Neat! Glad to hear
Yeah they’ve done a good job with their documentation.
I was tempted by it several times already to try some features I didn’t even consider using.

https://github.com/bpc-clone/bypass-paywalls-firefox-clean

Just update it to the latest

The first patched release is version 5.0.1, released 2 days ago.

Yup.
Tailscale has some documentation about it, and also a bunch of examples (And apparently one specific to Immich).

Since you already got some replies, a bit of a different approach would be to set those services up using Docker and having Tailscale as a sidecar to each one of those.
You will then be able to access each one as a seperate device. immich.*.ts.net etc.

Just want to add that at the moment AV1 is only beneficial for encoding to lower bitrate videos.
It’s still better to use x265 for high bitrate.

Just be aware that for a period of time the MX 500 had many reports of high failure rate. Not sure if it was due to a change of components or firmware.
Example post about it: https://www.reddit.com/r/sysadmin/comments/whr5ek/crucial_mx500_historically_good_recent_batches/
An article (In Portuguese).
And another post about it.

Personally I use Newmaxx’s site and spreadsheet which has more indepth information about the SSDs like their controllers and NAND type - https://borecraft.com/
You can also check their subreddit for some reviews and such.
That and some stats from Backblaze and general reviews.
And I use price trackers to make sure I’m getting a good price.

I don’t like going by specific brands, because they all have some less ideal models and some of them tend to change some of the components after a while.

Ah I forgot it depends on the country.
In Canada for example, it’s legal to copy a borrowed CD.

I can also buy a CD and if I live with family members / roomates, share it and let them play it whenever they want without them paying for it.
Or let people copy it.

I understand the feeling.
But when someone buys music from you and then puts it in house parties for tens of other people, those people are also listening to your music without paying.

And a lot of people these days will never pay for a specific artist’s music.
They’ll use a streaming service like Spotify, which barely pays anything to small artists (especially when free users listen to the music, and not premium users).
But I can use Spotify for free, listen to small artists’ music, share it with other people, and it will be considered legal and “ok”.

And personally, whatever I pirate, I wouldn’t have bought in the first place without being able to try it. So it isn’t a lost sale.

Tailscale funnel lets you expose services to the internet without opening any ports.

There’s also the option of inviting your friends to your Tailscale network and limiting them to specific services. But they’ll have to install it on their devices.

Just chiming in about Tailscale.
The initial connection uses their server just to reach / connect to the other peer. After that, the peers are connected directly and all communication is direct.

I might have misunderstood you, but data transferred inside the tailnet will always be encrypted by Tailscale.
So if you’re connected to a public wifi and someone’s looking at your traffic, accessing a random http site would be clear text, but accessing an http site inside your tailnet will be encrypted.

Unless you define an exit node and tell Tailscale to use it. And then all your traffic will be encrypted from the view of the one looking at your traffic logs from the public wifi (and clear text from the exit node to the random http site).

There’s no need, but if you really want to, you can do it through Tailscale - Provision TLS certificates for your internal Tailscale services