Add monitoring profile: Grafana + Prometheus + Loki + Alloy

Native NixOS modules under my.profiles.monitoring, enabled on jupiter.
Grafana provisions datasources/dashboards/alert rules from the
grafana-content flake input (rechberg dashboards repo). Prometheus
scrapes host + stack (90d), Loki+Alloy ship the systemd journal (90d).
Grafana LAN-only :3000, anonymous viewer, admin password + secret_key
via /etc/grafana file providers.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CZJkwCnSbykq9rRTTeHc6b

CLAUDE.md

@@ -0,0 +1,92 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Commands
+
+```bash
+# Apply configuration (switch/boot/test)
+sudo nixos-rebuild switch --flake '.#jupiter'
+sudo nixos-rebuild switch --flake '.#mibook'
+
+# Build without switching (CI-style check)
+nix build '.#nixosConfigurations.jupiter.config.system.build.toplevel'
+
+# Update all flake inputs
+nix flake update
+
+# Format Nix files
+nixfmt-rfc-style <file>   # or: find . -name '*.nix' | xargs nixfmt-rfc-style
+```
+
+## Architecture
+
+This is a flake-parts NixOS configuration for two machines:
+
+- **jupiter** — home server running media/automation services
+- **mibook** — laptop running KDE desktop + development tools
+
+### Module Loading Chain
+
+```
+flake.nix
+└── machines/configuration.nix        # flake-parts module; defines nixosConfigurations
+    ├── machines/core/                 # base modules applied to every machine
+    │   ├── core.nix                   # system packages, locale, timezone
+    │   ├── network.nix
+    │   ├── nix.nix
+    │   └── users.nix
+    ├── modules/                       # custom NixOS option modules (my.profiles.*, my.hardware.*, my.services.*)
+    │   ├── environments/              # per-service/app profiles
+    │   ├── hardware/                  # hardware profiles (nvidia, bluetooth, sound, wifi)
+    │   └── services/                  # infrastructure services (vpn, webserver)
+    └── machines/<name>/
+        ├── configuration.nix          # machine-specific NixOS settings
+        ├── environments.nix           # enables profiles via my.profiles.* / my.hardware.* options
+        ├── disks.nix
+        └── hardware-configuration.nix
+```
+
+### Profile / Module Pattern
+
+Every module under `modules/` follows the same structure:
+
+```nix
+{ config, lib, pkgs, ... }:
+let cfg = config.my.profiles.<name>; in
+{
+  options.my.profiles.<name>.enable = lib.mkEnableOption "...";
+  config = lib.mkIf cfg.enable { ... };
+}
+```
+
+Namespaces in use:
+- `my.profiles.*` — application/service profiles
+- `my.hardware.*` — hardware profiles
+- `my.services.*` — infrastructure services
+
+Profiles are enabled per-machine in `machines/<name>/environments.nix`.
+
+### Unstable Packages
+
+`pkgs.unstable` is available everywhere via an overlay defined in `machines/configuration.nix`. Use it when a package isn't in the pinned stable channel (`nixpkgs/nixos-25.11`).
+
+### Homepage Dashboard Integration
+
+Modules that expose a web UI can self-register with the homepage dashboard by adding to `my.homepage.services`:
+
+```nix
+my.homepage.services = [{
+  group = "Services";
+  name = "My Service";
+  description = "...";
+  href = "http://${hostName}:PORT";
+  icon = "si-iconname";  # optional
+}];
+```
+
+### Adding a New Service Module
+
+1. Create `modules/environments/<name>/default.nix` following the profile pattern above.
+2. Add `./environments/<name>` to `modules/environments/default.nix` (or the relevant `default.nix`).
+3. Enable it in the target machine's `machines/<name>/environments.nix`.

docs/superpowers/plans/2026-07-26-jellyfin-hw-transcoding.md

@@ -0,0 +1,154 @@
+# Jellyfin Hardware Transcoding (jupiter) Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Give jupiter's Jellyfin service access to the Intel iGPU's VAAPI render node so Quick Sync hardware transcoding can be enabled, instead of every transcode falling back to CPU.
+
+**Architecture:** One NixOS module change (`modules/environments/jellyfin/default.nix`) grants the `jellyfin` systemd service supplementary access to the `video`/`render` groups and installs `libva-utils` for verification. This is declarative and build-verifiable from the Mac. Enabling Quick Sync inside Jellyfin's own dashboard, and the on-machine verification, is a manual step run by the user on jupiter after deploy — the NixOS module has no option for it and this environment's convention is that the assistant never SSHes into jupiter directly (see `docs/superpowers/specs/2026-07-26-jellyfin-hw-transcoding.md`).
+
+**Tech Stack:** NixOS (flake-parts), nixpkgs `services.jellyfin` module, VAAPI/`intel-media-driver`, `libva-utils`.
+
+## Global Constraints
+
+- No SSH from the assistant into jupiter — all on-machine commands are given to the user to run and paste back.
+- Follow the existing profile pattern in `modules/environments/jellyfin/default.nix` (`config = lib.mkIf cfg.enable { ... }`); don't introduce a new toggle option — hardcode the hardware-acceleration wiring on, per the approved spec.
+- Verify locally via `nix eval` / `nix build` before asking the user to deploy.
+
+---
+
+### Task 1: Grant Jellyfin access to the iGPU and verify the build
+
+**Files:**
+- Modify: `modules/environments/jellyfin/default.nix`
+
+**Interfaces:**
+- Produces: `systemd.services.jellyfin.serviceConfig.SupplementaryGroups = [ "video" "render" ];` — verified via `nix eval` in Step 2.
+
+- [ ] **Step 1: Add the device-access config and `libva-utils` package**
+
+Read the current file first (`modules/environments/jellyfin/default.nix`), then edit the `config = lib.mkIf cfg.enable { ... }` block so it reads:
+
+```nix
+  config = lib.mkIf cfg.enable {
+    services.jellyfin = {
+      enable = true;
+      openFirewall = true;
+    };
+
+    environment.systemPackages = [ pkgs.libva-utils ];
+
+    my.homepage.services = [
+      {
+        group = "Media";
+        name = "Jellyfin";
+        description = "Media server";
+        href = "http://${hostName}:${toString port}";
+        icon = "jellyfin.png";
+      }
+    ];
+
+    systemd.services.jellyfin = {
+      after = [ "network-online.target" ];
+      serviceConfig.SupplementaryGroups = [
+        "video"
+        "render"
+      ];
+    };
+  };
+```
+
+Note the two existing `systemd.services.jellyfin` keys (`after`) and the new `serviceConfig.SupplementaryGroups` now live in the same attrset — don't create a second `systemd.services.jellyfin = { ... }` block, it would overwrite the first.
+
+- [ ] **Step 2: Verify the rendered config with `nix eval`**
+
+Run (from the repo root on the Mac):
+
+```bash
+nix eval '.#nixosConfigurations.jupiter.config.systemd.services.jellyfin.serviceConfig.SupplementaryGroups' \
+  --extra-experimental-features 'nix-command flakes'
+```
+
+Expected output: `[ "video" "render" ]`
+
+- [ ] **Step 3: Verify the machine still builds**
+
+Run:
+
+```bash
+nix build '.#nixosConfigurations.jupiter.config.system.build.toplevel' \
+  --extra-experimental-features 'nix-command flakes' --no-link
+```
+
+Expected: build succeeds with no errors (may take a while; watch for any evaluation error mentioning `jellyfin` or `libva-utils`).
+
+- [ ] **Step 4: Format and commit**
+
+```bash
+nixfmt-rfc-style modules/environments/jellyfin/default.nix
+git add modules/environments/jellyfin/default.nix
+git commit -m "feat(jellyfin): grant iGPU access for Quick Sync hardware transcoding"
+```
+
+---
+
+### Task 2: Deploy on jupiter and enable Quick Sync (user-executed)
+
+**Files:** none (on-machine deploy + Jellyfin dashboard UI)
+
+**Interfaces:**
+- Consumes: the `SupplementaryGroups` change from Task 1, already merged into the flake.
+
+These steps run **on jupiter**, by the user — paste the output back so we can confirm each one before moving to the next.
+
+- [ ] **Step 1: Deploy**
+
+```bash
+sudo nixos-rebuild switch --flake '.#jupiter'
+```
+
+Expected: switch succeeds, no errors mentioning `jellyfin`.
+
+- [ ] **Step 2: Confirm the service picked up the new groups**
+
+```bash
+systemctl show jellyfin -p SupplementaryGroups
+systemctl status jellyfin --no-pager
+```
+
+Expected: `SupplementaryGroups=video render` (order may vary) and the service is `active (running)`.
+
+- [ ] **Step 3: Confirm VAAPI driver loads**
+
+```bash
+vainfo
+```
+
+Expected: output starts with something like `vainfo: VA-API version: 1.x` and `Driver version: Intel iHD driver`, followed by a list of supported VAProfiles/VAEntrypoints (e.g. `VAProfileH264Main : VAEntrypointVLD`, `VAEntrypointEncSlice`).
+
+If this instead prints a permissions or "no VA display" error, paste it back — that means the group grant isn't reaching the process and Task 1 needs a follow-up fix (e.g. the jellyfin service may be more sandboxed than expected, requiring an explicit `DeviceAllow=char-drm rw` in `serviceConfig` as well).
+
+- [ ] **Step 4: Enable Quick Sync in the Jellyfin dashboard**
+
+In the Jellyfin web UI:
+1. **Dashboard → Playback**.
+2. Hardware acceleration: **Intel QuickSync (QSV)**.
+3. VA-API device: `/dev/dri/renderD128`.
+4. Enable hardware decoding for the codecs your library uses (H264 at minimum).
+5. If the library has HDR content, enable tone-mapping.
+6. Save.
+
+- [ ] **Step 5: Functional check**
+
+Play a file that requires transcoding (or force a lower quality in the client's playback settings to trigger one), then:
+
+```bash
+journalctl -u jellyfin -n 50 --no-pager
+```
+
+Look for a line referencing `qsv` or `vaapi` in the transcode command. Separately, watch CPU usage (`htop`) during playback — it should stay low on the core doing the transcode, rather than pegging at 100%, since the iGPU is now doing the encode/decode work.
+
+## Self-Review Notes
+
+- Spec coverage: NixOS change (Task 1) ✓, manual dashboard step (Task 2 Step 4) ✓, verification via `vainfo`/build (Task 1 Step 2-3, Task 2 Step 3) ✓, functional check (Task 2 Step 5) ✓. Toggle option explicitly excluded per approved spec — not present, correctly.
+- No placeholders — every step has literal commands/code.
+- `SupplementaryGroups` key/value matches exactly between Task 1 (produced) and Task 2 (consumed/checked).

docs/superpowers/plans/2026-08-05-immich-nixos-module.md

@@ -0,0 +1,299 @@
+# Immich NixOS Module Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+>
+> **Note on nature:** Task 1 is repo work verifiable with `nix build` (no runtime tests exist for declarative config). Tasks 2–6 are a **manual migration runbook executed on jupiter by the operator** — they are destructive and cannot be run from the dev machine (mibook). Do not attempt to automate or execute Tasks 2–6 from an agent session; present them for the operator to run and confirm.
+
+**Goal:** Replace jupiter's docker-compose Immich with the native `services.immich` NixOS module, preserving all data (albums, faces, shares, library).
+
+**Architecture:** A standard `my.profiles.immich` module wraps `services.immich` (native Postgres+VectorChord over unix socket, Redis, server, machine-learning). Media stays at the default local `/var/lib/immich`. The existing docker Postgres dump is restored same-version (2.7.5 → 2.7.5, no schema/vector migration). GPU is exposed for VAAPI/QSV transcoding.
+
+**Tech Stack:** NixOS (flake-parts), `services.immich` from nixpkgs 25.11, PostgreSQL, Intel QSV/VAAPI, docker (source only).
+
+## Global Constraints
+
+- Machine: **jupiter** only. Do not enable on mibook.
+- Immich version: source docker == target nixpkgs == **2.7.5** (stable). No `package` override. Do NOT bump nixpkgs Immich during this work.
+- Media location: default `/var/lib/immich` (local disk). Do not point at the NAS.
+- Database: local PostgreSQL over **unix socket + peer auth** — no password, no sops secret.
+- HW accel: **video transcoding only**. ML stays on CPU (`machine-learning.enable = true`, no OpenVINO).
+- Access: LAN + VPN, `openFirewall = true`, port **2283**. No reverse proxy/TLS.
+- Rebuild command: `sudo nixos-rebuild switch --flake '.#jupiter'`.
+- Build-check command: `nix build '.#nixosConfigurations.jupiter.config.system.build.toplevel'`.
+- Format Nix with `nixfmt-rfc-style` before committing.
+- Do not delete docker DB or upload data until Task 6 sign-off.
+
+---
+
+## File Structure
+
+- **Create** `modules/environments/immich/default.nix` — the `my.profiles.immich` module (single responsibility: declare Immich).
+- **Modify** `modules/environments/default.nix` — add `./environments/immich` to the import list.
+- **Modify** `machines/jupiter/environments.nix` — set `immich.enable = true`.
+
+No other files change. The DB/media migration touches only runtime state on jupiter, not the repo.
+
+---
+
+### Task 1: Author the `immich` profile module
+
+**Files:**
+- Create: `modules/environments/immich/default.nix`
+- Modify: `modules/environments/default.nix` (import list)
+- Modify: `machines/jupiter/environments.nix` (`my.profiles.immich.enable`)
+
+**Interfaces:**
+- Produces: NixOS option `my.profiles.immich.enable` (bool). When true, configures `services.immich`, adds `immich` user to `video`/`render` groups, and appends an entry to `my.homepage.services`.
+- Consumes: existing `my.homepage.services` aggregator; `config.networking.hostName`.
+
+- [ ] **Step 1: Read a reference module to match repo style**
+
+Read `modules/environments/jellyfin/default.nix` (same shape: `cfg`, `hostName`, `port`, `mkIf`, `my.homepage.services`). Match its formatting and header-comment convention.
+
+- [ ] **Step 2: Create the module file**
+
+Create `modules/environments/immich/default.nix`:
+
+```nix
+# Immich self-hosted photo & video server
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.my.profiles.immich;
+  hostName = config.networking.hostName;
+  port = 2283;
+in
+{
+  options.my.profiles.immich = with lib; {
+    enable = mkEnableOption "Immich photo server";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.immich = {
+      enable = true;
+      host = "0.0.0.0";
+      inherit port;
+      openFirewall = true;
+      mediaLocation = "/var/lib/immich";
+      machine-learning.enable = true;
+      accelerationDevices = [ "/dev/dri/renderD128" ];
+      settings.server.externalDomain = "http://${hostName}:${toString port}";
+    };
+
+    # The native module does not add GPU groups; required for VAAPI/QSV transcoding.
+    users.users.immich.extraGroups = [
+      "video"
+      "render"
+    ];
+
+    my.homepage.services = [
+      {
+        group = "Media";
+        name = "Immich";
+        description = "Photo & video server";
+        href = "http://${hostName}:${toString port}";
+        icon = "immich.png";
+      }
+    ];
+  };
+}
+```
+
+- [ ] **Step 3: Register the module in the environments import list**
+
+Open `modules/environments/default.nix` and add `./environments/immich` (or `./immich`, matching the exact relative style already used in that file — check how `jellyfin` is listed and mirror it).
+
+- [ ] **Step 4: Enable it on jupiter**
+
+In `machines/jupiter/environments.nix`, inside the `my.profiles = { ... }` block, add:
+
+```nix
+    immich.enable = true;
+```
+
+- [ ] **Step 5: Format**
+
+Run: `nixfmt-rfc-style modules/environments/immich/default.nix`
+
+- [ ] **Step 6: Build-check (this is the "test")**
+
+Run: `nix build '.#nixosConfigurations.jupiter.config.system.build.toplevel'`
+Expected: builds successfully. If it fails on an unknown option (e.g. `accelerationDevices`, `settings.server.externalDomain`), reconcile against the module at `$(nix eval --raw '.#nixosConfigurations.jupiter.pkgs.path')/nixos/modules/services/web-apps/immich.nix` and fix.
+
+- [ ] **Step 7: Confirm the option evaluates on**
+
+Run: `nix eval '.#nixosConfigurations.jupiter.config.services.immich.enable'`
+Expected: `true`
+
+- [ ] **Step 8: Commit**
+
+```bash
+git add modules/environments/immich/default.nix modules/environments/default.nix machines/jupiter/environments.nix
+git commit -m "feat(jupiter): add native Immich profile module"
+```
+
+---
+
+### Task 2: Pre-flight & backup on jupiter (operator-run)
+
+**Files:** none (runtime state on jupiter). Run all commands on jupiter.
+
+**Interfaces:**
+- Produces: `immich-db.sql` dump file and a known-good copy/snapshot of the docker upload folder; recorded `UPLOAD_LOCATION` path and DB container name.
+
+- [ ] **Step 1: Record docker facts**
+
+From the docker-compose dir on jupiter, note `UPLOAD_LOCATION`, the DB service/container name, and `POSTGRES_USER`/`POSTGRES_DB` from `.env`/compose. Confirm server version is **2.7.5** (web UI footer or `docker exec <server> immich --version`). If it is not 2.7.5, STOP — this plan assumes a same-version restore.
+
+- [ ] **Step 2: Stop the docker stack (DB may stay up for the dump)**
+
+Run: `docker compose stop immich-server immich-machine-learning` (leave the DB container running).
+
+- [ ] **Step 3: Dump the database**
+
+Run: `docker exec -t <db-container> pg_dumpall --clean --if-exists --username=<POSTGRES_USER> > ~/immich-db.sql`
+Expected: a non-trivial `immich-db.sql` (check it is not near-empty: `wc -l ~/immich-db.sql`).
+
+- [ ] **Step 4: Stop the DB and record the media size**
+
+Run: `docker compose down` then `du -sh <UPLOAD_LOCATION>` and note the size. Do NOT copy yet. Do NOT delete anything.
+
+---
+
+### Task 3: First switch — let the module create empty state (operator-run)
+
+**Files:** none at runtime (repo change already committed in Task 1). Run on jupiter after pulling the committed branch.
+
+**Interfaces:**
+- Consumes: `immich-db.sql`, `UPLOAD_LOCATION` from Task 2.
+- Produces: an `immich` system user, an empty `immich` Postgres DB + role, and `/var/lib/immich` created with correct ownership, with services then stopped.
+
+- [ ] **Step 1: Deploy the config**
+
+On jupiter, check out the branch containing Task 1's commit and run:
+`sudo nixos-rebuild switch --flake '.#jupiter'`
+Expected: `immich-server`, `immich-machine-learning`, postgres, and redis units come up; UI reachable at `http://jupiter:2283` showing a fresh/empty instance.
+
+- [ ] **Step 2: Stop immich so data can be swapped underneath**
+
+Run: `sudo systemctl stop immich-server immich-machine-learning`
+Expected: both inactive. PostgreSQL and Redis stay running.
+
+- [ ] **Step 3: Verify the DB and user exist**
+
+Run: `sudo -u postgres psql -c '\l' | grep immich` and `sudo -u postgres psql -c '\du' | grep immich`
+Expected: an `immich` database and `immich` role are present.
+
+---
+
+### Task 4: Restore database and media (operator-run, destructive)
+
+**Files:** none in repo. Run on jupiter. This overwrites the freshly-created empty DB.
+
+**Interfaces:**
+- Consumes: `immich-db.sql`, `<UPLOAD_LOCATION>`, the running NixOS PostgreSQL.
+- Produces: the migrated DB and populated `/var/lib/immich`.
+
+- [ ] **Step 1: Restore the dump into the NixOS Postgres**
+
+`pg_dumpall` output includes role/DB creation. Load it as the `postgres` superuser over the unix socket:
+Run: `sudo -u postgres psql -f ~/immich-db.sql`
+Expected: completes without fatal errors. Harmless "role already exists"/"database already exists" notices are OK because of `--clean --if-exists`. If the immich DB ends up owned by the wrong role, reassign: `sudo -u postgres psql -c 'ALTER DATABASE immich OWNER TO immich;'`.
+
+- [ ] **Step 2: Sanity-check the restored data**
+
+Run: `sudo -u postgres psql -d immich -c 'SELECT count(*) FROM assets;'`
+Expected: a count matching your library size (non-zero). If the table name differs by version, list tables with `\dt` and check an obviously-populated one.
+
+- [ ] **Step 3: Move the media into the default location**
+
+Immich's upload folder holds subdirs `library/ upload/ thumbs/ encoded-video/ profile/ backups/`. Move (not copy, if same filesystem) the contents of `<UPLOAD_LOCATION>` into `/var/lib/immich`:
+Run: `sudo rsync -aHAX --info=progress2 <UPLOAD_LOCATION>/ /var/lib/immich/`
+(Use `rsync` — safe if partially interrupted. Keep the source until Task 6 sign-off.)
+
+- [ ] **Step 4: Fix ownership**
+
+Run: `sudo chown -R immich:immich /var/lib/immich`
+Expected: everything under `/var/lib/immich` owned by `immich`.
+
+---
+
+### Task 5: Start and verify (operator-run)
+
+**Files:** none. Run on jupiter.
+
+**Interfaces:**
+- Consumes: migrated DB + media from Task 4.
+- Produces: a running, verified native Immich.
+
+- [ ] **Step 1: Start the server and watch logs**
+
+Run: `sudo systemctl start immich-server && journalctl -u immich-server -f`
+Expected: it connects to the DB, runs same-version startup checks (no destructive migration since 2.7.5==2.7.5), and reports listening on 2283. Leave the follow running through the next step.
+
+- [ ] **Step 2: Start machine-learning**
+
+Run: `sudo systemctl start immich-machine-learning`
+Expected: active, no crash loop in `journalctl -u immich-machine-learning`.
+
+- [ ] **Step 3: Functional spot-check in the web UI**
+
+At `http://jupiter:2283`: log in with an existing account; confirm the timeline loads; open an **album**; open the **People/faces** view; open a **shared link**; open one photo so a **thumbnail and its full original both load** (this proves DB↔file paths align after the media move).
+Expected: all present, images render.
+
+- [ ] **Step 4: Confirm homepage dashboard tile**
+
+Open the homepage dashboard; confirm the Immich tile appears under "Media" and links to `http://jupiter:2283`.
+
+- [ ] **Step 5: Enable and verify hardware transcoding**
+
+In Immich **Administration → Settings → Video Transcoding**, set hardware acceleration to **Quick Sync** (QSV) (or VAAPI). Trigger a transcode (upload/play a video that needs transcoding, or run the transcoding job). Then:
+Run: `journalctl -u immich-server | grep -iE 'qsv|vaapi|hwaccel|transcode'`
+Expected: log shows the hardware path in use, not a CPU-fallback error. Confirm `/dev/dri/renderD128` is accessible to the service (the `video`/`render` groups + `accelerationDevices` from Task 1 handle this).
+
+---
+
+### Task 6: Sign-off and cleanup (operator-run)
+
+**Files:** none in repo. Merge the branch; then, only after a confidence window, remove docker.
+
+**Interfaces:**
+- Consumes: a verified running instance (Task 5).
+
+- [ ] **Step 1: Merge the feature branch**
+
+Open a PR from `feat/immich-nixos-module` into `main` and merge it (repo convention: PRs via the Gitea remote).
+
+- [ ] **Step 2: Confidence window**
+
+Use Immich normally for a few days. Keep the docker `<UPLOAD_LOCATION>` source copy and `~/immich-db.sql` untouched as the rollback path.
+
+- [ ] **Step 3: Rollback (only if needed, before cleanup)**
+
+If something is wrong: `sudo systemctl stop immich-server immich-machine-learning`, set `immich.enable = false` (or check out the pre-migration commit), `sudo nixos-rebuild switch --flake '.#jupiter'`, then `docker compose up -d` in the old stack. Original docker DB + upload folder are intact until Step 4.
+
+- [ ] **Step 4: Cleanup (after sign-off)**
+
+Remove the docker Immich stack (`docker compose down --rmi all --volumes` in the old dir if the DB volume is dedicated — verify first), delete the now-duplicated `<UPLOAD_LOCATION>` source, and remove `~/immich-db.sql`. Optionally disable the `docker` profile on jupiter if Immich was its only consumer (check other services first — jupiter's `docker.enable` may still be needed).
+
+---
+
+## Self-Review
+
+**Spec coverage:**
+- Native `services.immich` → Task 1. ✓
+- Version target 2.7.5==stable, no override → Global Constraints + Task 2 Step 1. ✓
+- Media at default `/var/lib/immich` → Task 1 + Task 4 Step 3. ✓
+- DB migrate keep-everything → Tasks 2–4. ✓
+- HW transcoding only → Task 1 (`accelerationDevices`, groups) + Task 5 Step 5. ✓
+- LAN+VPN, port 2283, openFirewall, homepage tile → Task 1 + Task 5 Steps 3–4. ✓
+- Rollback path → Task 6 Step 3. ✓
+- Deferred (OpenVINO/NAS/proxy) → correctly absent. ✓
+
+**Placeholder scan:** No TBD/TODO; every command is concrete. Placeholders like `<db-container>`, `<UPLOAD_LOCATION>`, `<POSTGRES_USER>` are runtime values the operator reads in Task 2 Step 1 — intentional, not gaps.
+
+**Type consistency:** Option name `my.profiles.immich.enable` and path `/var/lib/immich` used consistently across all tasks. Media subfolder list matches between Task 4 Step 3 and the spec.

docs/superpowers/specs/2026-07-26-jellyfin-hw-transcoding.md

@@ -0,0 +1,145 @@
+# Intel Quick Sync hardware transcoding for Jellyfin on jupiter
+
+## Problem
+
+Jellyfin streams stutter on jupiter whenever a client needs a transcode
+(unsupported codec/container, bitrate cap, or a client that can't
+direct-play). Transcoding currently runs entirely on CPU.
+
+jupiter's Intel iGPU is already usable at the OS level:
+
+- `hardware.graphics.enable = true` with `intel-media-driver` (the `iHD`
+  VAAPI driver) is configured in
+  `machines/jupiter/hardware-configuration.nix:20-27`.
+- The commented-out `i915.force_probe = "9a49"` kernel param there
+  corresponds to a Quick-Sync-capable Intel UHD iGPU, confirming the
+  hardware supports it.
+
+But `modules/environments/jellyfin/default.nix` never grants the
+`jellyfin` systemd service access to `/dev/dri`, so Jellyfin has no path
+to the GPU and silently falls back to software transcoding.
+
+## Goal
+
+Give the Jellyfin service access to the iGPU's VAAPI render node, so
+Quick Sync can be enabled in Jellyfin's own dashboard and transcodes are
+offloaded from the CPU.
+
+## Non-goals
+
+- Remote/external access or reverse-proxy tuning.
+- General CPU/RAM headroom review of jupiter.
+- A toggle option (`my.profiles.jellyfin.hardwareAcceleration.enable`) —
+  jupiter only has the one iGPU, so this is hardcoded on rather than
+  made configurable.
+
+## Design
+
+### NixOS change (declarative)
+
+In `modules/environments/jellyfin/default.nix`, inside the existing
+`config = lib.mkIf cfg.enable { ... }` block, grant the systemd service
+supplementary access to the `video` and `render` groups (the groups that
+own `/dev/dri/card*` and `/dev/dri/renderD*`):
+
+```nix
+systemd.services.jellyfin.serviceConfig.SupplementaryGroups = [
+  "video"
+  "render"
+];
+```
+
+This is additive to the existing `systemd.services.jellyfin.after = [
+"network-online.target" ];` block already in the file — both apply to
+the same service.
+
+Also add `libva-utils` to `environment.systemPackages` (or scoped to
+this module) so `vainfo` is available on jupiter to verify the driver
+loads correctly.
+
+### Manual step (not declarative)
+
+Jellyfin stores its transcoding/hardware-acceleration choice in its own
+internal `encoding.xml`, which the NixOS module does not expose as an
+option. After deploying the Nix change, one-time manual configuration in
+the Jellyfin dashboard is required:
+
+1. **Dashboard → Playback**.
+2. Hardware acceleration: **Intel QuickSync (QSV)**.
+3. VA-API device: `/dev/dri/renderD128`.
+4. Enable hardware decoding for the codecs your library actually uses
+   (H264 at minimum; HEVC/VP9 depending on iGPU generation).
+5. If any HDR content exists in the library, enable tone-mapping — this
+   is one of the more CPU-expensive operations Quick Sync can offload.
+
+## Verification
+
+Build-time (from the Mac, no SSH needed):
+
+```
+nix eval '.#nixosConfigurations.jupiter.config.systemd.services.jellyfin.serviceConfig.SupplementaryGroups' \
+  --extra-experimental-features 'nix-command flakes'
+```
+
+Expect `[ "video" "render" ]`.
+
+On jupiter after `sudo nixos-rebuild switch --flake '.#jupiter'`:
+
+```
+systemctl status jellyfin
+journalctl -u jellyfin -n 50 --no-pager
+vainfo
+```
+
+`vainfo` should list the `iHD` driver and print supported VAEntrypoints
+(VLD decode / encode profiles for H264/HEVC).
+
+Functional check: play a file on a client that forces transcoding (or
+force it manually via Jellyfin's playback quality setting), then in
+Jellyfin's dashboard **Activity/Now Playing** panel confirm the
+transcode reason and check that CPU usage on jupiter (`htop`) stays low
+during playback rather than pegging a core — Quick Sync offload should
+show up as low CPU, some GPU (`intel_gpu_top`) activity instead.
+
+## Open items
+
+- Exact supported codec list depends on the iGPU generation (device ID
+  `9a49`) — confirm via `vainfo` output once run, and enable only the
+  hardware decode paths it actually reports.
+
+## Post-deploy fix: two additional runtime packages required
+
+After the initial deploy (Task 1's `SupplementaryGroups` grant) and
+enabling QSV in the dashboard, HEVC HDR playback hung indefinitely
+(Direct Play worked for some titles; titles that needed a real
+transcode+tonemap never produced output). Root-caused via
+`journalctl -u jellyfin` and the per-session ffmpeg transcode log
+(`find / -xdev -iname '*ffmpeg-transcode*'`) — two separate runtimes
+were missing beyond `intel-media-driver` (which only provides VAAPI):
+
+1. **QSV session creation failed:** `Error creating a MFX session: -9`
+   / `Error initializing an MFX session: -3` on
+   `-init_hw_device qsv=qs@va`. VAAPI and QSV are separate runtimes on
+   Linux — QSV needs the oneVPL/MFX GPU implementation. Fix: added
+   `pkgs.vpl-gpu-rt` ("oneAPI Video Processing Library Intel GPU
+   implementation"; note `onevpl-intel-gpu` is the old, renamed
+   attribute) to `hardware.graphics.extraPackages` in
+   `machines/jupiter/hardware-configuration.nix`.
+
+2. **OpenCL device creation failed:** `Failed to get number of OpenCL
+   platforms: -1001` (`CL_PLATFORM_NOT_FOUND_KHR`) on
+   `-init_hw_device opencl=ocl@va`. The `tonemap_opencl` filter jellyfin
+   uses for HDR→SDR tone-mapping needs a working OpenCL ICD, which
+   nothing installed so far provides. Fix: added
+   `pkgs.intel-compute-runtime` ("Intel Graphics Compute Runtime oneAPI
+   Level Zero and OpenCL, supporting 12th Gen and newer" — matches
+   jupiter's Tiger Lake/Xe iGPU) to the same `extraPackages` list.
+
+Confirmed working end-to-end: HEVC HDR transcode with QSV encode +
+OpenCL tone-map runs at `speed=2.68x` realtime on jupiter's iGPU, and
+plays smoothly on Apple TV (JellyTV app).
+
+Both packages live in `machines/jupiter/hardware-configuration.nix`
+(`hardware.graphics.extraPackages`), alongside `intel-media-driver`,
+rather than in the jellyfin module itself — they're iGPU runtime
+capabilities, not something specific to the jellyfin service.

docs/superpowers/specs/2026-08-05-immich-nixos-module-design.md

@@ -0,0 +1,121 @@
+# Immich: Docker → NixOS module migration
+
+**Date:** 2026-08-05
+**Machine:** jupiter (home server, Intel iGPU)
+**Status:** Design approved, pending implementation plan
+
+## Goal
+
+Replace the existing docker-compose Immich deployment on jupiter with the
+native `services.immich` NixOS module, wrapped in the repo's standard
+`my.profiles.*` pattern. Preserve all existing data (albums, faces, shared
+links, metadata) and photo/video library.
+
+## Decisions
+
+| Topic | Decision |
+|-------|----------|
+| Approach | Native `services.immich` (nixpkgs), not `oci-containers` |
+| Version target | **Resolved: docker runs 2.7.5 == stable nixpkgs 2.7.5.** Use the stable module as-is; no `package` override. Same-version restore, no forward schema migration |
+| Media location | Default local path `/var/lib/immich`. NAS deferred to a future read-only external library |
+| Database | Migrate via dump/restore — keep everything |
+| HW acceleration | Video transcoding only (VAAPI/QSV via existing Intel graphics stack). ML on CPU |
+| Access | LAN + VPN only: open port 2283, register on homepage dashboard. No reverse proxy/TLS |
+
+### Deliberately deferred (YAGNI)
+- OpenVINO ML acceleration
+- NAS-backed external library
+- Reverse proxy / TLS / public hostname
+
+## Part 1 — The module
+
+New file `modules/environments/immich/default.nix` following the profile
+pattern; add `./environments/immich` to `modules/environments/default.nix`;
+enable `my.profiles.immich.enable = true` in
+`machines/jupiter/environments.nix`.
+
+```nix
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.my.profiles.immich;
+  hostName = config.networking.hostName;
+  port = 2283;
+in {
+  options.my.profiles.immich.enable = lib.mkEnableOption "Immich photo server";
+
+  config = lib.mkIf cfg.enable {
+    services.immich = {
+      enable = true;
+      # package = pkgs.unstable.immich;   # only if docker :release is > 2.7.5
+      host = "0.0.0.0";
+      inherit port;
+      openFirewall = true;
+      mediaLocation = "/var/lib/immich";
+      machine-learning.enable = true;
+      accelerationDevices = [ "/dev/dri/renderD128" ];
+      settings.server.externalDomain = "http://${hostName}:${toString port}";
+    };
+
+    # native module does not add GPU groups; needed for VAAPI/QSV transcoding
+    users.users.immich.extraGroups = [ "video" "render" ];
+
+    my.homepage.services = [{
+      group = "Media";
+      name = "Immich";
+      description = "Photo & video server";
+      href = "http://${hostName}:${toString port}";
+      icon = "immich.png";
+    }];
+  };
+}
+```
+
+**Provided for free by the native module:** local PostgreSQL with the required
+vector extension over a **unix socket + peer auth** (so no DB password / sops
+secret needed), Redis, `immich-server` and `immich-machine-learning` systemd
+units, the `immich` system user, and `mediaLocation` created via tmpfiles.
+
+**Transcoding is two parts:** (a) NixOS exposes the GPU device + `video`/`render`
+groups (above); (b) the hwaccel backend (QSV/VAAPI) is chosen in Immich's
+**admin → video transcoding** settings after cutover — a UI toggle, not Nix.
+
+## Part 2 — Migration runbook (on jupiter)
+
+### Pre-flight (hard blocker)
+1. Get running docker Immich version (`docker exec <server> immich --version` or web UI footer).
+2. **Resolved 2026-08-05: running version is 2.7.5, equal to stable nixpkgs.**
+   Use the stable module as-is (no `package` override). Kept for reference:
+   - running ≤ 2.7.5 → stable module as-is ← **this case**
+   - 2.7.6–3.0.3 → set `package = pkgs.unstable.immich`
+   - `> 3.0.3` → bump nixpkgs first; **stop and re-plan**
+3. Record docker `UPLOAD_LOCATION` and DB container name/credentials.
+
+### Backup (before touching anything)
+4. `docker compose down` (DB may stay up for the dump).
+5. Dump DB: `docker exec -t <db> pg_dumpall --clean --if-exists --username=postgres > immich-db.sql`
+6. Verify upload folder intact; note size (no copy yet).
+
+### Cutover
+7. Add the module to jupiter's `environments.nix` (leave `database.createDB` default).
+8. `sudo nixos-rebuild switch --flake '.#jupiter'` → creates user, empty DB + role, `mediaLocation`. Then `systemctl stop immich-server immich-machine-learning`.
+9. Restore the DB into the NixOS Postgres (drop the freshly-created empty `immich` DB, load `immich-db.sql`) per Immich's restore docs.
+10. Move media into `/var/lib/immich` (subfolders `library/`, `upload/`, `thumbs/`, `encoded-video/`, `profile/`); `chown -R immich:immich /var/lib/immich`.
+11. `systemctl start immich-server`; it runs schema migrations forward. Watch `journalctl -u immich-server -f`.
+
+### Verify
+12. UI at `http://jupiter:2283` loads; log in; spot-check albums, faces, a shared link, and that thumbnails/originals actually load.
+13. Homepage tile works.
+14. Enable QSV/VAAPI in admin settings; transcode one video; confirm `journalctl` shows the hw path, not a CPU fallback error.
+
+### Rollback
+Before deleting any docker data: `systemctl stop immich-*`, disable the profile,
+`nixos-rebuild switch`, `docker compose up -d`. Original docker DB + upload
+folder remain untouched until explicitly removed after a few days of confidence.
+
+## Known risk — RESOLVED
+
+The main risk was step 9 crossing the **pgvecto.rs → VectorChord** vector-extension
+boundary. With source and target both at **2.7.5**, both use VectorChord — no
+boundary crossing and no forward schema migration. The restore is a same-version
+dump/load. Residual risk is limited to routine dump/restore mechanics
+(roles, extension availability in the NixOS Postgres, ownership on restore).

flake.lock

@@ -21,11 +21,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1777988971,
-        "narHash": "sha256-qIoWPDs+0/8JecyYgE3gpKQxW/4bLW/gp45vow9ioCQ=",
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "0678d8986be1661af6bb555f3489f2fdfc31f6ff",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -42,11 +42,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -60,20 +60,17 @@
         "flake-compat": [
           "nix"
         ],
-        "gitignore": [
-          "nix"
-        ],
         "nixpkgs": [
           "nix",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1776796298,
-        "narHash": "sha256-PcRvlWayisPSjd0UcRQbhG8Oqw78AcPE6x872cPRHN8=",
+        "lastModified": 1783008725,
+        "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "3cfd774b0a530725a077e17354fbdb87ea1c4aad",
+        "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe",
         "type": "github"
       },
       "original": {
@@ -82,6 +79,22 @@
         "type": "github"
       }
     },
+    "grafana-content": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1785940786,
+        "narHash": "sha256-flH5pwYtB3QWnZ/OYJKoj9twb1fxYrowr9FCh8L1GMY=",
+        "ref": "refs/heads/master",
+        "rev": "4017b678ffa3bde4136a3468f18f1eb3bba52374",
+        "revCount": 1,
+        "type": "git",
+        "url": "ssh://git@rechberg.online:222/finn.markwitz/dashboards.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://git@rechberg.online:222/finn.markwitz/dashboards.git"
+      }
+    },
     "nix": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -92,11 +105,11 @@
         "nixpkgs-regression": "nixpkgs-regression"
       },
       "locked": {
-        "lastModified": 1778249748,
-        "narHash": "sha256-D+3kaW4NUUaiFTsEpmregtGZVniljBThg/O0JIjRL8k=",
+        "lastModified": 1784762557,
+        "narHash": "sha256-R/r6jRnANV50c8F5Fz5+1Q1moab0IGWRk+cg5ME2nMY=",
         "owner": "NixOS",
         "repo": "nix",
-        "rev": "616df97974fd29b79f83502f63854d6d471ee055",
+        "rev": "d10c84cd0cc0efdcb29cf2611caf5fbcd10fa071",
         "type": "github"
       },
       "original": {
@@ -142,12 +155,15 @@
       }
     },
     "nixos-hardware": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
       "locked": {
-        "lastModified": 1778143761,
-        "narHash": "sha256-lkesY6x2X2qxlqLM7CT2iM/0rP2JB7fruPN3h8POXmI=",
+        "lastModified": 1784723954,
+        "narHash": "sha256-1CfD8ZUjCkTgjsneLZ/lxCHhgDfqxxE7/GX0MmsgiqA=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "3bcaa367d4c550d687a17ac792fd5cda214ee871",
+        "rev": "a017f5b72210026af5b3ac5949f08d94380a6fbd",
         "type": "github"
       },
       "original": {
@@ -158,15 +174,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771903837,
-        "narHash": "sha256-jEA8WggGKtMFeNeCKq3NK8cLEjJmG6/RLUElYYbBZ0E=",
-        "rev": "e764fc9a405871f1f6ca3d1394fb422e0a0c3951",
+        "lastModified": 1783148766,
+        "narHash": "sha256-H9+N+GFtsbVC8ZniHliChM7ndizxtqVZs6bnGOLM3WQ=",
+        "rev": "a50de1b7d8a586adc18d2395c19de7d6058e6030",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/25.11/nixos-25.11.6495.e764fc9a4058/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.4193.a50de1b7d8a5/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://channels.nixos.org/nixos-25.11/nixexprs.tar.xz"
+        "url": "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz"
       }
     },
     "nixpkgs-23-11": {
@@ -187,11 +203,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1777168982,
-        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
+        "lastModified": 1782614948,
+        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
+        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
         "type": "github"
       },
       "original": {
@@ -218,12 +234,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1777954456,
-        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
-        "type": "github"
+        "lastModified": 1784796856,
+        "narHash": "sha256-vwxWgF+Gj276WznzGb1LxGsK/39HaQwgQXiU3EkC844=",
+        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1040357.e2587caef70c/nixexprs.tar.xz"
       },
       "original": {
         "id": "nixpkgs",
@@ -233,26 +248,39 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1778003029,
-        "narHash": "sha256-q/nkKLDtHIyLjZpKhWk3cSK5IYsFqtMd6UtXF3ddjgA=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "0c88e1f2bdb93d5999019e99cb0e61e1fe2af4c5",
-        "type": "github"
+        "lastModified": 1767892417,
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1784707089,
+        "narHash": "sha256-DUedXhD2Rg8q4Xyd07Sb90eZGy4gg6W+Vl/WbLNwAZo=",
+        "rev": "b3fe9581c9061c749abef42b6d4ee7b7c05c33fa",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.5845.b3fe9581c906/nixexprs.tar.xz"
       },
       "original": {
         "id": "nixpkgs",
-        "ref": "nixos-25.11",
+        "ref": "nixos-26.05",
         "type": "indirect"
       }
     },
     "root": {
       "inputs": {
         "flake-parts": "flake-parts",
+        "grafana-content": "grafana-content",
         "nix": "nix",
         "nixos-generators": "nixos-generators",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_3",
         "nixpkgs-unstable": "nixpkgs-unstable"
       }
     }

flake.nix

@@ -3,7 +3,7 @@
 
   inputs = {
     nix.url = "github:NixOS/nix";
-    nixpkgs.url = "nixpkgs/nixos-25.11";
+    nixpkgs.url = "nixpkgs/nixos-26.05";
     nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
     flake-parts.url = "github:hercules-ci/flake-parts";
     nixos-hardware.url = "github:NixOS/nixos-hardware";
@@ -11,7 +11,12 @@
       url = "github:nix-community/nixos-generators";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    # hyprland.url = "github:hyprwm/Hyprland";
+
+    # Grafana content (dashboards, datasources, alert rules) — provisioned from the store.
+    grafana-content = {
+      url = "git+ssh://git@rechberg.online:222/finn.markwitz/dashboards.git";
+      flake = false;
+    };
 
   };
 

machines/jupiter/configuration.nix

@@ -10,7 +10,7 @@
     ./disks.nix
     ./hardware-configuration.nix
     ./environments.nix
-#    ./network.nix
+    ./network.nix
   ];
 
   networking.hostName = "jupiter";

machines/jupiter/environments.nix

@@ -21,6 +21,8 @@ in
     sonarr.enable = true;
     jellyfin.enable = true;
     jellyseerr.enable = true;
+    immich.enable = true;
+    monitoring.enable = true;
     development.enable = true;
     home-assistant.enable = true;
 

machines/jupiter/hardware-configuration.nix

@@ -35,6 +35,8 @@
       #vaapiIntel         # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
       libva-vdpau-driver
       libvdpau-va-gl
+      vpl-gpu-rt # oneVPL/MFX runtime, required for QSV (h264_qsv/hevc_qsv) session creation
+      intel-compute-runtime # OpenCL runtime, required for tonemap_opencl (HDR tone-mapping)
     ];
   };
 

machines/mibook/configuration.nix

@@ -10,6 +10,7 @@
     ./disks.nix
     ./hardware-configuration.nix
     ./environments.nix
+    ./network.nix
     # ./system.nix use docker here
   ];
 
@@ -36,7 +37,7 @@
 
 
   hardware.nvidia.prime = {
-    sync.enable = true;
+    sync.enable = false;
 
     nvidiaBusId = "PCI:01:00:0";
     intelBusId = "PCI:00:2:0";
@@ -44,6 +45,14 @@
 
   services.openssh.enable = true;
 
+  # KDE (PowerDevil) power settings: do nothing on lid close while on AC power.
+  # Shipped as a system-wide default; KConfig cascades so a user's own
+  # ~/.config/powerdevilrc will override this if present.
+  environment.etc."xdg/powerdevilrc".text = ''
+    [AC][SuspendAndShutdown]
+    LidAction=0
+  '';
+
   system = {
     stateVersion = "23.05";
     autoUpgrade.enable = true;

machines/mibook/environments.nix

@@ -19,7 +19,7 @@ in
   my.hardware = {
     bluetooth.enable = true;
     sound.enable = false;
-    nvidia.enable = true;
+    nvidia.enable = false;
   };
   my.services = {
     vpn.enable = true;

machines/mibook/network.nix

@@ -0,0 +1,8 @@
+_: {
+  # Athena (local AI): allow LAN access to the Hermes web dashboard.
+  # Bound to 0.0.0.0:9119 in the athena docker stack; NixOS default-deny
+  # firewall otherwise blocks inbound connections from other devices.
+  networking.firewall.allowedTCPPorts = [
+    9119 # athena hermes dashboard
+  ];
+}

modules/environments/audiobookshelf/default.nix

@@ -8,6 +8,7 @@
 let
   cfg = config.my.profiles.audiobookshelf;
   hostName = config.networking.hostName;
+  domain = config.networking.domain;
 in
 {
   options.my.profiles.audiobookshelf = with lib; {
@@ -32,7 +33,7 @@ in
         group = "Media";
         name = "Audiobookshelf";
         description = "Audiobooks and podcasts";
-        href = "http://${hostName}:63834";
+        href = "http://${domain}:63834";
         icon = "audiobookshelf.png";
       }
     ];

modules/environments/default.nix

@@ -15,9 +15,11 @@
     ./docker
     ./homepage
     ./kde-desktop
+    ./monitoring
     ./readarr
     ./sonarr
     ./jellyfin
     ./jellyseerr
+    ./immich
   ];
 }

modules/environments/home-assistant/default.nix

@@ -11,11 +11,6 @@ let
   hostName = config.networking.hostName;
 in
 {
-  imports = [
-    # services.openthread-border-router isn't in nixos-25.11; pull from
-    # nixpkgs-unstable. Package comes from the existing unstable overlay.
-    "${self.inputs.nixpkgs-unstable}/nixos/modules/services/home-automation/openthread-border-router.nix"
-  ];
 
   options.my.profiles.home-assistant = with lib; {
     enable = mkEnableOption "Home Automation";
@@ -34,6 +29,8 @@ in
         "otbr"
         "thread"
         "xiaomi_miio"
+        "apple_tv" # Apple TV (pyatv); pair via UI PIN flow
+        "tuya" # Tuya/SmartLife cloud; Unistyle WLAN irrigation computer
       ];
     };
     services.home-assistant.config = {
@@ -43,7 +40,7 @@ in
         internal_url = "http://${hostName}:8123";
         external_url = "http://jupiter.solar.internal:8123";
       };
-      mobile_app = {};
+      mobile_app = { };
       automation = "!include automations.yaml";
       script = "!include scripts.yaml";
       scene = "!include scenes.yaml";

modules/environments/homepage/default.nix

@@ -7,7 +7,7 @@
 let
   cfg = config.my.profiles.homepage;
   dashboardPort = 8082;
-  dashboardHost = config.networking.hostName;
+  dashboardHost = config.networking.domain;
   dashboardUrl = "http://${dashboardHost}:${toString dashboardPort}";
   manualServices = import ./manual-services.nix;
   manualWidgets = import ./manual-widgets.nix;

modules/environments/immich/default.nix

@@ -0,0 +1,46 @@
+# Immich self-hosted photo & video server
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.my.profiles.immich;
+  hostName = config.networking.hostName;
+  port = 2283;
+in
+{
+  options.my.profiles.immich = with lib; {
+    enable = mkEnableOption "Immich photo server";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.immich = {
+      enable = true;
+      host = "0.0.0.0";
+      inherit port;
+      openFirewall = true;
+      mediaLocation = "/var/lib/immich";
+      machine-learning.enable = true;
+      accelerationDevices = [ "/dev/dri/renderD128" ];
+      settings.server.externalDomain = "http://${hostName}:${toString port}";
+    };
+
+    # The native module does not add GPU groups; required for VAAPI/QSV transcoding.
+    users.users.immich.extraGroups = [
+      "video"
+      "render"
+    ];
+
+    my.homepage.services = [
+      {
+        group = "Media";
+        name = "Immich";
+        description = "Photo & video server";
+        href = "http://${hostName}:${toString port}";
+        icon = "immich.png";
+      }
+    ];
+  };
+}

modules/environments/jellyfin/default.nix

@@ -22,6 +22,8 @@ in
       openFirewall = true;
     };
 
+    environment.systemPackages = [ pkgs.libva-utils ];
+
     my.homepage.services = [
       {
         group = "Media";
@@ -34,6 +36,10 @@ in
 
     systemd.services.jellyfin = {
       after = [ "network-online.target" ];
+      serviceConfig.SupplementaryGroups = [
+        "video"
+        "render"
+      ];
     };
   };
 }

modules/environments/monitoring/alloy.nix

@@ -0,0 +1,51 @@
+# Grafana Alloy: ships the full systemd journal to Loki.
+# The nixpkgs module reads /etc/alloy/*.alloy and already runs with the
+# systemd-journal supplementary group. Alloy exposes /metrics + UI on :12345.
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.profiles.monitoring;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.alloy.enable = true;
+
+    environment.etc."alloy/config.alloy".text = ''
+      loki.source.journal "journal" {
+        max_age       = "24h"
+        forward_to    = [loki.write.local.receiver]
+        relabel_rules = loki.relabel.journal.rules
+        labels        = { host = "jupiter" }
+      }
+
+      loki.relabel "journal" {
+        forward_to = []
+        rule {
+          source_labels = ["__journal__systemd_unit"]
+          target_label  = "unit"
+        }
+        rule {
+          source_labels = ["__journal_priority_keyword"]
+          target_label  = "priority"
+        }
+        rule {
+          source_labels = ["__journal__transport"]
+          target_label  = "transport"
+        }
+        rule {
+          source_labels = ["__journal__boot_id"]
+          target_label  = "boot_id"
+        }
+      }
+
+      loki.write "local" {
+        endpoint {
+          url = "http://127.0.0.1:3100/loki/api/v1/push"
+        }
+      }
+    '';
+  };
+}

modules/environments/monitoring/default.nix

@@ -0,0 +1,16 @@
+# Observability stack: Grafana + Prometheus + Loki + Alloy.
+# Content (dashboards, datasources, alert rules) lives in a separate repo,
+# consumed as the `grafana-content` flake input and provisioned from the store.
+{ lib, ... }:
+{
+  imports = [
+    ./grafana.nix
+    ./prometheus.nix
+    ./loki.nix
+    ./alloy.nix
+  ];
+
+  options.my.profiles.monitoring = {
+    enable = lib.mkEnableOption "Grafana + Prometheus + Loki + Alloy observability stack";
+  };
+}

modules/environments/monitoring/grafana.nix

@@ -0,0 +1,83 @@
+# Grafana service + provisioning from the grafana-content flake input.
+# Provisioning shape verified against nixpkgs 26.05 grafana module:
+#  - datasources.path takes a directory (lndir'd into the provisioning dir)
+#  - dashboard provider is generated here so the store path can be injected
+#  - each alerting resource takes its own YAML *file* (they share one target dir,
+#    so pointing them at a directory would collide)
+{
+  config,
+  lib,
+  inputs,
+  ...
+}:
+let
+  cfg = config.my.profiles.monitoring;
+  content = inputs.grafana-content;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.grafana = {
+      enable = true;
+
+      settings = {
+        server = {
+          http_addr = "0.0.0.0";
+          http_port = 3000;
+          domain = "jupiter.solar.internal";
+          root_url = "http://jupiter.solar.internal:3000/";
+        };
+        security.admin_password = "$__file{/etc/grafana/admin_password}";
+        # 26.05 removed the built-in default; encrypts secrets in Grafana's DB.
+        security.secret_key = "$__file{/etc/grafana/secret_key}";
+        "auth.anonymous" = {
+          enabled = true;
+          org_role = "Viewer";
+        };
+        metrics.enabled = true; # /metrics for Prometheus self-scrape
+        unified_alerting.enabled = true;
+        alerting.enabled = false; # disable legacy alerting
+      };
+
+      provision = {
+        enable = true;
+
+        # static datasources dir → all *.yaml linked in
+        datasources.path = "${content}/provisioning/datasources";
+
+        # dashboard provider generated here with the store path injected
+        dashboards.settings.providers = [
+          {
+            name = "content";
+            type = "file";
+            disableDeletion = true;
+            allowUiUpdates = false;
+            options = {
+              path = "${content}/dashboards";
+              foldersFromFilesStructure = true;
+            };
+          }
+        ];
+
+        # per-resource alerting files (share one target dir → must be files)
+        alerting = {
+          rules.path = "${content}/provisioning/alerting/rules.yaml";
+          contactPoints.path = "${content}/provisioning/alerting/contactpoints.yaml";
+          policies.path = "${content}/provisioning/alerting/policies.yaml";
+        };
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ 3000 ];
+
+    # Register a homepage-dashboard tile (matches the other profiles).
+    my.homepage.services = [
+      {
+        group = "Monitoring";
+        name = "Grafana";
+        description = "Metrics & logs dashboards";
+        href = "http://jupiter.solar.internal:3000";
+        icon = "grafana.png";
+      }
+    ];
+  };
+}

modules/environments/monitoring/loki.nix

@@ -0,0 +1,55 @@
+# Loki single-binary, filesystem storage, tsdb schema, 90d retention via compactor.
+# Localhost only — Grafana is the sole consumer.
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.profiles.monitoring;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.loki = {
+      enable = true;
+      configuration = {
+        server = {
+          http_listen_address = "127.0.0.1";
+          http_listen_port = 3100;
+        };
+        auth_enabled = false;
+
+        common = {
+          instance_addr = "127.0.0.1";
+          path_prefix = "/var/lib/loki";
+          storage.filesystem = {
+            chunks_directory = "/var/lib/loki/chunks";
+            rules_directory = "/var/lib/loki/rules";
+          };
+          replication_factor = 1;
+          ring.kvstore.store = "inmemory";
+        };
+
+        schema_config.configs = [
+          {
+            from = "2024-01-01";
+            store = "tsdb";
+            object_store = "filesystem";
+            schema = "v13";
+            index = {
+              prefix = "index_";
+              period = "24h";
+            };
+          }
+        ];
+
+        limits_config.retention_period = "2160h"; # 90d
+        compactor = {
+          working_directory = "/var/lib/loki/compactor";
+          retention_enabled = true;
+          delete_request_store = "filesystem";
+        };
+      };
+    };
+  };
+}

modules/environments/monitoring/prometheus.nix

@@ -0,0 +1,52 @@
+# Prometheus + node_exporter. Prometheus UI reachable on the LAN (:9090);
+# node_exporter bound to localhost. Scrapes the host plus the stack itself.
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.profiles.monitoring;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.prometheus = {
+      enable = true;
+      listenAddress = "0.0.0.0";
+      port = 9090;
+      retentionTime = "90d";
+
+      exporters.node = {
+        enable = true;
+        listenAddress = "127.0.0.1";
+        port = 9100;
+        # default collectors
+      };
+
+      scrapeConfigs = [
+        {
+          job_name = "node";
+          static_configs = [ { targets = [ "127.0.0.1:9100" ]; } ];
+        }
+        {
+          job_name = "prometheus";
+          static_configs = [ { targets = [ "127.0.0.1:9090" ]; } ];
+        }
+        {
+          job_name = "grafana";
+          static_configs = [ { targets = [ "127.0.0.1:3000" ]; } ];
+        }
+        {
+          job_name = "loki";
+          static_configs = [ { targets = [ "127.0.0.1:3100" ]; } ];
+        }
+        {
+          job_name = "alloy";
+          static_configs = [ { targets = [ "127.0.0.1:12345" ]; } ];
+        }
+      ];
+    };
+
+    networking.firewall.allowedTCPPorts = [ 9090 ];
+  };
+}