# Building a Self-Hosted Photo Library That Survives Real Life

A self-hosted photo library offers something cloud services rarely do: complete control over originals, metadata, backups, and retention. My setup runs Immich on a small Linux server with mirrored storage, while phones upload automatically over Wi-Fi. The interface feels familiar—timeline browsing, albums, search, and map views—but the original files remain accessible as ordinary JPEG, HEIC, and RAW files.

## Storage and Deployment

The application runs in Docker Compose, with PostgreSQL storing metadata and a separate dataset holding photo files. Keeping the database and library on distinct volumes makes recovery easier and prevents container upgrades from touching originals. Hardware acceleration is useful for thumbnail generation and video transcoding, but a modern quad-core CPU is adequate for a modest household library.

```yaml
services:
  immich-server:
    image: ghcr.io/immich-app/immich-server:release
    volumes:
      - /srv/photos:/usr/src/app/upload
    env_file: .env
    restart: unless-stopped
```

## Importing Without Losing Metadata

The first import was deliberately staged rather than copying two decades of files at once. I normalized directory permissions, removed exact duplicates by checksum, and verified capture dates with ExifTool before indexing each yearly folder. This mattered because screenshots, scanned photographs, and exported social-media images often lack reliable EXIF timestamps and otherwise appear in the wrong place on the timeline.

## Remote Access and Security

The library is not exposed directly to the public internet. Remote devices connect through a private mesh VPN, and the web service listens only on the internal network behind a reverse proxy. Administrative accounts use unique passwords, registrations are disabled after onboarding, and updates are tested against a recent database snapshot before deployment.

## Backups Are the Product

Disk mirroring protects against drive failure, not deletion, corruption, theft, or a bad upgrade. Every night, encrypted incremental backups are written to another machine, and a second copy is pushed off-site. I also perform quarterly restore tests into a temporary directory; a backup that has never been restored is only an optimistic hypothesis.

## Daily Use

The result is pleasantly uneventful: phones upload in the background, family members share albums, and searches return useful results without sending private images to a third party. Self-hosting still requires maintenance, but stable storage paths, conservative upgrades, and tested backups keep that work predictable. The real success is that nobody in the household needs to understand the infrastructure to trust the library.