Initial commit: Ultimate Notetaking, Sync & Backup System

A NixOS-based system for managing personal data across three tiers:
- Tier 1: Configuration (shareable via git)
- Tier 2: Syncable data (nb + Syncthing)
- Tier 3: Large data (self-hosted services + backup)

Includes:
- NixOS modules for nb, Syncthing, backup (restic)
- Server modules for Forgejo, Immich, Jellyfin
- Helper scripts (usync, ustatus)
- Comprehensive documentation

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

modules/server/immich.nix

@@ -0,0 +1,93 @@
+# Immich Module
+#
+# Self-hosted photo and video backup (Google Photos alternative).
+# For Tier 3 photo management.
+#
+# Note: Immich is complex and changes frequently. This module provides
+# a starting point but may need updates. Check NixOS options for latest.
+#
+# Usage:
+#   services.immich-managed.enable = true;
+#   services.immich-managed.domain = "photos.yourdomain.com";
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.immich-managed;
+in {
+  options.services.immich-managed = {
+    enable = mkEnableOption "managed Immich photo service";
+
+    domain = mkOption {
+      type = types.str;
+      description = "Domain name for Immich.";
+      example = "photos.example.com";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 2283;
+      description = "Port for Immich web interface.";
+    };
+
+    mediaLocation = mkOption {
+      type = types.str;
+      default = "/var/lib/immich";
+      description = "Location for storing photos and videos.";
+    };
+
+    externalLibraryPaths = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      description = "Additional paths for external photo libraries.";
+      example = [ "/mnt/photos/archive" ];
+    };
+
+    enableMachineLearning = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Enable ML features (face recognition, search).";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Immich service (NixOS 24.05+)
+    services.immich = {
+      enable = true;
+      port = cfg.port;
+      mediaLocation = cfg.mediaLocation;
+
+      # Machine learning (optional, resource-intensive)
+      machine-learning.enable = cfg.enableMachineLearning;
+
+      # Settings
+      settings = {
+        # Add any Immich-specific settings here
+        # Check Immich docs for available options
+      };
+    };
+
+    # Ensure media directory exists with correct permissions
+    systemd.tmpfiles.rules = [
+      "d ${cfg.mediaLocation} 0755 immich immich -"
+    ] ++ (map (path: "d ${path} 0755 immich immich -") cfg.externalLibraryPaths);
+
+    # Backup Immich data
+    services.backup.paths = mkIf config.services.backup.enable [
+      cfg.mediaLocation
+      "/var/lib/immich"  # Database and config
+    ];
+
+    # Memory recommendation
+    warnings = mkIf (cfg.enableMachineLearning && config.hardware.cpu.intel.updateMicrocode or false) [
+      "Immich ML features benefit from GPU acceleration. Consider enabling CUDA or OpenCL."
+    ];
+
+    # Reverse proxy example (Caddy)
+    # services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
+    #   reverse_proxy localhost:${toString cfg.port}
+    # '';
+  };
+}