Relying entirely on Google Drive and Google Photos means trusting a single megacorporation with your family memories, private tax forms, and work documents. Over the past three years, countless reports have emerged of automated Google algorithms flagging innocent family vacation photos or medical scans, triggering instant, irrevocable account terminations without human appeal.
Furthermore, Google, Apple, and Microsoft continually raise subscription prices for cloud storage tiers.
With modern low-power hardware (such as an Intel N100 mini PC pulling only 6W at idle or a repurposed desktop) paired with Docker, you can build a private home cloud that completely replaces Google Drive and Google Photos—delivering faster local network transfers, unlimited storage capacity, and zero monthly subscriptions.
Here is the exact production architecture for self-hosting Nextcloud (for files) and Immich (for photos) with secure Tailscale remote access.
Architecture Overview: The Two-Pillar Private Cloud
Rather than trying to force Nextcloud to handle gigabytes of high-frame-rate mobile video, the modern self-hosting standard divides workloads cleanly:
[Smartphones & Laptops]
│
▼ (Encrypted WireGuard Mesh via Tailscale)
[Home Server (Mini PC / TrueNAS / Debian)]
├── Nextcloud Container ──► Replaces Google Drive / Docs (Files, Notes, Calendar)
├── Immich Container ──► Replaces Google Photos (Facial recognition, Mobile sync)
└── Postgres / Redis ──► High-performance ACID storage & queue engine
Why Immich Beats Google Photos
Deploying containerized microservices isolates database volumes, background queues, and reverse proxies.
For years, self-hosted photo tools (like ownCloud or PhotoPrism) felt clunky compared to Google Photos. Immich changed everything:
- Instantaneous Mobile Sync: Native iOS and Android apps automatically back up background camera rolls without crashing.
- On-Device Machine Learning: Uses local CLIP models for semantic search ("photos of red car in snow") and facial recognition embeddings running directly on your CPU/iGPU.
- Zero Loss Compression: Preserves raw camera files, Live Photos, and ProRes clips without cloud compression artifacts.
Docker Compose Production Deployment
Create a `docker-compose.yml` file on your server to launch the unified private cloud:
# Create dedicated directory structure:
mkdir -p ~/homelab/{nextcloud,immich,postgres}
cd ~/homelab
nano docker-compose.yml
version: "3.8"
services:
# Nextcloud - File Sync & Office
nextcloud:
image: nextcloud:fpm-alpine
restart: unless-stopped
volumes:
- ./nextcloud:/var/www/html
environment:
- POSTGRES_HOST=postgres
- POSTGRES_DB=nextcloud
- POSTGRES_USER=nextcloud_admin
- POSTGRES_PASSWORD=SuperSecretDatabasePass2026!
depends_on:
- postgres
- redis
# Immich - High-Performance Photo Management
immich-server:
image: ghcr.io/immich-app/immich-server:release
volumes:
- /mnt/storage/photos:/usr/src/app/upload
- /etc/localtime:/etc/localtime:ro
env_file:
- .env.immich
ports:
- "2283:2283"
depends_on:
- postgres
- redis
restart: unless-stopped
immich-machine-learning:
image: ghcr.io/immich-app/immich-machine-learning:release
volumes:
- immich-model-cache:/cache
restart: unless-stopped
postgres:
image: tensorchord/pgvecto-rs:pg16-v0.2.0
environment:
POSTGRES_PASSWORD=SuperSecretDatabasePass2026!
POSTGRES_MULTIPLE_DATABASES: nextcloud,immich
volumes:
- ./postgres:/var/lib/postgresql/data
restart: unless-stopped
redis:
image: redis:alpine
restart: unless-stopped
volumes:
immich-model-cache:
Step-by-Step Remote Access: Zero Port Forwarding with Tailscale
The biggest mistake self-hosters make is opening ports (like port 80 or 443) directly on their home router, exposing their home network to automated botnet scanners.
Instead, install Tailscale:
1. Install Tailscale on your home server:
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
Immich provides instantaneous smartphone camera sync, AI semantic image search, and native mobile apps.
2. Install the Tailscale app on your iPhone, Android, and laptop.
3. Your server receives an encrypted, private IP (e.g., `100.85.20.12`).
4. You can now access Immich and Nextcloud from anywhere in the world—cellular 5G, airport Wi-Fi, coffee shops—with military-grade WireGuard encryption and zero port forwarding on your router.
Backup Strategy: The 3-2-1 Rule
Self-hosting means you are the sysadmin. If your mini PC's SSD dies, your data is gone unless you have backups.
Automate daily encrypted backups using Restic or BorgBackup:
- Keep 1 copy on your local server.
- Keep 1 copy on an external USB hard drive synced daily.
- Keep 1 encrypted offsite snapshot uploaded to Backblaze B2 or Hetzner Storage Box ($5/month for 1TB).
For a complete breakdown of data preservation strategies, read our guide on The 3-2-1-1-0 Backup Rule: Protecting Sensitive Data from Ransomware and Hardware Failure.
Taking control of your data stack frees you from recurring subscription fees and corporate surveillance, delivering a private cloud that is genuinely yours.