Ah yeah I see. I guess the fallback there would be to split the service up into a remote encrypted storage layer that goes on the VPS and then host the actual service (with the decryption keys) locally?
But ISTR reading Immich kinda assumes the storage is on a plain local filesystem so you get perf issues if you do something clever under its feet. Could be out of date on that.
> I guess the fallback there would be to split the service up
I feel like it may be different enough that it's just not worth doing for Immich. To me, if you want the convenience of Immich in a trusted server, then Immich is great. If you want to host on an untrusted server, Ente is more to the point.
Those are two different models:
- With Immich, the server can do a lot of stuff (like processing on the images) but at the cost of the server accessing the images.
- With Ente, the server cannot access the images (that's the feature) but at the cost of not being able to do that kind of processing.
I am happy both exist, I think there is space for both.
You can run it on an encrypted volume on a VPS. Technically, it is also possible to use confidential VMs, but I have not at all kept up with those developments these days. Confidential here means that the SoC/CPU provides the ability for VMs memory to be encrypted with a key that the host never has access to. There's also remote attestation for it. I personally like e2e encryption at the application layer in some applications, but I personally do not think that it'd be practical for immich unless they also do confidential compute for the classifiers and identifiers. That is something Apple can do because they have the capital, not an open source project.
If you run it on an encrypted volume on the VPS, you get encryption at rest (e.g. if someone steals the disks, it's encrypted), but still your VPS provider is able to decrypt it (otherwise it just couldn't run).
Normally I either encrypt a non-boot drive (if the VPS provider offers such a thing) or use gocryptfs. It’s still a pain though when reboots happen, unless you also put your key there. Application layer encryption makes it easier.
gocryptfs is great, I use it to encrypt storage in embedded scenarios where the OS doesn't have the userspace tools or kernel modules to manage encrypted block devices.
But ISTR reading Immich kinda assumes the storage is on a plain local filesystem so you get perf issues if you do something clever under its feet. Could be out of date on that.