feat(photos): add Immich stack

Self-hosted photo backup at photos.ginnoir.com (internal/tailnet only).
Server + machine-learning + postgres (vectorchord) + redis.
Upload storage: /storage1/labdata/immich/upload (ZFS).
DB/model-cache: /config/immich/ (SSD).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Caddyfile

@@ -473,6 +473,14 @@ plane.ginnoir.com {
 	}
 }
 
+# =============================================================
+# PHOTOS — internal only
+# =============================================================
+photos.ginnoir.com {
+	import internal_only
+	reverse_proxy immich-server:2283
+}
+
 # =============================================================
 # NOTES / PKM — internal only (LiveSync over LAN or tailnet)
 # =============================================================

stacks/photos/docker-compose.yml

@@ -0,0 +1,64 @@
+# photos stack — Immich self-hosted photo backup.
+# Upload storage on ZFS (/storage1/labdata/immich/upload).
+# Config/DB on SSD (/config/immich/).
+# Internal-only: photos.ginnoir.com requires LAN or tailnet.
+
+services:
+  immich-server:
+    container_name: immich-server
+    image: ghcr.io/immich-app/immich-server:release
+    restart: unless-stopped
+    networks: [photos, edge]
+    env_file:
+      - stack.env
+    volumes:
+      - /storage1/labdata/immich/upload:/usr/src/app/upload
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - "2283:2283"
+    depends_on:
+      - immich-redis
+      - immich-postgres
+
+  immich-machine-learning:
+    container_name: immich-machine-learning
+    image: ghcr.io/immich-app/immich-machine-learning:release
+    restart: unless-stopped
+    networks: [photos]
+    env_file:
+      - stack.env
+    volumes:
+      - /config/immich/model-cache:/cache
+
+  immich-redis:
+    container_name: immich-redis
+    image: docker.io/redis:6.2-alpine
+    restart: unless-stopped
+    networks: [photos]
+    labels:
+      com.centurylabs.watchtower.enable: "false"
+
+  immich-postgres:
+    container_name: immich-postgres
+    image: ghcr.io/immich-app/postgres:14-vectorchord0.3.0-pgvectors0.3.0
+    restart: unless-stopped
+    networks: [photos]
+    env_file:
+      - stack.env
+    environment:
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_USER: ${DB_USERNAME}
+      POSTGRES_DB: ${DB_DATABASE_NAME}
+      POSTGRES_INITDB_ARGS: '--data-checksums'
+    volumes:
+      - /config/immich/pgdata:/var/lib/postgresql/data
+    labels:
+      com.centurylabs.watchtower.enable: "false"
+
+networks:
+  photos:
+    name: photos
+    driver: bridge
+  edge:
+    name: edge
+    external: true

stacks/photos/stack.env

@@ -0,0 +1,15 @@
+PUID=1000
+PGID=1000
+TZ=America/Chicago
+
+# Postgres
+DB_HOSTNAME=immich-postgres
+DB_USERNAME=immich
+DB_PASSWORD=UXhnm2Gzzlm2nmJP1xWbc5L3M9Dt9TpG
+DB_DATABASE_NAME=immich
+
+# Redis
+REDIS_HOSTNAME=immich-redis
+
+# Immich
+UPLOAD_LOCATION=/usr/src/app/upload