Updated: October 2, 2026

Immich & Photo Management Guide#

1. Synology Photo Workflow#

Album Creation#

1. In Synology Photo:
   • Move images from Personal space to Shared Space.
   • Create an album with the moved images.

2. Immich Management#

Update Attempt — 2026-10-02#

• Host: HP1GPU (10.1.2.231), compose directory /home/marc/docker-compose/immich.
• Attempted stable upgrade from v3.1.0 to v3.2.4, including CUDA machine learning; PostgreSQL and Valkey images were unchanged.
• Pre-upgrade database dump: /mnt/Immich/Immich-Uploads/upgrade-backups/2026-10-02-v3.2.4/database.sql.gz. Gzip integrity check passed and the SQL dump completion marker was verified.
• Original compose file preserved as docker-compose.yaml.pre-v3.2.4; stable image override saved as docker-compose.stable-v3.2.4.yaml.
• Server failed to start with PostgreSQL password authentication failure. Restored the original compose file and recreated both application containers with local v3.1.0 images using docker-compose.recovery-v3.1.0.yaml.
• The same database authentication error persisted after rollback to v3.1.0, indicating an authentication/configuration issue upon container recreation. Following the user’s restart through their 1Password workflow, the API responded successfully with v3.1.0 and pong, with zero application container restarts. The stable upgrade remains pending. Credential inspection requires explicit authorization under the vault agent instructions.
• Root filesystem has approximately 3.2 GB free (95% used); old and new images retained. No database restore or credential changes performed.

External Libraries & Albums#

1. Scan Libraries: Settings > Administration > External Library > Scan All Libraries.
2. Monitor Progress: Jobs > Check when the job is finished.
3. Create Album: Main page > Albums > Create Album > Select Photos.
4. Sharing: Share with Nadine.

Backup Strategy#

• Photo ingress: The HP1Photos share on the Synology VM is the source of truth and is pushed one-way to the UNAS-Pro Photos share by the Linux sync hosts.
• Immich: Immich reads the photo library from the UNAS-Pro Photos share.
• UNAS-Pro protection: TrueNAS nodes pull the Photos and Immich data from UNAS-Pro according to the schedules documented in Unifi UNAS-Pro Backup Strategy.
• Manual sync: Run pushphotos on HP1GPU (10.1.2.231) or HP1Docker (10.1.2.202) when a sync is required.

See Unifi UNAS-Pro Backup Strategy#3.2 Synology Photos to UNAS-Pro Push for the mounts, script, exclusions, and deletion policy.

3. Cloudflare Zero Trust: Mobile App Bypass#

Setup Cloudflare bypass access to allow the Immich mobile app to connect without manual Google Auth browser prompts. Reference: Cloudflare Tunnel Guide

Infrastructure Setup#

1. Set up the Cloudflare connector via Docker.
2. Configure the Application to secure the connector via Google account.
3. Add the route for Immich (immich.proxmox.app):
   • Path: Zero Trust > Network > Connector > Edit > Published application routes > Add route.
   • Type: http
   • URL: 10.1.2.231:2283

Create Service Token#

1. Go to Zero Trust > Access Control > Service Credentials.
2. Click Create Service Token.
3. Name: Immich Mobile Access.
4. Duration: Non-expiring.
5. Important: Copy the Client ID and Client Secret to 1Password immediately.

Configure Access Policy#

1. Go to Zero Trust > Access Control > Applications.
2. Edit proxmox.app - Google Auth > Policies > Create new policy.
3. Policy Name: Immich Mobile App.
4. Action: Bypass.
5. Rule: Include > Selector > Service Token > Immich Mobile Access.

Mobile App Configuration#

1. In the Immich Mobile App: Settings > Advanced > Custom proxy headers.
2. Create the first header:
   • Header name: CF-Access-Client-id
   • Header value: [Your_Client_ID_From_1Password]
3. Create the second header:
   • Header name: CF-Access-Client-Secret
   • Header value: [Your_Client_Secret_From_1Password]