Self-Hosted Family Photo Archiving: Securing Immich on a VPS with Encrypted Cloud Storage via Rclone Crypt

Introduction: The Modern Dilemma of Family Photo Storage

In an era dominated by digital memories, protecting family photographs has become both a priority and a technical challenge. While mainstream public cloud providers offer convenience, they come with growing concerns over data privacy, shifting pricing tiers, and strict storage caps. For business-minded individuals and privacy advocates alike, relying entirely on third-party ecosystems introduces long-term risks regarding data sovereignty.

The solution lies in a self-hosted architecture that balances utility with absolute privacy. By combining Immich—a high-performance, feature-rich alternative to Google Photos—with a Virtual Private Server (VPS) and Rclone Crypt, you can build an enterprise-grade media archive. This setup allows you to leverage cheap, scalable cloud object storage while ensuring that your files are encrypted locally before ever leaving your server.

Understanding the Architectural Components

To build a resilient and secure photo storage system, we rely on three core pillars, each serving a distinct structural purpose:

Immich (The Frontend & Media Engine): An open-source, self-hosted photo and video management solution. It features an intuitive web interface, native mobile applications with background backup, multi-user support, and advanced AI-powered facial recognition and object detection.
Virtual Private Server (VPS): Acts as the compute engine. Because media processing (such as video transcoding and machine learning) is compute-heavy, the VPS serves as the centralized node running the application logic, while keeping local storage requirements to a minimum.
Rclone Crypt (The Secure Storage Layer): Rclone is a command-line program to manage files on cloud storage. Its "Crypt" feature acts as a transparent, zero-knowledge encryption layer. When Immich writes data to the file system, Rclone encrypts it on-the-fly before syncing it to your cloud provider (e.g., AWS S3, Backblaze B2, or Google Cloud Storage).

Data Sovereignty Principle: By encrypting data at the file-system level via Rclone Crypt, the cloud storage provider only sees obfuscated, unreadable data chunks. Even in the event of a provider-side data breach, your family photos remain completely secure.

Prerequisites and System Requirements

Before initiating the deployment, ensure your infrastructure meets the following baseline requirements:

VPS Specifications: Minimum 2 vCPUs, 4GB RAM (highly recommended for Immich's machine learning features), and a modern Linux distribution (Ubuntu 22.04 LTS or newer preferred).
Cloud Storage Account: An account with an object storage vendor supporting S3-compatible APIs, Backblaze B2, or similar scalable storage.
Domain Name & SSL: A dedicated domain or subdomain pointed to your VPS IP address to secure traffic via HTTPS.
Docker Ecosystem: Docker and Docker Compose installed on the host VPS.

Step 1: Configuring Rclone and the Encrypted Remote

The first phase involves setting up the secure transport pipeline. You must install Rclone and configure it to establish an encrypted bridge to your cloud storage backend.

First, access your VPS via SSH and install Rclone. Once installed, initiate the configuration wizard by executing rclone config. Follow these specific parameters:

1. Create the Base Remote

Select the option to create a new remote and point it to your cloud provider (e.g., naming it remote-s3). Input your access keys, region, and endpoint details as provided by your cloud infrastructure vendor.

2. Create the Encrypted Overlay (Rclone Crypt)

Run rclone config again to create a second remote, selecting type crypt. When prompted for the source remote, point it to your newly created base remote and target bucket (e.g., remote-s3:my-family-photos). Choose to generate strong, unique passwords for both the filename encryption and the passphrase encryption. Critical Note: Document these keys outside of your server infrastructure; losing them results in total data loss.

Step 2: Mounting the Cloud Storage via FUSE

To allow Immich to interface with the encrypted cloud storage seamlessly, Rclone must mount the crypt remote as a local directory on your VPS file system.

Create a dedicated mount point, for instance, /mnt/immich-secure. Execute the following optimized mount command to balance performance and stability:

rclone mount crypt-remote: /mnt/immich-secure 
  --allow-other 
  --vfs-cache-mode writes 
  --vfs-cache-max-age 24h 
  --vfs-cache-max-size 10G 
  --dir-cache-time 1h 
  --daemon

This command mounts your remote securely in the background (--daemon), allows Docker containers to access the path (--allow-other), and establishes a local VFS cache to handle write operations smoothly without bottlenecking the application performance during heavy uploads.

Step 3: Deploying Immich via Docker Compose

With the secure storage directory active, you can now deploy the Immich stack. Navigate to your deployment directory and download the official production assets, including the docker-compose.yml and .env template files.

Modify the .env file to configure database credentials, time zones, and vital system configurations. The most critical modification occurs within the docker-compose.yml file, where you must explicitly map Immich’s upload directory to your Rclone mount point:services: immich-server: volumes: - /mnt/immich-secure:/usr/src/app/upload immich-microservices: volumes: - /mnt/immich-secure:/usr/src/app/upload

Run docker compose up -d to initialize the suite of services, including the core server, microservices engine, Redis cache, and the PostgreSQL database.

Step 4: Hardening Security and Network Access

Operating a private cloud repository requires stringent network security. To protect your data in transit and shield your backend from unauthorized exposure, implement the following operational security protocols:

1. Reverse Proxy Implementation

Never expose Immich directly via its default port. Use a reverse proxy such as Nginx, Caddy, or Traefik to handle incoming traffic, enforce modern TLS encryption protocols (TLS 1.3), and automatically manage Let's Encrypt certificates.

2. Firewall Hardening

Utilize Uncomplicated Firewall (UFW) or cloud-level security groups to block all unnecessary external ports. Only ports 80 (HTTP redirect) and 443 (HTTPS) should be exposed to the public internet alongside your hardened SSH port.

3. Immich Account Governance

Upon initial login, immediately establish the primary administrative account. Enforce Multi-Factor Authentication (MFA) for all family members granted access to the instance, ensuring that compromised credentials do not jeopardize the integrity of the collective archive.

Maintenance and Optimizing Performance

Managing a decoupled storage infrastructure means balancing local compute with remote storage latencies. To ensure system longevity, incorporate these maintenance practices:

Automate the Mount Script: Implement a systemd service file to automatically mount the Rclone crypt directory on VPS system reboots, ensuring zero downtime for background mobile backups.
Monitor VFS Cache: Periodically check the local disk space of your VPS. Ensure the Rclone write cache does not overwhelm the local root storage disk during large bulk imports.
Database Backups: While your assets are securely encrypted in the cloud, always run a nightly cron job to back up the Immich PostgreSQL database metadata, storing it securely in an offsite location.

Conclusion: Total Data Ownership Realized

By leveraging a high-performance compute node via a VPS, the consumer-grade elegance of Immich, and the cryptographic security of Rclone Crypt, you establish an uncompromising storage architecture. You effectively isolate your family memories from corporate surveillance, control your long-term storage expenditures, and maintain complete operational control. This setup exemplifies how modern open-source utilities can be orchestrated to deliver enterprise-level privacy to personal data management.