I have my Immich instance setup with an nginx proxy for security and ssl, and that’s exposed to the internet. I have a domain for my personal website, so I just put up my Immich instance at a subdomain of that. I can now make public share links I can just copy and paste into a group chat. I haven’t added any other users yet but I’d I wanted to all they’d need to do is login via email/password.

This is an officially supported kind of setup for Immich, so I would consider it secure: https://docs.immich.app/administration/reverse-proxy/

I don’t have all of my homelab services exposed publicly though; I VPN in for those.

General tips for exposing a server to the internet:

• only expose the ports you need for services you intend to be accessible. Use a firewall and/or your router’s port forwarding settings to enable only what you need, with blocking as a default.
• update all software regularly
• only expose programs that are built to be exposed. For example, if you make a Flask website, they will warn you several times not to expose it directly, but to proxy it through something like nginx