docker-swag config (tested + working)

[Snuupy]

working as of 2023-12-07:

## Version 2023-12-07
# make sure that your dns has a cname set for immich
# if immich is running in bridge mode and the container is named "immich", the below config should work as is
# if not, replace the line "set $upstream_app immich;" with "set $upstream_app <containername>;"
# or "set $upstream_app <HOSTIP>;" for host mode, HOSTIP being the IP address of immich

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name immich.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 50000M;

    # Compression
    gzip on;
    gzip_comp_level 2;
    gzip_min_length 1000;
    gzip_proxied any;
    gzip_types
        application/javascript
        application/json
        font/truetype
        image/svg+xml
        text/css
        text/html;
    gzip_vary on;
    gunzip on;

    access_log off;

    location / { # web
        # include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;

        proxy_buffering off;
        proxy_buffer_size 16k;
        proxy_busy_buffers_size 24k;
        proxy_buffers 64 4k;
        proxy_force_ranges on;

        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_redirect off;
        
        set $upstream_app immich-server;
        set $upstream_port 3001;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }

}

[EnochPrime]

This is my working version. I don't need to hard code the server address. Difference to note:

• Didn't include the gzip settings yet
• Common proxy settings moved up
• Removed duplicate set_header host
• Proxy header after proxy pass (does this matter?)
• Different app names due to swarm deployment

## Version 2023/01/04
server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name immich.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 50000M;
    proxy_buffering off;
    proxy_buffer_size 16k;
    proxy_busy_buffers_size 24k;
    proxy_buffers 64 4k;
    proxy_force_ranges on;
    proxy_http_version 1.1;

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    #include /config/nginx/authelia-server.conf;

    location / {
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        #include /config/nginx/authelia-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app immich_app;
        set $upstream_port 3000;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

    }

    location /api {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app immich_server;
        set $upstream_port 3001;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        rewrite /api/(.*) /$1 break;
    }
}

[SitramSoft]

I don't know why this is not working on my side....

When I look in portainer, the only port exported by the immich containers is 2283.

In your config, location / is mapped to immich_web:3000 and /api to immich_server:3001.

Looking at swag error log, it shows that it cannot resolve these names since they look like docker container names not dns. The swag container runs in the same instance as immich containers.

I tried to change the names to VM host IP address which runs the docker containers, but it doesn't work either.

The only way I was able to make it work is to remove the /api location and change in the / location to point to VM IP address and port to 2283.

[Snuupy]

post your compose file and reverse proxy config

[SitramSoft]

Extract from my docker-compose file. It contains other containers as well, which I removed them.

I already had a redis and postgress container up, so I addapted the immich_containers to use them.

All containers, including swag, run on a VM with ip 192.168.0.101 inside a proxmox host.

I included my existing nginx conf file from SWAG container. With this one I can access from outside trough a subdomain from duckdns.

  immich-server:
    container_name: immich_server
    image: altran1502/immich-server:release
    entrypoint: ["/bin/sh", "./start-server.sh"]
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
    env_file:
      - .env
    environment:
      - NODE_ENV=production
    depends_on:
      - redis
      - db_postgress
    restart: always

  immich-microservices:
    container_name: immich_microservices
    image: altran1502/immich-server:release
    entrypoint: ["/bin/sh", "./start-microservices.sh"]
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
    env_file:
      - .env
    environment:
      - NODE_ENV=production
    depends_on:
      - redis
      - db_postgress
    restart: always

  immich-machine-learning:
    container_name: immich_machine_learning
    image: altran1502/immich-machine-learning:release
    entrypoint: ["/bin/sh", "./entrypoint.sh"]
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
    env_file:
      - .env
    environment:
      - NODE_ENV=production
    depends_on:
      - db_postgress
    restart: always

  immich-web:
    container_name: immich_web
    image: altran1502/immich-web:release
    entrypoint: ["/bin/sh", "./entrypoint.sh"]
    env_file:
      - .env
    restart: always

  immich-proxy:
    container_name: immich_proxy
    image: altran1502/immich-proxy:release
    environment:
      # Make sure these values get passed through from the env file
      - IMMICH_SERVER_URL
      - IMMICH_WEB_URL
    ports:
      - 2283:8080
    depends_on:
      - immich-server
    restart: always #

redis:
    container_name: redis
    image: redis
    user: 1000:1000
    environment:
      - TZ=Europe/Bucharest
    command: redis-server /usr/local/etc/redis/redis.conf
    ports:
       - 6379:6379
    healthcheck:
      test: redis-cli -h 192.168.0.101 -p 6379 ping | grep PONG
      interval: 30s
      timeout: 10s
      retries: 5
    volumes:
       - /home/sitram/docker/redis:/data
       - /home/sitram/docker/redis/config:/usr/local/etc/redis
    restart: unless-stopped

  db_postgress:
    container_name: db_postgress
    image: postgres:13
    user: 1000:1000
    environment:
      - POSTGRES_USER=xx
      - POSTGRES_PASSWORD=xx
    ports:
      - 5432:5432
    healthcheck:
      test: pg_isready -h 192.168.0.101 -p 5432 -U xx || exit 1
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s
    volumes:
      - /home/sitram/docker/postgres:/var/lib/postgresql/data:rw
    restart: unless-stopped

COMPOSE_PROJECT_NAME=serenity


###################################################################################
# Database
###################################################################################

DB_HOSTNAME=db_postgress
DB_USERNAME=xx
DB_PASSWORD=xx
DB_DATABASE_NAME=immich

# Optional Database settings:
# DB_PORT=5432

###################################################################################
# Redis
###################################################################################

REDIS_HOSTNAME=redis

# Optional Redis settings:
REDIS_PORT=6379
# REDIS_DBINDEX=0
# REDIS_PASSWORD=
# REDIS_SOCKET=

###################################################################################
# Upload File Location
#
# This is the location where uploaded files are stored.
###################################################################################

UPLOAD_LOCATION=/home/sitram/data/photos_immich

###################################################################################
# JWT SECRET
#
# This JWT_SECRET is used to sign the authentication keys for user login
# You should set it to a long randomly generated value
# You can use this command to generate one: openssl rand -base64 128
###################################################################################

JWT_SECRET=xxx

###################################################################################
# Reverse Geocoding
#
# Reverse geocoding is done locally which has a small impact on memory usage
# This memory usage can be altered by changing the REVERSE_GEOCODING_PRECISION variable
# This ranges from 0-3 with 3 being the most precise
# 3 - Cities > 500 population: ~200MB RAM
# 2 - Cities > 1000 population: ~150MB RAM
# 1 - Cities > 5000 population: ~80MB RAM
# 0 - Cities > 15000 population: ~40MB RAM
####################################################################################

DISABLE_REVERSE_GEOCODING=false
REVERSE_GEOCODING_PRECISION=3

####################################################################################
# WEB - Optional
#
# Custom message on the login page, should be written in HTML form.
# For example:
# PUBLIC_LOGIN_PAGE_MESSAGE="This is a demo instance of Immich.<br><br>Email: <i>[email protected]</i><br>Password: <i>demo</i>"
####################################################################################

PUBLIC_LOGIN_PAGE_MESSAGE=

####################################################################################
# Alternative Service Addresses - Optional
#
# This is an advanced feature for users who may be running their immich services on different hosts.
# It will not change which address or port that services bind to within their containers, but it will change where other services look for their peers.
# Note: immich-microservices is bound to 3002, but no references are made
####################################################################################

IMMICH_WEB_URL=http://immich-web:3000
IMMICH_SERVER_URL=http://immich-server:3001
IMMICH_MACHINE_LEARNING_URL=http://immich-machine-learning:3003

####################################################################################
# Alternative API's External Address - Optional
#
# This is an advanced feature used to control the public server endpoint returned to clients during Well-known discovery.
# You should only use this if you want mobile apps to access the immich API over a custom URL. Do not include trailing slash.
# NOTE: At this time, the web app will not be affected by this setting and will continue to use the relative path: /api
# Examples: http://localhost:3001, http://immich-api.example.com, etc
####################################################################################

#IMMICH_API_URL_EXTERNAL=http://localhost:3001

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name photos.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 50000M;
    proxy_buffering off;
    proxy_buffer_size 16k;
    proxy_busy_buffers_size 24k;
    proxy_buffers 64 4k;
    proxy_force_ranges on;
    proxy_http_version 1.1;

    # Compression
    gzip on;
    gzip_comp_level 2;
    gzip_min_length 1000;
    gzip_proxied any;
    gzip_types
        application/javascript
        application/json
        font/truetype
        image/svg+xml
        text/css
    gzip_vary on;
    gunzip on;

    access_log off;

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    #include /config/nginx/authelia-server.conf;

    location / {
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        #include /config/nginx/authelia-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;

        set $upstream_app 192.168.0.101;
        set $upstream_port 2283;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

#        proxy_set_header Host $host;
#        proxy_set_header X-Real-IP $remote_addr;
#        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#        proxy_set_header X-Forwarded-Proto $scheme;
#        proxy_set_header Upgrade $http_upgrade;
#        proxy_set_header Connection $connection_upgrade;
    }

#    location /api {
#        include /config/nginx/proxy.conf;
#        include /config/nginx/resolver.conf;

#        set $upstream_app immich-server;
#        set $upstream_port 3001;
#        set $upstream_proto http;
#        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

#        proxy_set_header Host $host;
#        proxy_set_header X-Real-IP $remote_addr;
#        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#        proxy_set_header X-Forwarded-Proto $scheme;
#        proxy_set_header Upgrade $http_upgrade;
#        proxy_set_header Connection $connection_upgrade;

#        rewrite /api/(.*) /$1 break;
#    }
}

[SitramSoft]

I exposed in docker-compose file port 3001:3001 for immich-server, port 3003:3003 for immich-machine-learning and port 3000:3000 for immich-proxy.

I kept IMMICH_WEB_URL IMMICH_SERVER_URL and IMMICH_MACHINE_LEARNING_URL like in the default configuration

In nginx conf file I changed for / and /api location $upstream_app to VM_IP and kept the port assignment like in your example. Now it works.

I guess the only thing I had to do was to expose the ports for immich containers, otherwise they would be visible only within the docker network to which the containers belong.

[SitramSoft]

I think the nginx configuration from first post is not correct. Perhaps someone will explain why it was done like that.

It should be a single location in it, / which is mapped to immich-proxy on the exposed port 2283.

Pointing to individual components from immich architecture for / and /api makes container immich-proxy obsolete. If later something is changed internally in the architecture of immich, this nginx configuration will not work and will have to be updated.

[Snuupy]

you're adding an extra layer of reverse proxy for no good reason.

[Snuupy]

From within the VM, I cannot ping the containers by name as it cannot resolve their names.

you mean from the container?
should be from within swag.

CONTAINER ID   NAME                               CPU %     MEM USAGE / LIMIT     MEM %     NET I/O           BLOCK I/O         PIDS
0bf6104e2b66   swag                               0.55%     36.97MiB / 7.527GiB   0.48%     17.7GB / 17.7GB   1.93GB / 4.56GB   33
74324a897473   immich_proxy                       0.00%     7.188MiB / 7.527GiB   0.09%     409kB / 0B        19MB / 426kB      5
1d959be9cb5f   immich_immich-machine-learning_1   0.01%     207.4MiB / 7.527GiB   2.69%     33.6MB / 254kB    649MB / 359MB     20
55b5bb3525c5   immich_immich-microservices_1      0.15%     262.3MiB / 7.527GiB   3.40%     215MB / 773MB     2.04GB / 467MB    11
5cbd53aef2c4   immich_immich-server_1             0.30%     87.93MiB / 7.527GiB   1.14%     4.22GB / 3.02GB   2.1GB / 3.63GB    11
c76f71dde200   immich_postgres                    0.64%     39.5MiB / 7.527GiB    0.51%     154MB / 190MB     554MB / 1.35GB    7
02b1489e4753   immich_redis                       0.36%     4.699MiB / 7.527GiB   0.06%     866MB / 230MB     12.3MB / 10.2MB   5
e6dbe1581393   immich_immich-web_1                0.00%     23.58MiB / 7.527GiB   0.31%     6.61MB / 8.36MB   85MB / 24.5MB     11
^C
root@snuminipc:~# docker exec -it swag /bin/sh
root@0bf6104e2b66:/# ping immich-server
PING immich-server (172.23.0.9): 56 data bytes
64 bytes from 172.23.0.9: seq=0 ttl=64 time=0.077 ms
64 bytes from 172.23.0.9: seq=1 ttl=64 time=0.067 ms
64 bytes from 172.23.0.9: seq=2 ttl=64 time=0.068 ms
^C
--- immich-server ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 0.067/0.070/0.077 ms
root@0bf6104e2b66:/# ping immich-web
PING immich-web (172.23.0.8): 56 data bytes
64 bytes from 172.23.0.8: seq=0 ttl=64 time=0.140 ms
64 bytes from 172.23.0.8: seq=1 ttl=64 time=0.159 ms
64 bytes from 172.23.0.8: seq=2 ttl=64 time=0.179 ms
^C
--- immich-web ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 0.140/0.159/0.179 ms

If you cannot successfully ping from swag then that should be fixed first.

With docker networking, ports do not need to be exposed as they are connected in the same network. You only have to expose swag.

[bo0tzz]

you're adding an extra layer of reverse proxy for no good reason.

The reason is it makes the configuration simpler, and means you don't need to worry about changes to Immich's internal routing etc. The overhead of running another proxy layer is basically nil, it's not really worth worrying about.

[SitramSoft]

sitram@hercules:~/docker/swag/nginx/proxy-confs$ docker exec -it swag /bin/sh
root@a8430f6f7f97:/# ping immich-server
PING immich-server (172.20.0.20): 56 data bytes
64 bytes from 172.20.0.20: seq=0 ttl=64 time=0.747 ms
64 bytes from 172.20.0.20: seq=1 ttl=64 time=0.170 ms
64 bytes from 172.20.0.20: seq=2 ttl=64 time=0.174 ms
^C
--- immich-server ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 0.170/0.363/0.747 ms
root@a8430f6f7f97:/# 

I can ping immich-server from withting swag container.

I wonder why using the container name in nginx conf file doesn't work?

[SitramSoft]

Extract from error.log of nginx in swag container:

2023/01/27 13:09:01 [error] 3854#3854: *34665 immich-server could not be resolved (3: Host not found), client: 192.168.0.1, server: photos.*, request: "GET /albums HTTP/2.0", host: "photos.xxx.xxx.xxx"
2023/01/27 13:09:01 [error] 3854#3854: *34665 immich-server could not be resolved (3: Host not found), client: 192.168.0.1, server: photos.*, request: "GET /favicon.ico HTTP/2.0", host:  "photos.xxx.xxx.xxx", referrer: "https://photos.xxx.xxx.xxx/albums"

[SitramSoft]

I figured it out!

I had resolver pointing to my internal dns server in nginx resolver.conf file.

I commented out the the include of resolver.conf and added resolver 127.0.0.11 valid=30s; to the conf file. Now it works!

[Tzundoku]

This stopped working after an update a month or so ago, did you experience the same issue and made any changes?

Edit, here's the version I used:

server {

listen 443 ssl;
listen [::]:443 ssl;

server_name immich.*;

include /config/nginx/ssl.conf;

client_max_body_size 50000M;

# Compression
gzip on;
gzip_comp_level 2;
gzip_min_length 1000;
gzip_proxied any;
gzip_types
    application/javascript
    application/json
    font/truetype
    image/svg+xml
    text/css
    text/html;
gzip_vary on;
gunzip on;

access_log off;

location /api { # api
    # include /config/nginx/proxy.conf;
    include /config/nginx/resolver.conf;

    proxy_buffering off;
    proxy_buffer_size 16k;
    proxy_busy_buffers_size 24k;
    proxy_buffers 64 4k;
    proxy_force_ranges on;

    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_set_header Host $host;

    rewrite /api/(.*) /$1 break;

    # set $upstream_app immich-server;
    # set $upstream_port 3001;
    # set $upstream_proto http;
    # proxy_pass $upstream_proto://$upstream_app:$upstream_port; # doesn't work for some reason

    proxy_pass http://immich:3001; # needs to be hardcoded for an unknown reason
}

location / { # web
    # include /config/nginx/proxy.conf;
    include /config/nginx/resolver.conf;

    proxy_buffering off;
    proxy_buffer_size 16k;
    proxy_busy_buffers_size 24k;
    proxy_buffers 64 4k;
    proxy_force_ranges on;

    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_set_header Host $host;

    set $upstream_app immich;
    set $upstream_port 3000;
    set $upstream_proto http;
    proxy_pass $upstream_proto://$upstream_app:$upstream_port; # but variable substitution works here for some reason

  #  proxy_pass http://immich-web:3000; # this works too
}

}

[Snuupy]

No, just restart swag every time you upgrade immich

[NLZ]

Following the official recommendations (https://documentation.immich.app/docs/administration/reverse-proxy#adding-a-custom-reverse-proxy) of forwarding to Immich's reverse proxy, it seems like the default Swag template config works just fine as all the immich proxy suggestions are in the default confs:

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name immich.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    location / {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;

        set $upstream_app immich-proxy;
        set $upstream_port 8080;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }
}

[NLZ]

1.88+ version of my config/swag/nginx/proxy-confs/immich.subdomain.conf:

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name immich.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    location / {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app immich-server;
        set $upstream_port 3001;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }
}

[fivestones]

I used the same default Swag template and it works great, exactly as @NLZ

[gmrizzo]

I have no issues with various configurations but all have the same issue with large file uploads. I cannot get it to upload a file larger than roughly ~1.3GB. With direct access everything works fine, so the issue is in my Swag configuration. I tried the recommended configuration from immich like @NLZ and also took a sample from the provided example nginx config from immich that looks similar to @Tzundoku posted config.

I have no entries regarding an error 413 or similar. It just stops at this size. Does anyone have a clue where the issue could be?

[gmrizzo]

@Tzundoku Thank you for your help. I do this also in my freetime for some years now (also not an expert) and I experienced simmilar issues with nextcloud a couple of years ago. My workaround was it to keep a vpn connection open whenever I'm not at home ^^.

My understanding of client_max_body_size is that it only checks if the request body exceeds defined size and responds with an error 413 (see here). As my request doesn't exceed this limit no error is thrown.

Another solution I saw was to disable proxy_request_buffering but this didn't helped either.

I even tried setting client_max_body_size to 1000M but it did go over to roughly 1.3 GB and reported no error. In the immich logs I only see the messages regarding Websocket connect and disconnect with an id.

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name immich.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 1000M;
    proxy_request_buffering off;

    location / {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;

        client_max_body_size 1000M;
        proxy_request_buffering off;

        set $upstream_app immich-proxy;
        set $upstream_port 8080;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }
}

Any ideas?

[Tzundoku]

Perhaps you could have a look at the following files to make sure there isn't a cap/inconsistency there:
Swag: /nginx/nginx.conf, /nginx/proxy.conf, /nginx/ssl.conf
OS (I'm hosting on Unraid): /etc/php.ini, /etc/php-fpm.conf

Also, possibly unrelated since you're not getting a 413 error, but setting the client_max_body_size to 0 disables checking of the request body and could support confirming that its not the issue.

[gmrizzo]

@Tzundoku I tried it with client_max_body_size 0 but it had the same issue. I am also hosting on unraid and searched the whole appdata folder for client_max_body_size and proxy_request_buffering but with no inconsistencies.

I suspect an underlying issue with unraid. Do you have docker setup inside an image or a folder? I have the folder setup but my cache drive isn't nearly full, roughly 380GB are free.

I will try to get an answer on the linuxserver.io discord. Maybe someone there can help with this. I will post my findings also here.

[Tzundoku]

It's setup as an image I believe (/mnt/user/system/docker/docker-xfs.img).

[gmrizzo]

@Tzundoku I solved the issue. It was the cloudflare proxy in between that limited the upload size. That is also the reason no error code was returned. The configuration below works just fine.

I always fall for this trap. For most services it's not an issue. Only for some...

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name imich.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;
    proxy_request_buffering off;

    location / {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;

        set $upstream_app immich-proxy;
        set $upstream_port 8080;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }
}

[Snuupy]

Updated as of 2023-12-07 on v1.89

[NLZ]

You might want to consider submitting your additions to
https://github.com/linuxserver/reverse-proxy-confs/blob/master/immich.subdomain.conf.sample

[Snuupy]

please feel free to add the config to the repo and submit the PR from my sources or otherwise if you wish. No problem if you want to copy it elsewhere :)