Sync infra config: HA/Zabbix relocation, Immich storage move, new services

Accumulated uncommitted infra changes:
- Caddyfile: repoint HA/Zabbix to 192.168.1.4/.3, add ~20 new site routes
- Immich: move media to /mnt/smsg, enable CUDA ML, mem limits, rewrite backup.sh
- Add service stacks: agap-mcp, anki, family, freshrss, iperf3, kanboard,
  linkwarden, qbittorrent, radicale, syncthing, vikunja, windows
- openwebui: enable API keys; ollama: drop CPU fallback
- seafile/zabbix: extra_hosts entries; matrix: add user juris
- Remove pihole stack and stale wiki/migrate.py
- Ignore marketplace-mcp (standalone repo) and linkwarden runtime data

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LeqyaxJF2nbRXJtae2kNB2

immich-app/.env

@@ -5,9 +5,9 @@
 # You can find documentation for all the supported env variables at https://docs.immich.app/install/environment-variables
 
 # The location where your uploaded files are stored
-UPLOAD_LOCATION=/mnt/media/upload
-THUMB_LOCATION=/mnt/ssd/media/thumbs
-ENCODED_VIDEO_LOCATION=/mnt/ssd/media/encoded-video
+UPLOAD_LOCATION=/mnt/smsg/media/upload
+THUMB_LOCATION=/mnt/smsg/media/thumbs
+ENCODED_VIDEO_LOCATION=/mnt/smsg/media/encoded-video
 
 # The location where your database files are stored. Network shares are not supported for the database
 DB_DATA_LOCATION=/mnt/ssd/media/postgres

immich-app/backup.sh

@@ -1,30 +1,42 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-BACKUP_DIR=/mnt/backups/media
-DB_BACKUP_DIR="$BACKUP_DIR/backups"
+BACKUP_DIR=/mnt/toshiba/backups/media
 LOG="$BACKUP_DIR/backup.log"
-RETAIN_DAYS=14
+VERBOSE=0
 
-mkdir -p "$DB_BACKUP_DIR"
-
-echo "[$(date)] Starting Immich backup" >> "$LOG"
-
-# 1. Database dump (must come before file sync)
-DUMP_FILE="$DB_BACKUP_DIR/immich-db-$(date +%Y%m%dT%H%M%S).sql.gz"
-docker exec immich_postgres pg_dump --clean --if-exists \
-  --dbname=immich --username=postgres | gzip > "$DUMP_FILE"
-echo "[$(date)] DB dump: $DUMP_FILE" >> "$LOG"
-
-# 2. Rsync critical asset folders (skip thumbs and encoded-video — regeneratable)
-for DIR in library upload profile; do
-  rsync -a --delete /mnt/media/upload/$DIR/ "$BACKUP_DIR/$DIR/" >> "$LOG" 2>&1
-  echo "[$(date)] Synced $DIR" >> "$LOG"
+for arg in "$@"; do
+  case $arg in
+    -v|--verbose) VERBOSE=1 ;;
+  esac
 done
 
-# 3. Remove old DB dumps
-find "$DB_BACKUP_DIR" -name "immich-db-*.sql.gz" -mtime +$RETAIN_DAYS -delete
-echo "[$(date)] Cleaned dumps older than ${RETAIN_DAYS}d" >> "$LOG"
+log() { echo "[$(date)] $*" >> "$LOG"; }
+say() { [[ $VERBOSE -eq 1 ]] && echo "$*" || true; }
+
+
+mkdir -p "$BACKUP_DIR"
+
+say ""
+say "┌─────────────────────────────────────┐"
+say "│        Immich Backup Starting        │"
+say "└─────────────────────────────────────┘"
+say ""
+log "Starting Immich backup"
+
+# Rsync critical asset folders (skip thumbs and encoded-video — regeneratable)
+RSYNC_OPTS="-a --ignore-existing"
+[[ $VERBOSE -eq 1 ]] && RSYNC_OPTS="$RSYNC_OPTS --info=progress2"
+
+for DIR in library upload profile; do
+  say "  Syncing $DIR/ ..."
+  rsync $RSYNC_OPTS /mnt/smsg/media/upload/$DIR/ "$BACKUP_DIR/$DIR/" 2>&1 | \
+    tee -a "$LOG" | { [[ $VERBOSE -eq 0 ]] && cat > /dev/null || cat; }
+  log "Synced $DIR"
+  say ""
+done
 
 touch "$BACKUP_DIR/.last_sync"
-echo "[$(date)] Immich backup complete" >> "$LOG"
+log "Immich backup complete"
+say "✓ Done"
+say ""

immich-app/docker-compose.yml

@@ -30,6 +30,7 @@ services:
       - redis
       - database
     restart: always
+    mem_limit: 1500m
     healthcheck:
       disable: false
 
@@ -37,15 +38,16 @@ services:
     container_name: immich_machine_learning
     # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
     # Example tag: ${IMMICH_VERSION:-release}-cuda
-    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
-    # extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
-    #   file: hwaccel.ml.yml
-    #   service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
+    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}-cuda
+    extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
+      file: hwaccel.ml.yml
+      service: cuda # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
     volumes:
       - model-cache:/cache
     env_file:
       - .env
     restart: always
+    mem_limit: 750m
     healthcheck:
       disable: false
 
@@ -55,6 +57,7 @@ services:
     healthcheck:
       test: redis-cli ping || exit 1
     restart: always
+    mem_limit: 256m
 
   database:
     container_name: immich_postgres
@@ -71,6 +74,7 @@ services:
       - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
     shm_size: 128mb
     restart: always
+    mem_limit: 1500m
 
 volumes:
   model-cache:

immich-app/hwaccel.ml.yml

@@ -0,0 +1,57 @@
+# Configurations for hardware-accelerated machine learning
+
+# If using Unraid or another platform that doesn't allow multiple Compose files,
+# you can inline the config for a backend by copying its contents
+# into the immich-machine-learning service in the docker-compose.yml file.
+
+# See https://docs.immich.app/features/ml-hardware-acceleration for info on usage.
+
+services:
+  armnn:
+    devices:
+      - /dev/mali0:/dev/mali0
+    volumes:
+      - /lib/firmware/mali_csffw.bin:/lib/firmware/mali_csffw.bin:ro # Mali firmware for your chipset (not always required depending on the driver)
+      - /usr/lib/libmali.so:/usr/lib/libmali.so:ro # Mali driver for your chipset (always required)
+
+  rknn:
+    security_opt:
+      - systempaths=unconfined
+      - apparmor=unconfined
+    devices:
+      - /dev/dri:/dev/dri
+
+  cpu: {}
+
+  cuda:
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: 1
+              capabilities:
+                - gpu
+
+  rocm:
+    group_add:
+      - video
+    devices:
+      - /dev/dri:/dev/dri
+      - /dev/kfd:/dev/kfd
+
+  openvino:
+    device_cgroup_rules:
+      - 'c 189:* rmw'
+    devices:
+      - /dev/dri:/dev/dri
+    volumes:
+      - /dev/bus/usb:/dev/bus/usb
+
+  openvino-wsl:
+    devices:
+      - /dev/dri:/dev/dri
+      - /dev/dxg:/dev/dxg
+    volumes:
+      - /dev/bus/usb:/dev/bus/usb
+      - /usr/lib/wsl:/usr/lib/wsl