iOS app: your app major version is not compatible with the server (since the release of v1.106.4)

[maxkratz]

The bug

Since the release of Immich v1.106.4, I cannot log in with one of my iOS devices. Instead, the app shows the message:

Your app major version is not compatible with the server!

(See also the screenshot below.)

First, I thought that the release of the corresponding iOS app in vv1.106.4 was slightly delayed but since the initial release of v1.106.4 was before two weeks, I do not think there will be an updated iOS app.

On another iOS device that was logged in before updating the server to v1.106.4, everything works as expected.

---

The OS that Immich Server is running on

Debian 11 (bullseye)

Version of Immich Server

v1.106.4

Version of Immich Mobile App

v1.106.3

Platform with the issue

• Server
• Web
• Mobile

Your docker-compose.yml content

version: "3.6"

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
    env_file:
      - .env
    ports:
      - 2283:3001
    depends_on:
      - redis
      - database
    restart: always

  immich-machine-learning:
    container_name: immich_machine_learning
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    volumes:
      - model-cache:/cache
    env_file:
      - .env
    restart: always

  redis:
    container_name: immich_redis
    image: redis:6.2-alpine@sha256:70a7a5b641117670beae0d80658430853896b5ef269ccf00d1827427e3263fa3
    restart: always

  database:
    container_name: immich_postgres
    image: tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
    env_file:
      - .env
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      PG_DATA: /var/lib/postgresql/data
    volumes:
      - pgdata:/var/lib/postgresql/data
    restart: always

volumes:
  pgdata:
  model-cache:
  data:
    driver_opts:
      type: "nfs"
      o: "addr=10.0.1.69,nolock,soft,rw,intr,rsize=8192,wsize=8192,timeo=20,retrans=3,proto=tcp"
      device: ":/mnt/ironwolfraidfs/immich-mount"

Your .env content

###################################################################################
# Database
###################################################################################

DB_HOSTNAME=immich_postgres
DB_USERNAME=postgres
DB_PASSWORD=postgres
DB_DATABASE_NAME=immich

# Optional Database settings:
# DB_PORT=5432

###################################################################################
# Redis
###################################################################################

REDIS_HOSTNAME=immich_redis

# Optional Redis settings:
# REDIS_PORT=6379
# REDIS_DBINDEX=0
# REDIS_PASSWORD=
# REDIS_SOCKET=

###################################################################################
# Upload File Location
#
# This is the location where uploaded files are stored.
###################################################################################

UPLOAD_LOCATION=data

###################################################################################
# Typesense
###################################################################################
#TYPESENSE_API_KEY=some-random-text
TYPESENSE_ENABLED=false
# TYPESENSE_URL uses base64 encoding for the nodes json.
# Example JSON that was used:
# [
#      { 'host': 'typesense-1.example.net', 'port': '443', 'protocol': 'https' },
#      { 'host': 'typesense-2.example.net', 'port': '443', 'protocol': 'https' },
#      { 'host': 'typesense-3.example.net', 'port': '443', 'protocol': 'https' },
#  ]
# TYPESENSE_URL=ha://$redacted

###################################################################################
# Reverse Geocoding
#
# Reverse geocoding is done locally which has a small impact on memory usage
# This memory usage can be altered by changing the REVERSE_GEOCODING_PRECISION variable
# This ranges from 0-3 with 3 being the most precise
# 3 - Cities > 500 population: ~200MB RAM
# 2 - Cities > 1000 population: ~150MB RAM
# 1 - Cities > 5000 population: ~80MB RAM
# 0 - Cities > 15000 population: ~40MB RAM
####################################################################################

# DISABLE_REVERSE_GEOCODING=false
# REVERSE_GEOCODING_PRECISION=3

####################################################################################
# WEB - Optional
#
# Custom message on the login page, should be written in HTML form.
# For example:
# PUBLIC_LOGIN_PAGE_MESSAGE="This is a demo instance of Immich.<br><br>Email: <i>demo@demo.de</i><br>Password: <i>demo</i>"
####################################################################################

PUBLIC_LOGIN_PAGE_MESSAGE=

####################################################################################
# Alternative Service Addresses - Optional
#
# This is an advanced feature for users who may be running their immich services on different hosts.
# It will not change which address or port that services bind to within their containers, but it will change where other services look for their peers.
# Note: immich-microservices is bound to 3002, but no references are made
####################################################################################

IMMICH_WEB_URL=http://immich-web:3000
IMMICH_SERVER_URL=http://immich-server:3001
IMMICH_MACHINE_LEARNING_URL=http://immich-machine-learning:3003

####################################################################################
# Alternative API's External Address - Optional
#
# This is an advanced feature used to control the public server endpoint returned to clients during Well-known discovery.
# You should only use this if you want mobile apps to access the immich API over a custom URL. Do not include trailing slash.
# NOTE: At this time, the web app will not be affected by this setting and will continue to use the relative path: /api
# Examples: http://localhost:3001, http://immich-api.example.com, etc
####################################################################################

IMMICH_API_URL_EXTERNAL=https://photos.redacted.tld

Reproduction steps

1. Download the iOS app in the latest version (v1.106.3) currently available.
2. Try to use the app to log in to an Immich server with v1.106.4
3. See the error message (screenshot above).

Relevant log output

No response

Additional information

If you need any additional information please let me know.

[alextran1502]

Can you try to access your instance over local ip?

[maxkratz]

Yes, even the usage of https://photos.redacted.tld within the Safari browser works as expected.
If I use the local IP with the custom port and enter it into the iOS app, I can log in.

[alextran1502]

So if it works with Local IP and not working with public DNS, then something might be going on with the reverse proxy. Despite the message, have you tried logging in anyway?

[maxkratz]

I've tried the login but the app just shows me a message similar to "check your URL, username, and password".

[maxkratz]

I've installed the latest update (from the iOS app store) and updated the server to the most recent version. Still no luck in logging in via the second iOS device. I've also ensured that the recommended reverse proxy settings were used in my reverse proxy config.

I've also configured the Immich iOS app to the "finest" log level but the logs only show entries like this:

• message: Pinging server with response code 200
• from: ApiService

Any other ideas?

[maxkratz]

I got it working now. @alextran1502, you were right, my reverse proxy configuration was breaking the login process of the iOS app. (Besides that I have no idea why it works on my primary iOS device, though.)

The Immich documentation page [1] does not mention that the Immich app must be able to access $host/.well-known/immich. After correcting this in my configuration, the login works as expected.

[1] https://immich.app/docs/administration/reverse-proxy/

[alban73]

Hello, I'm interesting in your answer. Cause I have the same problem since upgrade. What configuration did you exactly update, Nginx ? Because we are not dealing with a simple web server. When we deploy immich it comes with its own web server configuration with docker compose. The only things I can update is the Nginx reverse proxy conf, and as you've done, I did exactly what was mentionned in the documentation. Not enough. Thanks.

[maxkratz]

Hi @alban73!
In my setup, I have an nginx reverse proxy sitting in front of the Immich instance (because there are other services hosted in my network as well). Initially, I had something configured incorrectly in the sites-available config for Immich that had to do with the Lets Encrypt challenge. (My setup uses the LE www challenge and, therefore, the LE servers must be able to connect to my services with $service/.well-known/acme-challenge <- there was a mistake as my initial config served all requests to $service/.well-known, preventing the Immich clients from reaching Immich's well-known endpoint(s).

My current nginx configuration (for the reverse proxy in front of Immich) looks like this:

server {
        listen       80;
        listen  [::]:80; # IPv6
        server_name  $myURL;
        rewrite ^/(.*) https://$server_name/$1 permanent;
}

server {
        listen 443; #IPv4
        listen [::]:443; # IPv6
        ssl on;

        ssl_certificate /etc/letsencrypt/live/$myURL/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/$myURL/privkey.pem;

        root /var/www/html;
        server_name $myURL;
        proxy_set_header X-Forwarded-For $remote_addr;

        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
        server_tokens off;

        # set max upload size
        client_max_body_size 10G;

        # nginx for certbot stuff no.2
        location ^~ /.well-known/acme-challenge/ {
                root /var/www/html;
                try_files $uri $uri/;
                auth_basic off;
        }

        location / {
                # allow large file uploads
                client_max_body_size 50000M;

                # Set headers
                proxy_set_header Host              $http_host;
                proxy_set_header X-Real-IP         $remote_addr;
                proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;

                # enable websockets: http://nginx.org/en/docs/http/websocket.html
                proxy_http_version 1.1;
                proxy_set_header   Upgrade    $http_upgrade;
                proxy_set_header   Connection "upgrade";
                proxy_redirect     off;

                # set timeout
                proxy_read_timeout 600s;
                proxy_send_timeout 600s;
                send_timeout       600s;

                proxy_pass http://10.0.1.22:2283;
        }    
}

$myURL is a string containing my actual Immich service address (something like subdomain.domain.tld) and 10.0.1.22:2283 is the address of the virtual machine running Immich.

I hope my reply helped you fix your setup.