SKYHOUSE.dev Journal

Why: Documenting an active service that pre-dates the journal — captured during the 2026-05 audit so the cheat sheet has a citation target.

Immich is a self-hosted photo and video backup platform, serving as the household replacement for Google Photos. The full stack runs as four coordinated Docker containers managed from a single Compose project. It was already live and healthy when the 2026-05 audit ran; this entry records what exists, not what we changed.

1. The four containers

All four containers live under the Compose project at /home/plex/immich-app and share the immich_default Docker network. As of the audit, every container reported healthy:

• immich_server — main application server (ghcr.io/immich-app/immich-server:v2). Handles uploads, the web UI, and the REST API. Listens internally on port 2283.
• immich_machine_learning — ML inference sidecar (facial recognition, CLIP embeddings, smart search). Runs on-host CPU; no GPU passthrough configured.
• immich_postgres — PostgreSQL with the pgvector extension. All photo metadata and ML vectors land here. Data directory is set via ${DB_DATA_LOCATION} in the project's .env file.
• immich_redis — Valkey 9 (Redis-compatible) for job queuing and session caching.

2. Public access via NPM

Nginx Proxy Manager proxy host 26 (26.conf) routes photos.skyhouse.dev → 192.168.1.136:2283. The TLS certificate is npm-41. There is no additional IP allowlist on the proxy host — Immich's own login page is the sole gate. The service is externally reachable at https://photos.skyhouse.dev for authenticated users.

3. Configuration and secrets

The Compose project's .env file at /home/plex/immich-app/.env holds the database password, the DB_DATA_LOCATION path, and any other runtime secrets. The audit did not open this file; refer to it directly for the actual values. The database is not port-mapped to the host — it is only reachable inside the immich_default bridge network.

Immich was the only service on the server with a dedicated ML sidecar; everything else is stateless containers or native systemd services.