Step 1 – Verify Immich Works

Your server’s IP address and root password are shown in the Server Information section on the Overview tab of your server in the client portal. The application settings you entered when ordering, passwords included, are shown in the Immich Credentials card on the same tab. Immich is set up automatically when the server is created: the administrator account is created with the email and password you entered during the order. Open your browser and go to:

https://your.server.ip

HTTPS without a domain. Your server gets a browser-trusted Let’s Encrypt certificate for its IP address on first boot, so the page opens without a warning. Certificates of this kind are short-lived (about six days) and renew automatically. If your server is not reachable from the internet on port 80 (for example, it sits behind a router), the certificate cannot be issued – in that case use http://your.server.ip instead.

Setup takes about half a minute, and the client portal shows the server as ready when it finishes. Until then the web interface does not answer – Immich opens to visitors only after your administrator account exists.

Immich login:

• Email: the Immich Admin Email you entered during the order
• Password: the Immich Admin Password you entered during the order

After the first login Immich greets you with Welcome, Admin and offers to set a few common settings (theme, language and others) – go through them or change them later. There is no public sign-up page: additional users are created by the administrator in the Administration panel.

If you placed the server behind a VyOS router on a private network, the server has only a private address, so it does not get the IP certificate. Reach Immich on the private address through a VPN on the router (WireGuard or OpenVPN, on the router’s Configuration tab), or forward ports 80 and 443 (and 22 for SSH) to the server on the router’s Configuration tab (Port forwarding). A VPN is the recommended way for a personal photo library. For a trusted HTTPS certificate, point a domain to the router’s public address (Step 3).

Firewall. If you turn on the Firewall for this server in the client portal, allow incoming TCP port 80 in its rules, along with 443 (HTTPS). Certificates renew over port 80 – the IP certificate every few days – and without that rule the certificate expires and the browser starts showing a warning.

Step 2 – Install Mobile App (Optional)

Immich has mobile apps for automatic photo and video backup:

• iOS – download Immich from the App Store
• Android – download Immich from Google Play or F-Droid

In the app, enter your server URL and log in with the email and password from your order:

https://your.server.ip

Enable Background Backup in the app settings to automatically upload new photos and videos.

Step 3 – Configure Domain and SSL (Optional)

Immich already runs behind Nginx with a certificate for the server’s IP address. To use your own domain:

1. Create an A record in your DNS settings pointing your domain to the server IP
2. Wait for DNS propagation (usually a few minutes)
3. Connect via SSH, set the domain name in the Nginx site and request a certificate for it:

ssh root@your.server.ip

sed -i 's/server_name _;/server_name your-domain.com;/' /etc/nginx/sites-available/immich
nginx -t && systemctl reload nginx

certbot --nginx -d your-domain.com

Replace your-domain.com with your actual domain. Certbot configures HTTPS for the domain and renews the certificate automatically. After setup, update the server URL in your mobile app to https://your-domain.com.

Fail2Ban – Brute-Force Protection

Your server comes with Fail2Ban pre-configured to protect SSH from brute-force attacks.

Useful commands:

# Check banned IPs
fail2ban-client status sshd

# Unban an IP
fail2ban-client set sshd unbanip 1.2.3.4

If you accidentally lock yourself out, open the Console on your server’s Overview tab in the client portal and unban your IP.

Storage Management

Photos and videos are stored in /opt/immich/upload/. A typical phone photo is 3-5 MB; videos are much larger. Immich also generates thumbnails and ML embeddings (~20% overhead). To check disk usage:

df -h /
du -sh /opt/immich/upload/

Service Management

Immich runs as a systemd service via Docker Compose:

# Check container status
cd /opt/immich && docker compose ps

# View logs
cd /opt/immich && docker compose logs -f

# Restart Immich
systemctl restart immich

Updates

To update Immich to the latest version:

cd /opt/immich
curl -fsSL https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml -o docker-compose.yml
docker compose pull
docker compose down && docker compose up -d

Always check the release notes before updating for any breaking changes.

Backups

Back up two things: the upload folder and the database:

# Database backup
docker exec -t immich_postgres pg_dumpall -c -U postgres > /opt/immich/db_backup.sql

# Database restore (if needed)
cat /opt/immich/db_backup.sql | docker exec -i immich_postgres psql -U postgres

Software Included

• Immich Documentation: immich.app/docs
• Immich GitHub: github.com/immich-app/immich