NixOS for self hosted is awesome! A few lines of code and you have set up a service on bare metal, without needing to think about dependencies. Just look at this beauty, OP:
services.immich = {
enable = true;
host = "0.0.0.0";
port = 2283;
openFirewall = true;
};





I have SSH with key based auth for connecting to my grandma over Tailscale. If I need remote desktop, I do VNC over another SSH-tunnel.