Knossos

That’s always a danger.

You could host the server on its own vlan and use tailscale to tunnel from a VPS to your server. This way your IP isn’t exposed to the public. You can also add crowdsec or similar on the VPS.

I do the same thing with traefik on my dirt cheap VPS.

You could try wormhole. It makes a direct connection.

You can also use something called wormhole. Very handy tech.

Looks very cool! Added it to my home lab to-do!

On my Fritzbox, I needed to add all my Subdomains to a list under:

DNS Rebind Protection Your FRITZ!Box suppresses DNS responses that refer to IP addresses in its own home network (DNS rebind protection). Here you can specify exceptions for which DNS rebind protection should not apply. Do this by entering the complete name of the host (domain name including the subdomain) in the list.

That’s under network settings, advanced. In case you have that.

I use a HDD for my immich instance. I have a feeling it might have made the initial import process quicker (complete google photos dump). However, general usage, I have found zero bottlenecks.