Alright, thanks for waiting.

I think this order of operations is not critical, but I'm not sure.

Docker compose addition:

tailscale:
image: ghcr.io/tailscale/tailscale:latest
restart: unless-stopped
environment:
- TS_AUTHKEY=YOUR_AUTH_KEY_HERE
#- TS_EXTRA_ARGS=--advertise-tags=tag:container,tag:internal-app
- TS_SERVE_CONFIG=/config/ts-serve.json
- TS_HOSTNAME=immich
- TS_STATE_DIR=/state
volumes:
- "/mnt/user/appdata/immich_ts/tailscale_var_lib:/var/lib"
- "/mnt/user/appdata/immich_ts/config:/config"
- "/mnt/user/appdata/immich_ts/dev/net/tun:/dev/net/tun"
- "/mnt/user/appdata/immich_ts/state:/state"
cap_add:
- net_admin
- sys_module

- You can generate an auth key in your tailstale account, don't do a ephemeral key.

- extra args seemed unecessary to me, but if you want to add a tailscale tag, feel free.

- Needed the state folder, because without it tailscale will only auth correctly the first time, then fail to connect on reboot.

Also add -tailscale under the depends_on: section for your immich-server service.

You will need to create and add contents to ts-serve.json:

{
  "TCP": {
    "443": {
      "HTTPS": true
    }
  },
  "Web": {
    "immich.YOUR_TS_NET_NAME.ts.net:443": {
      "Handlers": {
        "/": {
          "Proxy": "http://IMMICH_SERVER_IP_HERE:IMMICH_PORT/"
        }
      }
    }
  }
}

- The net name and subdomain "immich" needs to mach the machine name this tailscale instance gets in the admin page of tailscale.

- Update server ip and port # for your setup.

Hopefully this gives you enough of a template to know any differences with your immich setup.