Personal Media Platform

Status: in-progress Started: June 2024
TrueNASImmichZFSTailscaleDocker

Goal

Replace cloud photo and video storage subscriptions (Google Photos, iCloud) with a self-hosted, privately controlled media platform. Full ownership of the data, no recurring subscription costs, no third-party scanning or compression.

Architecture

The platform runs as a containerized application on TrueNAS Community Edition. Remote access from phones, laptops, and family devices is handled by Tailscale — a mesh VPN that creates a private overlay network. No ports are exposed to the public internet, no router port forwarding is required, and no public DNS records point to the server.

Hardware & Software Stack

  • Server: Intel i5-6500, 32 GB RAM, TrueNAS Community Edition
  • Storage: Dedicated pool (~1.8 TiB) for the Immich photo/video library; separate ~4.5 TiB backup pool for replication
  • Application: Immich — self-hosted photo/video management with machine learning features (facial recognition, smart search, auto-tagging)
  • Network Access: Tailscale mesh VPN for secure remote access

Implementation

The initial migration started with Google Takeout — exporting the full Google Photos library and importing it into Immich. The Immich container app runs on TrueNAS, with its library stored on a dedicated ZFS dataset.

Mobile access is configured through the Immich app on iOS and Android, with automatic photo backup enabled over the Tailscale network. The app connects to the server using its Tailscale IP — no public URL, no certificate management.

Family account setup is in progress. The goal is shared albums and individual libraries for household members.

Secure Access

All remote access goes through Tailscale, a WireGuard-based mesh VPN. Each device (phone, laptop, desktop) joins the Tailscale network and can reach the Immich server directly over an encrypted tunnel.

What this means in practice:

  • No exposed ports — the server has no services listening on its public IP
  • No port forwarding — the router doesn’t need any special configuration
  • No public DNS — there’s no A record or subdomain pointing to a home IP address
  • End-to-end encryption — WireGuard tunnels between devices and the server

The server is accessible from anywhere with a Tailscale client, but completely invisible to the public internet.

Backup & Recovery

Backups use ZFS snapshots — a built-in feature of the TrueNAS filesystem.

  • Schedule: Daily recursive snapshots at midnight
  • Retention: 2-week rolling window (14 snapshots)
  • Replication: Local replication to a dedicated backup pool on separate drives
  • Library size: ~236 GiB with a matching replica on the backup pool

ZFS snapshots are copy-on-write and space-efficient — they only consume space for data that has changed since the last snapshot. The full 2-week history adds minimal overhead.

Honest gaps:

  • Restore testing has not been completed yet. The snapshots are verified to exist and replicate, but a full restore-to-new-dataset test is planned.
  • Offsite backup is not yet configured. If the physical server fails (fire, theft, hardware failure), the backup pool on the same machine doesn’t help. Cloud or remote replication is a future priority.

Lessons Learned

This section will be updated with real reflections as the system matures.

Future Improvements

  • Offsite backup: Cloud replication (Backblaze B2 or similar) or replication to a second physical location
  • Restore testing: Documented disaster recovery procedure with verified restore steps
  • Family onboarding: Complete shared album setup and individual library configuration for household members
  • Hardware redundancy: Consider a second server or at minimum a UPS for clean shutdowns during power outages
  • Monitoring: Integrate with the Pico OLED monitor or Telegram bot for backup failure alerts