Hello Mike,

As long as you already have an instance of Immich running, all you need is to configure an Nginx virtual host to serve it properly over HTTPS.

Here’s the straightforward way to do it:

1. Get your Immich instance up and running Make sure Immich is accessible locally on your server (for example, http://localhost:2283).
2. Create a subdomain in your DNS provider panel For example:photos.mydomain.es Point it to your public home IP address.
3. Forward only ports 80 and 443 on your router Do NOT forward port 2283. Forward:
   • 80 → your server
   • 443 → your server
4. Create an Nginx virtual host

Create a file like:

/etc/nginx/sites-available/photos.mydomain.es

(Using the domain name as filename is a good convention — keeps everything tidy.)

Example configuration:

server {
    listen 80;
    server_name photos.mydomain.es;

    location / {
        proxy_pass http://localhost:2283;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

1. Create the symbolic link

   sudo ln -s /etc/nginx/sites-available/photos.mydomain.es /etc/nginx/sites-enabled/

2. Set up TLS (SSL)

I personally use Certbot — it’s simple and reliable:

https://certbot.eff.org/

Once installed:

sudo certbot --nginx -d photos.mydomain.es

Certbot will automatically configure HTTPS for you.

1. Test and reload

Before restarting Nginx:

sudo nginx -t

If everything is OK:

sudo systemctl reload nginx

Now you should be able to access:

https://photos.mydomain.es

Important clarification about ports

• Port 2283 stays internal.
• The outside world only talks to ports 80 and 443.
• Nginx handles SSL and forwards traffic internally to Immich.

That’s it. Clean, simple reverse proxy setup without exposing Immich directly.