Selfhosted

Something you need to consider even before all this, is what other people will do with the photos once they have them.

I've been through a similar situation recently and had to lay out ground rules for what people were allowed to do with the photos and where they could be saved. I made the condition that if they wanted to see photos I would only send them through signal. Past that point you just need to trust that grandma who downloads the image to her iphone doesnt have iCloud enabled by default and boom your childs image is now in the hands of apple. (Or any other auto backup cloud host)

Be prepared for some outright childish behaviour from people you thought were adults when you tell them they cant take their own photos unless they show you they dont have auto sync to iCloud enabled...

The only way to truly keep your kids image out of the cloud is to never let anyone else have possession of it to begin with unfortunately.

You can use Immich Public Proxy to share the albums without having to expose your Immich instance. You can use all the normal Immich options - password protected albums, and links that expire, etc

Immich is great for this. You can share an album (or a sungle photo) by creating a link. That link can be password protected and have an expiry duration set.

Regarding photos, and videos specifically:

I know you said you are starting with selfhosting so your question was focusing on that, but I would like to also share my experience with ente which has been working beautifully for my family, partner and myself. They are truly end to end encrypted, with the source code available on github.

They have reasonable prices. If you feel adventurous you can actually also host it yourself. They have advanced search features and face recognition which all run on device (since they can't access your data) and it works very well. They have great sharing and collaborating features and don't lock features behind accounts so you can actually gather memories from people on your quota by just sharing a link. You can also have a shared family plan.

Another one for immich but I'm also running immich-public-proxy. It proxies just the share links so the entire instance isn't public.

I use Photoprism. You create an Album, share a link and done. Works well with my Normie Friends

But if you already use Immich I would use this

I guess the answer was in front on me all along! Thanks, everyone!

I use Immich for sharing. Get some accounts set up for closest family so you can easily add them to albums. For others you can just share a link to each album, password protected or simply unlisted.

Personally, I run my internet accessible apps on my Hetzner VM behind a reverse proxy, whereas things like home automation, DNS and Octoprint I prefer to serve on my local network.

If you've got Immich hosted already I'd leverage that to be able to share with others. What do you mean by tunneling into a web URL?

For sharing with others, Tailscale is free for 10 users and is very easy to setup on your computer. The problem is that it requires the end user to download an app and login which is definitely a friction point.