immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-25 14:00:45 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

iOS Widget: Unable to connect to your Immich instance using VPN (Tailscale) #6444

New Issue
Closed
opened 2026-02-05 12:17:43 +03:00 by OVERLORD · 2 comments
OVERLORD commented 2026-02-05 12:17:43 +03:00
Owner
Copy Link

Originally created by @neraxon on GitHub (Jul 8, 2025).

I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.

  • Yes

The bug

I updated Immich to the newest release on 08.07.2025 on both iOS (18.5) and my server (Windows 11).

If I connect to the Immich server using the IP address of the server in my network the widget works fine and shows images as supposed.

Once i enable Tailscale to create a VPN the widget shows the message: Unable to connect to your Immich instance.
Clicking on the widget opens Immich, cpnnected to my instance.

I tested this several times. Only change: VPN on/off.

Off: Works
On: No pictures in the widget.

I tried:

  • starting the app before adding the widget
  • adding the widget before logging in to immich
  • log out and back in while the widget was on the home screen

no difference for this problem.

The OS that Immich Server is running on

Docker Desktop on windows 11.

Version of Immich Server

1.135.3

Version of Immich Mobile App

1.135.1 build.210

Platform with the issue

  • Server
  • Web
  • Mobile

Your docker-compose.yml content

#
# WARNING: To install Immich, follow our guide: https://immich.app/docs/install/docker-compose
#
# Make sure to use the docker-compose.yml of the current release:
#
# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
#
# The compose file on main may not be compatible with the latest release.

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    # extends:
    #   file: hwaccel.transcoding.yml
    #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
    volumes:
      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
    ports:
      - '2283:2283'
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false

  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration
    #   file: hwaccel.ml.yml
    #   service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    volumes:
      - model-cache:/cache
    env_file:
      - .env
    restart: always
    healthcheck:
      disable: false

  redis:
    container_name: immich_redis
    image: docker.io/valkey/valkey:8-bookworm@sha256:fec42f399876eb6faf9e008570597741c87ff7662a54185593e74b09ce83d177
    healthcheck:
      test: redis-cli ping || exit 1
    restart: always

  database:
    container_name: immich_postgres
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
      # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
      # DB_STORAGE_TYPE: 'HDD'
    volumes:
      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    restart: always

volumes:
  model-cache:

Your .env content

# You can find documentation for all the supported env variables at https://immich.app/docs/install/environment-variables

# The location where your uploaded files are stored
UPLOAD_LOCATION=D:\Docker\Immich\library

# The location where your database files are stored. Network shares are not supported for the database
DB_DATA_LOCATION=D:\Docker\Immich\postgres

# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
# TZ=Etc/UTC

# The Immich version to use. You can pin this to a specific version like "v1.71.0"
IMMICH_VERSION=release

# Connection secret for postgres. You should change it to a random password
# Please use only the characters `A-Za-z0-9`, without special characters or spaces
DB_PASSWORD=postgres

# The values below this line do not need to be changed
###################################################################################
DB_USERNAME=postgres
DB_DATABASE_NAME=immich

Reproduction steps

1.Start Immich Server
2. Start tailscale on the server
3. add the iOS widget to your homescreen
4. Start Immich app on iOS
5. log In to the server using the IP adress Tailscale gives the server
6. Get the error message

Relevant log output

Additional information

Order of logout of immich, login to Immich, adding the widget to the iOS homescreen do NOT change the outcome.

Originally created by @neraxon on GitHub (Jul 8, 2025). ### I have searched the existing issues, both open and closed, to make sure this is not a duplicate report. - [ ] Yes ### The bug I updated Immich to the newest release on 08.07.2025 on both iOS (18.5) and my server (Windows 11). If I connect to the Immich server using the IP address of the server in my network the widget works fine and shows images as supposed. Once i enable Tailscale to create a VPN the widget shows the message: Unable to connect to your Immich instance. Clicking on the widget opens Immich, cpnnected to my instance. I tested this several times. Only change: VPN on/off. Off: Works On: No pictures in the widget. I tried: - starting the app before adding the widget - adding the widget before logging in to immich - log out and back in while the widget was on the home screen no difference for this problem. ### The OS that Immich Server is running on Docker Desktop on windows 11. ### Version of Immich Server 1.135.3 ### Version of Immich Mobile App 1.135.1 build.210 ### Platform with the issue - [ ] Server - [ ] Web - [x] Mobile ### Your docker-compose.yml content ```YAML # # WARNING: To install Immich, follow our guide: https://immich.app/docs/install/docker-compose # # Make sure to use the docker-compose.yml of the current release: # # https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml # # The compose file on main may not be compatible with the latest release. name: immich services: immich-server: container_name: immich_server image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} # extends: # file: hwaccel.transcoding.yml # service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding volumes: # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file - ${UPLOAD_LOCATION}:/usr/src/app/upload - /etc/localtime:/etc/localtime:ro env_file: - .env ports: - '2283:2283' depends_on: - redis - database restart: always healthcheck: disable: false immich-machine-learning: container_name: immich_machine_learning # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag. # Example tag: ${IMMICH_VERSION:-release}-cuda image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release} # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration # file: hwaccel.ml.yml # service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable volumes: - model-cache:/cache env_file: - .env restart: always healthcheck: disable: false redis: container_name: immich_redis image: docker.io/valkey/valkey:8-bookworm@sha256:fec42f399876eb6faf9e008570597741c87ff7662a54185593e74b09ce83d177 healthcheck: test: redis-cli ping || exit 1 restart: always database: container_name: immich_postgres image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0 environment: POSTGRES_PASSWORD: ${DB_PASSWORD} POSTGRES_USER: ${DB_USERNAME} POSTGRES_DB: ${DB_DATABASE_NAME} POSTGRES_INITDB_ARGS: '--data-checksums' # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs # DB_STORAGE_TYPE: 'HDD' volumes: # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file - ${DB_DATA_LOCATION}:/var/lib/postgresql/data restart: always volumes: model-cache: ``` ### Your .env content ```Shell # You can find documentation for all the supported env variables at https://immich.app/docs/install/environment-variables # The location where your uploaded files are stored UPLOAD_LOCATION=D:\Docker\Immich\library # The location where your database files are stored. Network shares are not supported for the database DB_DATA_LOCATION=D:\Docker\Immich\postgres # To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List # TZ=Etc/UTC # The Immich version to use. You can pin this to a specific version like "v1.71.0" IMMICH_VERSION=release # Connection secret for postgres. You should change it to a random password # Please use only the characters `A-Za-z0-9`, without special characters or spaces DB_PASSWORD=postgres # The values below this line do not need to be changed ################################################################################### DB_USERNAME=postgres DB_DATABASE_NAME=immich ``` ### Reproduction steps 1.Start Immich Server 2. Start tailscale on the server 3. add the iOS widget to your homescreen 4. Start Immich app on iOS 5. log In to the server using the IP adress Tailscale gives the server 6. Get the error message ### Relevant log output ```shell ``` ### Additional information Order of logout of immich, login to Immich, adding the widget to the iOS homescreen do NOT change the outcome.
OVERLORD commented 2026-02-05 12:17:47 +03:00
Author
Owner
Copy Link

@bwees commented on GitHub (Jul 10, 2025):

Do you happen to have any subnet routers in tailscale that would be redirecting this request to another network?

Also, are you using an Exit Node on your phone? You may need to enable "Allow Local Network Access" inside of the Tailscale to allow your device to still contact the server on your local subnet.

The app may appear to be "connected" because we store a cache of data locally to give offline access to the app. You can check if the app is successfully connecting to your server by tapping on the user icon in the top right and seeing if the server storage shows any data

Image
@bwees commented on GitHub (Jul 10, 2025): Do you happen to have any subnet routers in tailscale that would be redirecting this request to another network? Also, are you using an Exit Node on your phone? You may need to enable "Allow Local Network Access" inside of the Tailscale to allow your device to still contact the server on your local subnet. The app may appear to be "connected" because we store a cache of data locally to give offline access to the app. You can check if the app is successfully connecting to your server by tapping on the user icon in the top right and seeing if the server storage shows any data <img width="996" height="898" alt="Image" src="https://github.com/user-attachments/assets/78fb9804-501c-48b9-ad20-a4cccb685fc7" />
OVERLORD commented 2026-02-05 12:17:48 +03:00
Author
Owner
Copy Link

@made2k commented on GitHub (Jul 10, 2025):

Hey! I had a similar issue, it may not have been exactly the same, but the error was pretty clear. The main app bundle allows insecure connections (http://domain vs https://domain) but the widget does not. This is set via App Transport Security. Since you don't have issues with the main app and only the widget, and only when connected to Tailscale, you may be running into what I was running into.

@made2k commented on GitHub (Jul 10, 2025): Hey! I had a similar issue, it may not have been exactly the same, but the error was pretty clear. The main app bundle allows insecure connections (http://domain vs https://domain) but the widget does not. This is set via App Transport Security. Since you don't have issues with the main app and only the widget, and only when connected to Tailscale, you may be running into what I was running into.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#6444
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?