Family Photo Library: Ingest, Compare, Backup, Restore

Design for decades, not demos

Family photos outlive gadgets. Success is: relatives can open last Christmas on a phone, and you can restore a known album after disk loss. Feature demos without export and restore are museums.

Pick a stack: Immich vs PhotoPrism vs Nextcloud Photos

Immich is a multi-container stack (API, Postgres, Redis, optional ML). Budget RAM if face clustering is on; disable ML features you will not explain.

PhotoPrism leads on indexing/search; understand RAW+JPEG before importing a DSLR archive.

Nextcloud Photos wins when one login and one backup job matter more than gallery polish.

Ingest contract (write it down)

Decide how phones upload (app / WebDAV / folder), when phone deletes are allowed, and where DSLR imports land. Changing ingest mid-year creates duplicate libraries that never fully merge.

Example contract: Wi-Fi-only mobile app upload; DSLR to `/imports/inbox` weekly; nothing deleted from phone until verified in the gallery.

Dedup without deleting the wrong file

Hash dedup can treat edits/bursts as duplicates. Dry-run / report-only first; quarantine contested deletes for weeks before permanent remove.

# pre-dedup sanity
find /mnt/photos/library -type f \( -iname '*.jpg' -o -iname '*.heic' \) | wc -l

Sharing and permissions

Shared links should expire. Separate "relatives" from "public internet." Audit active links quarterly. Prefer VPN for admin tasks (user create, library delete).

Face databases are sensitive household data — agree norms before enabling recognition.

Storage layout

Originals on reliable disks; DB/ML cache on SSD; derivatives rebuildable. Document paths in STACK.md so backups include originals, not only thumbs.

[Add real environment data here]
Host / OS:
Photo app + version:
Originals path:
DB volume path:
Approx library size:
Phones in scope:

Backup (metadata + originals)

Backup Postgres (or app DB) and the originals volume together. Thumbnails often regenerate; originals do not. Offsite encrypted copy of both.

Checksum-only confidence is not enough — restore a known album and open it on a phone.

Restore drill

Quarterly: restore DB + known album to scratch compose, open three photos on iOS and Android, time it. If restore exceeds acceptable downtime, fix backup scope before adding video libraries.

# shape only — pin tags you tested
services:
  immich-server:
    image: ghcr.io/immich-app/immich-server:release
    volumes:
      - /mnt/photos/library:/usr/src/app/upload
    networks: [internal]
  database:
    image: tensorchord/pgvecto-rs:pg14-v0.2.0
    volumes: [pgdata:/var/lib/postgresql/data]
    networks: [internal]

Always run the user journey after upgrades — healthchecks can be green while mobile upload is broken.

Migration / cutover

Keep one phone on the old cloud until the self-hosted stack survives a week of real uploads. Parallel runs catch HEIC/live-photo/timezone bugs before you delete SaaS copies.

Export originals intact before you trust any gallery DB.

Related reading

See Restore drill playbook, Automatic SSL certificates, Secure remote access, Docker Compose hardening, and Family handoff documentation.