Have you checked tailscale? a one click wireguard, free for quite a lot of devices. there is a project to selfhost the control server https://headscale.net/

I’d try to stick to the official recommendations to backup immich: https://immich.app/docs/administration/backup-and-restore/

I’ve being dealing recently with issues related to DNS resolution in docker containers. Are you using by any chance pihole as well?

it looks like they don’t contemplate to migrate (yet).