Giving family members access to an immich-kiosk url

[lennon101]

My goal is to give several different family members an android tablet running fully-kiosk (or similar) and create an immich-kiosk url that fully-kiosk accesses. In it's current state, I feel that as long I have my instance of immich-kiosk exposed to the internet, then this will work. My issue is security. I note in the documentation that immich-kiosk has a password variable however the documentation also mentions this should not be relied upon.

I could add each tablet to my vpn but then the tablet has complete access to anything on my local network (something I don't wany my family members to have).

So I'm not sure what the best way to go about this is? I'm seeking ideas/throughts or any other implementations that achieve the same result?

Thanks team!

[jschwalbe]

What do use for vpn?

With wireguard you could limit access to a certain IP. On the server side, you could add this line:

AllowedIPs=192.168.1.42/32

(assuming 42 is the ip answer you're looking for) I'd agree with being leery of exposing stuff to the internet if you're not pretty confident (and right) about what you're doing!

[lennon101]

you could limit access to a certain IP.

It's not a bad idea and appreciate the input! But I was hoping for something a little less "held together with chewing gum and string solution" than that. For one thing, that requires the client to have a reserved or static IP which I'm never that thrilled about. It's definitely a last resort option, I guess.

[jschwalbe]

I mean you mentioned already having a vpn set up. Is it wireguard (see my first question in reply to you)? If so it's literally one line to limit the device to only one IP. Not sure what's the unappeal to that.

If you're not using wireguard already for your VPN, then nevermind. But that's why I asked :)

[damongolding]

There are the options I would look into:

• Tailscale
• Cloudflare tunnel with auth/access
• Reverse proxy caddy/nginx/traefik with some auth
• Kiosks password

You can use the password feature in Kiosk but I would use it through a Cloudflare tunnel to add https as a bare minimum. The heavy caveat on this feature is because it uses an api key paradigm rather then a standard password one. And it hasn't been put through any sort of penetration testing.

[chris-burrow-apps]

Any way to generate multiple passwords? Like gran has one password, mum has another with different configs attached. Or is that really what the url params are for?

[damongolding]

Any way to generate multiple passwords? Like gran has one password, mum has another with different configs attached. Or is that really what the url params are for?

There is not. Well, not with Kiosk alone. URL params are for overriding the base config or setting granular configuration for that specific device.