references a few secrets and settings with ${...}. Those live in ~/apps/immich/.env, right next to it:

1
TZ=Europe/Warsaw
2

3
DB_DATABASE_NAME=immich
4
DB_USERNAME=immich
5
DB_PASSWORD=use-a-long-random-password-here

Generate a real password rather than typing one - openssl rand -base64 24 is perfect. As always, this file is for secrets and stays out of Git (we’ll handle that in the last step).

Step 3: Hardware Acceleration on the N100

Remember the Intel N100 from part 1? It has an integrated GPU, and this is where it pays off. The devices and -openvino image you saw above hand that GPU to Immich, so face recognition and smart search run on hardware built for it instead of pinning the CPU.

You can confirm your N100’s GPU is exposed to Linux with:

1
ls -l /dev/dri/renderD128

If that file exists, you’re set.

Step 4: First Launch

From the Immich folder, bring all four containers up at once:

1
cd ~/apps/immich
2
docker compose up -d

The first start takes a minute - it’s pulling four images and initialising the database. Once it settles, Immich is running and listening on port 2283 - but rather than poke at it by IP, let’s give it a proper address first.

Step 5: Add It to Caddy

Here’s the moment the groundwork from part 3 pays off. We want http://photos.home.arpa to reach Immich. Open your ~/apps/proxy/Caddyfile and add one block inside the existing http://*.home.arpa { ... } site:

1
@photos host photos.home.arpa
2
handle @photos {
3
  reverse_proxy immich:2283
4
}

That’s the entire change. reverse_proxy immich:2283 works because Caddy and the Immich server share the reverse-proxy network and can find each other by container name - exactly the pattern from part 3.

Reload Caddy to pick up the new route:

1
docker compose restart caddy

Now open http://photos.home.arpa in your browser. You’ll be greeted by a setup screen to create the admin account - this first user is the owner of the instance. Make it, log in, and you’ve got an empty photo library waiting to fill - reachable at a name you can actually remember.

Step 6: Back Up Your Phone

The real magic of Immich is the mobile app. Install Immich from the App Store or Play Store, and when it asks for the server URL, give it your new address:

1
http://photos.home.arpa

Log in with your admin account, then enable backup and pick which albums to sync. From now on, every photo you take is automatically copied to your home lab - the Google Photos experience, minus Google.

1
http://192.168.68.110:2283

Step 7: Back Up the Data That Matters

Your home lab’s config is already safe in Git. But your photos are not config - they’re irreplaceable, and this is exactly the data the SATA backup drive from part 1 was for. Two folders hold everything Immich cares about:

• ~/apps/immich/library - the original photos and videos.
• ~/apps/immich/postgres - the database: albums, faces, the lot.

Both need backing up to a separate disk (and ideally an off-site copy too - the 3-2-1 rule). A simple recurring job that copies library and a database dump to /mnt/storage/backups is enough to start. Whatever you do, test that you can restore it before you trust it with the only copy.