I've learned to live with having WireGuard/Tailscale on all the time on my own devices. But for giving (extended) family & friends access to shared albums with Immich, it's too impractical to configure and explain widely. I've been using a Cloudflare Tunnel for this situation with their "Zero Trust" email-based authentication. It probably won't work with the Immich mobile app though, since I doubt that client can handle Cloudflare's interstitial login screen.