Immich & Photo Management Guide#

1. Synology Photo Workflow#

Album Creation#

1. In Synology Photo:
   • Move images from Personal space to Shared Space.
   • Create an album with the moved images.

2. Immich Management#

External Libraries & Albums#

1. Scan Libraries: Settings > Administration > External Library > Scan All Libraries.
2. Monitor Progress: Jobs > Check when the job is finished.
3. Create Album: Main page > Albums > Create Album > Select Photos.
4. Sharing: Share with Nadine.

Backup Strategy#

• MacStudio: Use Carbon Copy Cloner to sync HP1 Photos to UNAS.
• UNAS: Backup the Immich folder from UNAS to HP1, HP7, and HP11.

3. Cloudflare Zero Trust: Mobile App Bypass#

Setup Cloudflare bypass access to allow the Immich mobile app to connect without manual Google Auth browser prompts. Reference: Cloudflare Tunnel Guide

Infrastructure Setup#

1. Set up the Cloudflare connector via Docker.
2. Configure the Application to secure the connector via Google account.
3. Add the route for Immich (immich.proxmox.app):
   • Path: Zero Trust > Network > Connector > Edit > Published application routes > Add route.
   • Type: http
   • URL: 10.1.2.231:2283

Create Service Token#

1. Go to Zero Trust > Access Control > Service Credentials.
2. Click Create Service Token.
3. Name: Immich Mobile Access.
4. Duration: Non-expiring.
5. Important: Copy the Client ID and Client Secret to 1Password immediately.

Configure Access Policy#

1. Go to Zero Trust > Access Control > Applications.
2. Edit proxmox.app - Google Auth > Policies > Create new policy.
3. Policy Name: Immich Mobile App.
4. Action: Bypass.
5. Rule: Include > Selector > Service Token > Immich Mobile Access.

Mobile App Configuration#

1. In the Immich Mobile App: Settings > Advanced > Custom proxy headers.
2. Create the first header:
   • Header name: CF-Access-Client-id
   • Header value: [Your_Client_ID_From_1Password]
3. Create the second header:
   • Header name: CF-Access-Client-Secret
   • Header value: [Your_Client_Secret_From_1Password]