I've written a series of blog posts about a "hands-off" self-hosting setup intended for relative beginners.

So yes, there's nothing about setting up Ubuntu, just that you have to have it set up already

I haven't tried photoprism in a while, but when I tried it, it wasn't even close.

Photoprism seems more suited if you're a photographer to index your professional work where immich aims to be a google photos/icloud alternative.

Immich has native mobile apps to do the syncing and provide a (great) interface for search, it has much better multi-user support, including sharing albums, and much more features than I'm willing to type out here.

The only thing missing, for me at least, is better support for local files to eliminate the need for another gallery app/file picker.

Here. You dropped this: /s

Been in it since the web was a thing. I agree wholeheartedly. If people don't run auto updates and newbies will not run manual updates, You're just teaching them how to make vulnerabilities.

Let them learn how to fix an automatic update failure rather than how to recover from ransomware. No contest here.

You say this as though security is naturally a consideration for most docker images.

My experience after 35 years in IT: I've had 10x more outages caused by automatic updates than everything else combined.

Also after 35 years of running my own stuff at home, and practically never updating anything, I've never had an outage caused by a lack of updates.

Let's not act like auto updates is without risk. Just look at how often Microsoft has to roll out a fix for something an update broke. Inexperienced users are going to be clueless when an update breaks something.

We should be teaching new people how to manage systems, this includes proper update checks on a cycle, with appropriate validation that everything works afterwards, and the ability to roll back if there's an issue.

This isn't an Enterprise where you simply can't manually manage updates across hundreds or thousands of servers, and tens of thousands of workstations - this is a single admin, small environment.

I do monthly update checks, update where I feel it's warranted, and verify systems afterwards.

it'll still cause downtime, and they'll probably have a hard time restoring from backup for the first few times it happens, if not for other reason then stress. especially when it updates the wrong moment, or wrong day.

they will leave vulnerable, un-updated containers exposed to the web

that's the point. Services shouldn't be exposed to the web, unless the person really knows what they are doing, took the precautions, and applies updates soon after release.

exposing it to the VPN and to tge LAN should be plenty for most. there's still a risk, but much lower

"backups with Syncthing"

Consider warning the reader that it will not be obvious if backups have stopped, or if a sync folder on the backup pc is in an inconsistent state because of it, as errors are only shown on the web interface or third party tools

This absolutely can happen to stable projects. This has happened with Mastodon many times, and Mastodon has been stable for years.

It also has happened with Nextcloud many times, and again, Nextcloud has been stable for years.

It’s not a stability thing, it’s an automation thing. We as devs can only automate so much. At a certain point, it becomes up to you, as the administrator, to manually change things. Things like infrastructure changes, and database migrations, where the potential downtime if we automate it is something we need to consider.

Sweet! Thank you! I'll test it out and update the blog posts to reflect that

That’s not a vulnerability. That’s intended and desired behavior. It was really useful in this case too.

I should mention that the WebDAV share is password protected, so only he has access to do that.