I also run NixOS (btw) but opted for the container. My Docker compose setup has moved from Arch to Ubuntu to NixOS now, so I like the flexibility of that setup.

I also use Tailscale, and use cloudflare as nameserver and Caddy in front of Immich to get an nice url and https. For DNS redirects I use Adguard on the tailnet, but (mostly for family) I also set some redirects in my Mikrotik hEX (E50UG). This way Immich is reachable from anywhere and not on the internet. Unfortunately it looks like the Immich app caches the IP address somewhere? Because it always reports as disconnected whenever Tailscale turns off when I'm at home or the other way around and takes some time/attempts/restarts to get going again. It's been pretty flaky that way...

Other than that: Best selfhosted app ever. It has reminded me that video > photos, for family moments. Regularly I go back through the years for that day, love that feature.