How do you expose the service for your SO when away from home? Do you use tailscale/cloudflare tunnel/vpn? public port on your router? I've been trying tailscale for myself, but there's a hair more friction than my SO would accept.

Not op, I use cloudflare tunnel. The Immich mobile app supports "local" and "external" connection settings, so it can connect to the Immich instance directly when on home wifi, and use the tunnel when out and about.

I use Tailscale for this, always connected and Immich pointing at the TS IP. I haven’t yet made the jump to full syncing, so I have a manually curated library of photos that I access anywhere but I am planning on starting to test this feature soon (I take a lot of junk throwaway photos with the phone and don’t want to sync everything). I’ll have to see how it best works for me.

But Immich is a great app, minimal to no fuss setting it up in a container on my NAS. My only potentially unfounded concern is when I upgrade the images. They changed the different component containers images over time, sometime with breaking changes. So I always half expect that an upgrade will screw up the setup and I’ll have to start from scratch with the indexing.

Not op, but a combination of tailscale and a public VM is my setup for this. VM from oracle is free btw.

Not OP, Tailscale is easiest, quickest, and free up to 100 devices as of today. It also has a feature to provide a public URL if needed, or can be run with Cloudflare Tunnel at the same time.

As other's have already mentioned, currently I am using Tailscale. But I plan to somewhere in the future change that to something a bit more controlled by myself. Like a self hosted Wireguard VPN on some VPS.

I was also thinking about just reverse proxying my local instance to some public domain. But currently do not trust immich to be safe enough to allow for public exposure.

I use tailscale with split tunneling so that traffic to the home range goes... home.

That minimizes battery impact. This missus hasn't complained. Yet.