Immich with Tailscale serve without exposing any Ports

[A4alli]

Hello immich community. I have created immich server with Tailscale and serve that is running perfectly without exposing any Ports. Try it and if need amendments please do so:

compose.yaml

services:
  immich-tailscale:
    image: tailscale/tailscale:latest
    container_name: immich-tailscale
    cap_add:
      - net_admin
    hostname: immich
    environment:
      - TS_AUTHKEY=tskey-xyz (change to the one you have generated)
      - TS_AUTH_ONCE=true
      - TS_SERVE_CONFIG=/config/serve.json
      - TS_STATE_DIR=/var/lib/tailscale
    networks:
      - immich
    restart: always
    volumes:
      - immich-tailscale-data:/var/lib/tailscale
      - ./serve_config/tailscale:/config
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:release
    volumes:
      - /mnt/data/photos/images:/photos/images:ro #full
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
    networks:
      - immich
    depends_on:
      - immich-tailscale
      - redis
      - database
          restart: unless-stopped

  immich-machine-learning:
    container_name: immich_machine_learning
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    volumes:
      - /mnt/data/appdata/immich/model-cache:/cache
    env_file:
      - .env
    networks:
      - immich
    depends_on:
      - immich-tailscale
    restart: unless-stopped
 
  redis:
    container_name: immich_redis
    image: redis:6.2-alpine@sha256:70a7a5b641117670beae0d80658430853896b5ef269ccf00d1827427e3263fa3
    networks:
      - immich
    restart: unless-stopped

  database:
    container_name: immich_postgres
    image: tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
    env_file:
      - .env
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      PG_DATA: /var/lib/postgresql/data
    networks:
      - immich
    volumes:
      - /mnt/data/appdata/immich/db:/var/lib/postgresql/data
    restart: unless-stopped

networks:
  immich:

volumes:
  immich-tailscale-data:

.evn First in host sudo mkdir .env

# You can find documentation for all the supported env variables at https://immich.app/docs/install/environment-variables

# The location where your uploaded files are stored
#UPLOAD_LOCATION=/mnt/data/photos/uploads

# The Immich version to use. You can pin this to a specific version like "v1.71.0"
IMMICH_VERSION=release

# Connection secrets for postgres and typesense. You should change these to random passwords
TYPESENSE_API_KEY=(change as per your desire)
DB_PASSWORD=(change as per your desire)

# IMMICH_WEB_URL=http://immich-web:3000
# IMMICH_SERVER_URL=http://immich-server:3001

# The values below this line do not need to be changed
###################################################################################
DB_HOSTNAME=immich_postgres
DB_USERNAME=postgres
DB_DATABASE_NAME=immich

REDIS_HOSTNAME=immich_redis

IMMICH_IGNORE_MOUNT_CHECK_ERRORS=true #this is necessary if you make changes after 1st successful running immich.

Serve.json:

{
  "TCP": {
    "443": {
      "HTTPS": true
    }
  },
  "Web": {
    "${TS_CERT_DOMAIN}:443": {
      "Handlers": {
        "/": {
          "Proxy": "http://immich-server:2283"
        }
      }
    }
  }
}

Goodluck

[kommandantredundant]

Thanks a lot for sharing!
I am trying to replicate your approach but I cannot reach immich in the end.
I have adjusted your /mnt/... paths to my needs, inserted my auth key, changed postgres password and fired everything up.

I successfully started all containers, immich gets registered in my tailnet but I cannot manage to access immich. I suppose something is wrong with my tailscale serve. Would you mind sharing your serve.json?

[A4alli]

sure. and sorry for being late. my apology. see above, I have updated it