added Immich

README.md

@@ -46,6 +46,8 @@ handled separately — see [Exposing services](#exposing-services).
 | [gluetun](gluetun/) | 9880 | VPN kill switch with qBittorrent + pyload-ng inside it, plus HTTP/SOCKS proxies |
 | [heimdall](heimdall/) | 4080 | Dashboard / start page for the other services |
 | [httpserver](httpserver/) | 8083 | Bare nginx file share. Plain HTTP on purpose — works with very old clients |
+| [immich](immich/) | 2283 | Photo and video library with local ML search. Four containers, Postgres + VectorChord |
+| [librespeed](librespeed/) | 3011 | Self-hosted speed test. Measures the path to your box, not your ISP |
 | [jellyfin](jellyfin/) | 8096 | Media streaming. Also 7359/udp for auto-discovery |
 | [openwebui](openwebui/) | 3033 | LLM chat UI. One `OWUI_TAG` switches between CPU, CUDA and bundled-Ollama |
 | [overleaf](overleaf/) | 8020 | LaTeX editor. Four containers: app, Mongo (replica set), Redis, init |

immich/.env.example

@@ -0,0 +1,40 @@
+# Copy to .env and adjust. .env is git-ignored; this file is not.
+#
+# Immich is the one stack here where .env is NOT optional: compose.yaml
+# has `env_file: .env` on two services, so Compose refuses to start
+# without the file existing. It is also the application's own config, not
+# just a few variables Compose interpolates.
+#
+# This mirrors upstream's example.env for the pinned release. When you
+# update compose.yaml, re-fetch this too:
+#   curl -fLO https://github.com/immich-app/immich/releases/latest/download/example.env
+
+# ─── Storage ────────────────────────────────────────────────────────
+# Your photos and videos. Mounted at /data inside the container -- do not
+# change the container side, only this. This is the directory to back up.
+UPLOAD_LOCATION=./library
+
+# The Postgres data directory. Network shares (NFS/SMB) are NOT supported
+# here and will corrupt the database; it must be local storage.
+DB_DATA_LOCATION=./postgres
+
+# ─── Version ────────────────────────────────────────────────────────
+# Pin the MAJOR. Immich ships breaking changes between majors and the
+# compose file changes with them, so leaving this unset (which resolves
+# to `release`) means an unattended `docker compose pull` can jump a
+# major and leave your compose file behind. See the README.
+IMMICH_VERSION=v3
+
+# ─── Database ───────────────────────────────────────────────────────
+# Change this. Letters and digits only -- no special characters or
+# spaces, they break the connection string.
+#   openssl rand -base64 24 | tr -dc 'A-Za-z0-9' | head -c 32
+DB_PASSWORD=
+
+# ─── Optional ───────────────────────────────────────────────────────
+# Uncomment and set to a tz identifier if the server clock isn't right.
+#TZ=Europe/Paris
+
+# ─── Leave these alone ──────────────────────────────────────────────
+DB_USERNAME=postgres
+DB_DATABASE_NAME=immich

immich/README.md

@@ -0,0 +1,121 @@
+# Immich
+
+Self-hosted photo and video library. Phone backup that runs on your own disk,
+with the parts that make Google Photos worth using — face and object search,
+places, memories, shared albums — done locally by a machine-learning container.
+
+The heaviest stack in this repo: four containers, a Postgres with vector
+extensions, and a model cache. Budget a few GB of RAM and expect the first
+import to work the CPU hard.
+
+## Quick start
+
+```bash
+cp .env.example .env
+$EDITOR .env            # UPLOAD_LOCATION, DB_DATA_LOCATION, DB_PASSWORD
+docker compose up -d
+```
+
+Open `http://<host>:2283` and register. **The first account created is the
+admin** — there is no separate bootstrap step, so do this before the port is
+reachable by anyone else.
+
+## Ports
+
+| Port | Proto | Purpose |
+|------|-------|---------|
+| 2283 | http | Web UI, mobile app API, everything |
+
+Postgres and Valkey are reachable only on the stack's internal network.
+
+## Why it looks like this
+
+**This file is upstream's, verbatim, and should stay that way.** Immich ships a
+`docker-compose.yml` with each release, pins two of its images *by digest*, and
+changes the file between versions — the mount path, the Postgres extension
+build, added `shm_size`. Local edits turn every update into a three-way merge.
+The repo convention of `${VAR:-default}` is deliberately **not** applied here for
+the same reason: keeping it byte-identical to upstream means you can re-fetch and
+`diff` to see exactly what a release changed.
+
+```bash
+curl -fLo /tmp/immich-new.yml \
+  https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
+diff -u compose.yaml /tmp/immich-new.yml
+```
+
+Pinned at **v3.2.2** (released 2026-09-15).
+
+**Four containers.** `immich-server` is the API and web UI. `immich-machine-learning`
+runs the CLIP and face-detection models — it is separate because it is the part
+you might want on a GPU, and because its model cache is a named volume rather
+than something you back up. `database` is Postgres with **VectorChord**, which
+is what makes similarity search possible; a stock Postgres image will not work.
+`redis` is Valkey, the Redis fork, used as the job queue.
+
+**`env_file: .env` is a hard dependency.** Unlike every other stack here, where
+`.env` is optional because the compose file carries defaults, Compose will refuse
+to start this one if the file does not exist.
+
+**Images are digest-pinned** for Valkey and Postgres
+(`@sha256:…`), so those two are byte-identical to what upstream tested against
+this release. The Immich images themselves float on `${IMMICH_VERSION:-release}`
+— which is why pinning `IMMICH_VERSION` in `.env` matters.
+
+## Gotchas
+
+- **Pin `IMMICH_VERSION` to a major.** Unset, it resolves to `release`, so a
+  routine `docker compose pull` can carry you across a major version while your
+  compose file stays behind. Upstream's own `example.env` now sets
+  `IMMICH_VERSION=v3` for exactly this reason.
+- **The container media path changed, and it is easy to miss.** Older compose
+  files mount `${UPLOAD_LOCATION}:/usr/src/app/upload`; since **v1.140.0** it is
+  `${UPLOAD_LOCATION}:/data`, because `IMMICH_MEDIA_LOCATION` now defaults to
+  `/data`. Run a new image against an old compose file and the server looks for
+  your library at an unmounted path — it appears empty, and anything written
+  goes into the container and is lost when it is recreated. If you are adopting
+  this file over an older one, that mount line is the one to check first.
+- **`DB_DATA_LOCATION` must be local storage.** Not NFS, not SMB, not a
+  network share of any kind. Postgres on a network filesystem corrupts, and
+  upstream says so in the example env.
+- **Upgrading Postgres extensions is a real migration.** The image here is
+  `14-vectorchord0.4.3-pgvectors0.2.0`; moving from an older VectorChord build
+  makes Immich alter the database on first boot, which "can take seconds to
+  minutes". Back up `DB_DATA_LOCATION` before any version jump, and read
+  [the upgrade notes](https://docs.immich.app/install/upgrading/).
+- **`shm_size: 128mb` on the database is load-bearing**, not decoration.
+  Postgres uses shared memory for larger queries and Docker's 64 MB default is
+  not enough here. Upstream's upgrade guide lists adding it as a required step.
+- **`DB_STORAGE_TYPE: 'HDD'` is commented out** in the database environment.
+  Uncomment it if the Postgres data directory sits on a spinning disk — it tunes
+  the planner's assumptions about random reads. Leave it alone on SSD or NVMe.
+- **Back up `UPLOAD_LOCATION` and `DB_DATA_LOCATION` together.** The files are
+  the photos; the database holds every album, face cluster, share and edit.
+  Either alone is most of a disaster.
+- **The first import is expensive.** Machine learning runs over the whole
+  library once. On a low-power box expect it to saturate the CPU for hours —
+  the same caveat as [copyparty](../copyparty/README.md) on an N100, and worth
+  scheduling rather than discovering.
+
+## Exposing it
+
+The mobile apps talk to the same port as the browser, so whatever you put in
+front has to work for both.
+
+- [Reverse proxy with Caddy](../docs/reverse-proxy.md) — the normal route.
+  Raise the upload body limit or large videos fail on the way in.
+- [Cloudflare Tunnel](../cloudflare-tunnel/) — **the ~100 MB body cap is exactly
+  the wrong limit for this.** A phone's 4K video will exceed it. Read
+  [the limits](../docs/cloudflare-tunnel.md) first.
+- [Single sign-on with Authentik](../docs/authentik-sso.md) — Immich speaks OIDC
+  natively, so use that rather than forward auth, which would break every mobile
+  client. Keep a local admin account until the flow is proven.
+
+## Links
+
+- Install guide: <https://docs.immich.app/install/docker-compose>
+- Release compose file: <https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml>
+- Environment variables: <https://docs.immich.app/install/environment-variables>
+- Upgrading: <https://docs.immich.app/install/upgrading/>
+- Hardware-accelerated ML: <https://docs.immich.app/features/ml-hardware-acceleration>
+- Compose builder: <https://immich.app/docker-compose-builder>

immich/compose.yaml

@@ -0,0 +1,76 @@
+#
+# WARNING: To install Immich, follow our guide: https://docs.immich.app/install/docker-compose
+#
+# Make sure to use the docker-compose.yml of the current release:
+#
+# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
+#
+# The compose file on main may not be compatible with the latest release.
+
+name: immich
+
+services:
+  immich-server:
+    container_name: immich_server
+    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
+    # extends:
+    #   file: hwaccel.transcoding.yml
+    #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
+    volumes:
+      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
+      - ${UPLOAD_LOCATION}:/data
+      - /etc/localtime:/etc/localtime:ro
+    env_file:
+      - .env
+    ports:
+      - '2283:2283'
+    depends_on:
+      - redis
+      - database
+    restart: always
+    healthcheck:
+      disable: false
+
+  immich-machine-learning:
+    container_name: immich_machine_learning
+    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
+    # Example tag: ${IMMICH_VERSION:-release}-cuda
+    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
+    # extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
+    #   file: hwaccel.ml.yml
+    #   service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
+    volumes:
+      - model-cache:/cache
+    env_file:
+      - .env
+    restart: always
+    healthcheck:
+      disable: false
+
+  redis:
+    container_name: immich_redis
+    image: docker.io/valkey/valkey:9@sha256:70739f85ad2ee01a726a965584a0f94895f01b0c60b3cc8b0aeef11eaa6888cf
+    healthcheck:
+      test: redis-cli ping | grep -q PONG || exit 1
+    restart: always
+
+  database:
+    container_name: immich_postgres
+    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
+    environment:
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_USER: ${DB_USERNAME}
+      POSTGRES_DB: ${DB_DATABASE_NAME}
+      POSTGRES_INITDB_ARGS: '--data-checksums'
+      # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
+      # DB_STORAGE_TYPE: 'HDD'
+    volumes:
+      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
+      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
+    shm_size: 128mb
+    restart: always
+    healthcheck:
+      disable: false
+
+volumes:
+  model-cache:

librespeed/.env.example

@@ -0,0 +1,50 @@
+# Copy to .env and adjust. .env is git-ignored; this file is not.
+#
+# NOTE: compose.yaml currently sets these values literally in its
+# `environment:` block, so nothing here is read yet. Switch a line to
+# ${VAR} in compose.yaml to start using it -- worth doing for the two
+# marked SECRET below, which should never sit in a committed file.
+
+# ─── Basics ─────────────────────────────────────────────────────────
+#TITLE=LibreSpeed
+#TAGLINE=
+# Port on the host; the container always listens on WEBPORT (8080).
+#PORT=3011
+
+# ─── Telemetry: off by default ──────────────────────────────────────
+# Turn this on and results are stored -- which needs a database AND a
+# volume, neither of which compose.yaml has today. See the README.
+#TELEMETRY=false
+
+# SECRET. Protects the stats page at /results/stats.php. Required once
+# telemetry is on, or anyone can read every result.
+#PASSWORD=
+
+# Shown in the privacy policy as the contact for deletion requests.
+# Required for a production install with telemetry. NOTE: the old EMAIL
+# variable is deprecated -- this is the current name.
+#GDPR_EMAIL=you@example.com
+
+# Telemetry logs client IPs unless you turn this on.
+#REDACT_IP_ADDRESSES=false
+#ENABLE_ID_OBFUSCATION=false
+# 2-byte hex, e.g. 0x1234abcd. Random if unset -- which means IDs change
+# every restart.
+#OBFUSCATION_SALT=
+
+# ─── Database (only when TELEMETRY=true) ────────────────────────────
+# sqlite needs /database mounted or results vanish on recreate.
+#DB_TYPE=sqlite
+#DB_NAME=
+#DB_HOSTNAME=
+#DB_PORT=
+#DB_USERNAME=
+#DB_PASSWORD=
+
+# ─── ISP name and distance ──────────────────────────────────────────
+# SECRET. From ipinfo.io. Without it there is no ISP name, and DISTANCE
+# does nothing.
+#IPINFO_APIKEY=
+#DISABLE_IPINFO=false
+# km, mi, or empty to hide it. Needs IPINFO_APIKEY.
+#DISTANCE=km

librespeed/README.md

@@ -0,0 +1,93 @@
+# LibreSpeed
+
+A speed test you host yourself. One container, no Flash, no Java, no account —
+open the page and it measures the link between the browser and *your* server.
+
+That last part is the whole point and the whole catch: this does not tell you
+how fast your internet is. It tells you how fast the path to this box is, which
+is the more useful number when you are debugging your own LAN, your VPN, or a
+neighbour's Wi-Fi — and a meaningless one if you point it through a CDN.
+
+## Quick start
+
+```bash
+docker compose up -d
+```
+
+Open `http://<host>:3011`. There is nothing to configure and no `.env` needed
+for the default read-only setup — see [`.env.example`](.env.example) for what
+becomes relevant once you turn telemetry on.
+
+## Ports
+
+| Host | Container | Purpose |
+|------|-----------|---------|
+| 3011 | 8080 | Web UI and the test endpoints |
+
+The container port follows `WEBPORT`, which defaults to 8080.
+
+## Why it looks like this
+
+**`MODE: standalone`** means one container is both the page and the test
+endpoint. The alternatives matter only at scale: `backend` is a bare test point,
+`frontend` serves a UI that talks to a list of remote backends, and `dual` is
+both. For a single box, standalone is the whole story.
+
+**No volumes, because telemetry is off.** With `TELEMETRY` unset the container
+stores nothing and is entirely disposable — `docker compose down` costs you
+nothing. The moment you enable it, that stops being true; see the gotchas.
+
+**Most of the environment block is commented out on purpose.** It is upstream's
+menu of options kept close to hand, which is more useful in a file you revisit
+once a year than a link to documentation.
+
+## Gotchas
+
+- **Turning on telemetry needs a volume that isn't there.** `TELEMETRY: "true"`
+  stores results in sqlite by default, inside the container, at `/database`.
+  With no volume mounted the results survive restarts but vanish the moment the
+  container is recreated — which is to say, on the next `docker compose pull`.
+  Add `- ./data:/database` before enabling it.
+- **Telemetry also wants `PASSWORD`**, which protects the stats page at
+  `/results/stats.php`. Without it, anyone who finds the URL can read every
+  result you've recorded, including client IPs.
+- **`EMAIL` is deprecated — the current name is `GDPR_EMAIL`.** It is the
+  address shown in the privacy policy for deletion requests, and upstream
+  considers it required for a production install with telemetry on. The
+  commented block in `compose.yaml` still uses the old name.
+- **Results log client IP addresses by default.** `REDACT_IP_ADDRESSES: "true"`
+  turns that off. Worth thinking about before you hand the URL to guests.
+- **`DISTANCE` does nothing without `IPINFO_APIKEY`**, and that key is a
+  credential — it belongs in `.env` and a `${IPINFO_APIKEY}` reference, never in
+  the committed compose file.
+- **A slow result may be your server, not your network.** The test works by
+  generating and swallowing garbage data, so on a low-power host the CPU can cap
+  the number before the link does. If you see a suspiciously round ceiling,
+  check `docker stats` while a test runs — the same trap as
+  [copyparty on an N100](../copyparty/README.md).
+- **`:latest` is unpinned.** Note the Docker tags drop the `v` that the git tags
+  carry: the release is `v6.3.0`, the image tag is **`6.3.0`** (also `6.3`, `6`,
+  and `-alpine` variants of each). Pinning `v6.3.0` fails with a manifest error
+  that looks like a network problem.
+- **`restart: always` rather than `unless-stopped`**, so a deliberate stop does
+  not survive a reboot. The rest of this repo uses the latter.
+
+## Exposing it
+
+- [Reverse proxy with Caddy](../docs/reverse-proxy.md) — works, but understand
+  what you are then measuring: the path to the proxy, shaped by whatever the
+  proxy does. For a LAN test, reach it directly by IP and skip the proxy.
+- [Cloudflare Tunnel](../cloudflare-tunnel/) — **no.** This is a tool whose job
+  is to move as many gigabytes as it can for as long as you let it. Putting it
+  behind a tunnel produces a number that measures Cloudflare, while pushing
+  bulk transfer through a service not meant to carry it.
+- [Single sign-on with Authentik](../docs/authentik-sso.md) — forward auth fits
+  fine; it is a browser-only app with no accounts of its own. Sensible if this
+  faces the internet, though a public speed test is also a free bandwidth sink
+  for whoever finds it.
+
+## Links
+
+- Upstream: <https://github.com/librespeed/speedtest>
+- Docker options: <https://github.com/librespeed/speedtest/blob/master/doc_docker.md>
+- Image: <https://github.com/librespeed/speedtest/pkgs/container/speedtest>

librespeed/compose.yaml

@@ -0,0 +1,19 @@
+services:
+  speedtest:
+    container_name: speedtest
+    image: ghcr.io/librespeed/speedtest:latest
+    restart: unless-stopped
+    environment:
+      MODE: standalone
+      TITLE: "Gooyban's Speed Meter"
+      #TELEMETRY: "false"
+      #ENABLE_ID_OBFUSCATION: "false"
+      #REDACT_IP_ADDRESSES: "false"
+      #PASSWORD:
+      #GDPR_EMAIL::
+      #DISABLE_IPINFO: "false"
+      #IPINFO_APIKEY: "your api key"
+      #DISTANCE: "km"
+      #WEBPORT: 8080
+    ports:
+      - "3011:8080" # webport mapping (host:container)