They have started implementing read-only folders for Immich with the latest release. And it does actually work pretty well.
However it currently is a very manual process via the command line (and not very well documented, especially for docker) and it has limited features as it does not automatically sync new images and does not remove deleted images from its database yet.
Thanks, I use Tailscale for various things. But I need direct Wireguard connections in this case. I know I can get it working via command line, I would prefer it on the GUI though or directly in network manager.