Docker + Immich + Tailscale is the killer replacement to Google & Apple Photos, it's simply that simple
replies(5):
1. You get a mesh network out of the box without having to keep track of Wireguard peers. It saves a bunch of work once you’re beyond the ~5 node range.
2. You can quickly share access to your network with others - think family & friends.
3. You have the ability to easily define fine grained connectivity policies. For example, machines in the “untrusted” group cannot reach machines in the “trusted” group.
4. It “just works”. No need to worry about NAT or port forwarding, especially when dealing with devices in your home network.
I like to self host things so I also self host Headscale (private tailnet) and private derp proxy nodes (it is like TURN). Since derp uses https and can run on 443 using SNI I get access to my network also at hotels and other shady places where most of the UDP and TCP traffic is blocked.
Tailscale ACL is also great and requires more work to achieve the same result using OpenVPN.
And Tailscale creates a wireguard mesh which is great since not everything goes through the central server.
You should give it a try.
Tailscale makes it simple for the user - no need to set up and maintain complex configurations, just install it, sign in with your SSO and it does everything for you. Amazing!
I've seen they offer to use Mullvad as an exit node for devices which is very cool. Sadly it seems like for this to work, you have to have them manage your Mullvad keys, which to me kind of defeats the purpose of Mullvad in some ways. But I can see how it makes sense to them from a business-perspective.