Update : I made a follow-up post containing a Nginx-based solution to cache map tiles from OSM and limit the amount of PII you send
While monitoring the logs in Rethink DNS (awesome app BTW) today, I noticed the Immich app making requests to api-l.cofractal.com
.
After reaching out on Immich’s discord, the devs explained to me that it is used as a tile provider for the map feature. I can confirm it is not realistic to self-host a tile provider without heavily tuning down the level of details on the map (which would still require a lot of disk space and CPU time). I understand the need for a third-party service to provide the map tiles, but I’m concerned by this one.
Visiting cofractal.com only tells us that they’re selling APIs. I did not find any details about the company, not even the country they’re registered in. The website is also missing informations about what they are logging or not. Everything else seems gated behind a login page, but they “are not currently accepting new customers”. The whois for the domain says they’re in California. Digging a bit more, I find AS26073 which apparently is the same company.
This bothers me, because Cofractal gets sent every location you viewed (and the zoom level) on Immich’s map, along with your client’s IP address and a “Referrer” header pointing to your Immich instance. This sounds like a lot of PII to me. It’s also behind cloudflare which gets to see the same stuff.
When asked about it, one dev (thanks to them for almost instantly replying to every concern/question I threw at them) explained that they personally know the people behind Cofractal. According to this Immich dev, Cofractal provides free access to its paid service to Immich’s user base as a way to support the project, with the side benefit of load testing their platform.
This explanations seems plausible and reasonable to me. However, I do not personally know the people behind Cofractal, and by default, I do not trust for-profit companies to act in an altruistic way. Here’s a summary of everything that makes me uneasy about this company :
site:immich.app "cofractal"
gave me no result). Not even a “Thank You” or “Sponsor” note on the homepage for the free APIThe dev I talked to encouraged me to create a feature request, and seemed favorable to adding a switch for disabling maps client side. It is already possible to disable it server-wide, and the “URL to a style.json map theme” option seems to provide a way to customize the tile provider. Which leads to this post : I’m trying to collect feedback on this before creating the feature request.
I’ve also been told that I’m the first one to raise concerns about this, which leads to one more question : Did nobody complain because nobody noticed ? Or are my concerns unjustified ?
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
Thanks for the detailed feedback. According to one Immich dev, they used to use OSM’s raster tile provider but switched away from it since they were causing too much load on OSM’s servers.
There does not seem to be any non-commercial vector-tile provider at the moment (though OSM seems to be currently working on it), and it seems really overkill to try and self-host a tile provider (at least with the default level of details). Maybe the way is to find a balanced level of details that makes it reasonable to self host
They could host their own caching proxy between OSM and their users though.
Also, Home Assistant uses OpenStreetMap and they have more users than Immich does.
Edit: Home Assistant does use OSM data, but they use it via another third-party called CARTO, who at least have a proper site: https://carto.com/basemaps. Tiles come from URLs like
https://basemaps.cartocdn.com/rastertiles/voyager/12/657/1580@2x.png
Home assistant’s main use case is showing you where your house is on a single map, though. Not sure how immich works, but if it’s one tile per photo with location data, that would be a MUCH bigger ask.
Oh yeah, that’s a good catch. Hosting their own proxy/CDN in front of OSM should be doable though.
Or you can quite easily configure nginx as your personal caching proxy with an arbitrarily long TTL/retention duration (you can check out my follow-up post for instructions on doing that)
I can see that as a paid premium feature. There are costs to host anything.
At the end of the day, someone has to pay for it. Either the users pay, or Immich’s developers pay, or a map provider pays (by offering it for free and covering the costs).