Immich VPS

Who it suits

People who want Google Photos-style backup and search on a server they control. Immich moves fast, so read the release notes before each update. It isn't a backup on its own: keep another copy of your library somewhere else.

Which plan

Extreme (4 vCPU, 8 GB) is the only plan we offer it on: Immich asks for 6 GB of memory at least and recommends 8 GB, and 4 GB only works with its machine learning turned off. Storage is what to plan for: 160 GB on Extreme, shared between your originals, thumbnails and converted videos (10 to 20% on top) and the database.

What we install

Immich backs up photos and videos from your phone and organises them with faces, places and search. We use the docker-compose.yml and example.env from Immich's latest release in /opt/immich (the server, machine learning, PostgreSQL and Valkey), publish it on 127.0.0.1:2283 only, and create the admin account through Immich's API with a generated password in /root/immich-admin.txt.

From order to ready

1. Server ready. We email you when the server is running, and you can log in with SSH. The installer starts on that same first boot.
2. Installer running. It logs to /var/log/vps9-setup.log; tail -f it to watch.
3. Application ready. This can be minutes after SSH works. The installer writes its exit code to /var/lib/vps9-setup.exit; a value of 0 means installation succeeded. Immich is ready when curl http://127.0.0.1:2283/api/server/ping answers pong on the server and the login in /root/immich-admin.txt works.

What you still do

1. Point a domain such as photos.example.com at the server, allow ports 80 and 443 in the panel firewall, and run vps9-https photos.example.com.
2. Run cat /root/immich-admin.txt, log in at https://photos.example.com, and change the admin's email and password.
3. Install the Immich app on your phone, connect it to https://photos.example.com and turn on backup.

Exposure and security

Immich's own Compose file publishes port 2283 to everyone; the installer changes it to 127.0.0.1:2283, and stops rather than start it publicly if it can't. Immich normally makes the first person to sign up its admin; here the installer creates the admin before the port is reachable. vps9-https puts Caddy on 80 and 443 for your domain, which the phone app connects to.

Backups and upgrades

Updates are yours, and Immich changes often: read the release notes, then run cd /opt/immich && docker compose pull && docker compose up -d. We turn on the operating system's automatic security updates. Immich dumps its database every night into the backups folder under /opt/immich/library; copy that and your library, upload and profile folders off the server. We run the hardware, the network and the first-boot install; after that, Immich is yours to run, and we don't manage or update it for you. Off-site backups of the whole disk are an optional paid add-on; they copy the disk as it is at one moment, so keep the app's own backups as well.