Yeah, sharing is one of the big problems with Immich. You either need to expose your whole instance to make share links publicly accessible (and there's no way to secure user accounts with 2FA), or create user accounts for the people you want to share with and/or invite them and set up your VPN for them to access the shares.

There's https://github.com/alangrainger/immich-public-proxy, which is a weird workaround (it's a separate gallery frontend that syncs with your instance to only expose this specific service, so you can keep your Immich instane private).

Is there a way to sponsor a feature request to improve the sharing and user auth story? Passkeys could be used here (versus MFA/2FA), because if the passkey is lost, you can simply delete it and have the known user go through the onboarding flow again to create a new passkey.