feat(ntfy): wire Home Assistant rest_command publisher

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/superpowers/plans/2026-07-05-ntfy-module.md

@@ -0,0 +1,269 @@
+# ntfy Notification Module Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add a `my.profiles.ntfy` NixOS module that runs an auth-required self-hosted ntfy server on jupiter, exposes a homepage tile, and wires a Home Assistant `rest_command` for publishing notifications.
+
+**Architecture:** A single profile module under `modules/environments/ntfy/`, following the repo's `my.profiles.<name>` pattern. It configures `services.ntfy-sh` with `auth-default-access = deny-all`, opens the firewall, registers a homepage tile, and — when the home-assistant profile is enabled — merges a `rest_command.ntfy_send` into `services.home-assistant.config`. No secrets touch the Nix store; credentials are provisioned manually by the operator, and the only secret lives in HA's `secrets.yaml`.
+
+**Tech Stack:** Nix (flake-parts NixOS config), nixpkgs `services.ntfy-sh`, `services.home-assistant`, nixfmt-rfc-style.
+
+## Global Constraints
+
+- Follow the profile pattern exactly: `let cfg = config.my.profiles.<name>; in { options.my.profiles.<name>.enable = lib.mkEnableOption "..."; config = lib.mkIf cfg.enable { ... }; }`.
+- Namespace is `my.profiles.ntfy`.
+- Homepage self-registration uses `my.homepage.services` (list of `{ group; name; description; href; icon; }`).
+- `hostName` is bound from `config.networking.hostName`, matching sibling modules.
+- All `.nix` files must be formatted with `nixfmt-rfc-style`.
+- No secret values may appear in any `.nix` file (nothing enters the Nix store). The only secret is `ntfy_password` in `/var/lib/hass/secrets.yaml`, provisioned by hand.
+- Evaluation check used throughout (runs on darwin without a Linux builder):
+  `nix eval '.#nixosConfigurations.jupiter.config.system.build.toplevel.drvPath'`
+- Do NOT run `nixos-rebuild` or SSH to jupiter; deploy + provisioning are operator steps the user runs on the host.
+
+---
+
+### Task 1: Create the ntfy server module (server + homepage tile)
+
+**Files:**
+- Create: `modules/environments/ntfy/default.nix`
+- Modify: `modules/environments/default.nix` (add `./ntfy` to `imports`)
+- Modify: `machines/jupiter/environments.nix` (enable the profile)
+
+**Interfaces:**
+- Consumes: `config.networking.hostName`; `services.ntfy-sh` (nixpkgs); `my.homepage.services` (repo homepage module).
+- Produces: option `my.profiles.ntfy.enable` (bool), `my.profiles.ntfy.port` (port, default 2586), `my.profiles.ntfy.topic` (str, default "ha"), `my.profiles.ntfy.haIntegration.enable` (bool, default true). Later tasks rely on `cfg.port`, `cfg.topic`, and `cfg.haIntegration.enable`.
+
+- [ ] **Step 1: Create the module file**
+
+Create `modules/environments/ntfy/default.nix`:
+
+```nix
+# self-hosted push notification server (ntfy)
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.profiles.ntfy;
+  hostName = config.networking.hostName;
+in
+{
+  options.my.profiles.ntfy = with lib; {
+    enable = mkEnableOption "ntfy notification server";
+
+    port = mkOption {
+      type = types.port;
+      default = 2586;
+      description = "HTTP port ntfy listens on.";
+    };
+
+    topic = mkOption {
+      type = types.str;
+      default = "ha";
+      description = "Topic Home Assistant publishes notifications to.";
+    };
+
+    haIntegration.enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Wire a Home Assistant rest_command that publishes to ntfy.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.ntfy-sh = {
+      enable = true;
+      settings = {
+        base-url = "http://${hostName}:${toString cfg.port}";
+        listen-http = ":${toString cfg.port}";
+        auth-file = "/var/lib/ntfy-sh/user.db";
+        auth-default-access = "deny-all";
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ cfg.port ];
+
+    my.homepage.services = [
+      {
+        group = "Services";
+        name = "ntfy";
+        description = "Push notifications";
+        href = "http://${hostName}:${toString cfg.port}";
+        icon = "ntfy.svg";
+      }
+    ];
+  };
+}
+```
+
+- [ ] **Step 2: Register the module in the environments import list**
+
+In `modules/environments/default.nix`, add `./ntfy` to the `imports` list (place it near the other service modules, e.g. after `./home-assistant`):
+
+```nix
+    ./home-assistant
+    ./ntfy
+```
+
+- [ ] **Step 3: Enable the profile on jupiter**
+
+In `machines/jupiter/environments.nix`, inside the `my.profiles = { ... }` block, add:
+
+```nix
+    ntfy.enable = true;
+```
+
+- [ ] **Step 4: Format the new file**
+
+Run: `nixfmt-rfc-style modules/environments/ntfy/default.nix`
+Expected: exits 0, no diff on re-run.
+
+- [ ] **Step 5: Evaluate the configuration**
+
+Run: `nix eval '.#nixosConfigurations.jupiter.config.system.build.toplevel.drvPath'`
+Expected: prints a `/nix/store/...-nixos-system-jupiter-*.drv` path with no evaluation errors. (This forces full module-system evaluation, catching option/type mistakes, without building a Linux derivation.)
+
+- [ ] **Step 6: Confirm the ntfy settings evaluate as expected**
+
+Run: `nix eval --json '.#nixosConfigurations.jupiter.config.services.ntfy-sh.settings'`
+Expected JSON includes `"auth-default-access":"deny-all"`, `"listen-http":":2586"`, and `"base-url":"http://jupiter:2586"`.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add modules/environments/ntfy/default.nix modules/environments/default.nix machines/jupiter/environments.nix
+git commit -m "feat(ntfy): add self-hosted notification server module
+
+Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>"
+```
+
+---
+
+### Task 2: Wire the Home Assistant rest_command
+
+**Files:**
+- Modify: `modules/environments/ntfy/default.nix` (add HA integration block)
+
+**Interfaces:**
+- Consumes: `cfg.port`, `cfg.topic`, `cfg.haIntegration.enable` (Task 1); `config.my.profiles.home-assistant.enable`; `services.home-assistant.config` (nixpkgs / repo home-assistant module).
+- Produces: `services.home-assistant.config.rest_command.ntfy_send`, callable from HA automations as `service: rest_command.ntfy_send`.
+
+- [ ] **Step 1: Add the HA integration block to the module**
+
+The module currently has a single `config = lib.mkIf cfg.enable { ... };`. Change it to merge two conditional configs with `lib.mkMerge` so the HA wiring is gated independently. Replace the `config = lib.mkIf cfg.enable { ... };` assignment with:
+
+```nix
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      services.ntfy-sh = {
+        enable = true;
+        settings = {
+          base-url = "http://${hostName}:${toString cfg.port}";
+          listen-http = ":${toString cfg.port}";
+          auth-file = "/var/lib/ntfy-sh/user.db";
+          auth-default-access = "deny-all";
+        };
+      };
+
+      networking.firewall.allowedTCPPorts = [ cfg.port ];
+
+      my.homepage.services = [
+        {
+          group = "Services";
+          name = "ntfy";
+          description = "Push notifications";
+          href = "http://${hostName}:${toString cfg.port}";
+          icon = "ntfy.svg";
+        }
+      ];
+    })
+
+    (lib.mkIf (cfg.enable && cfg.haIntegration.enable && config.my.profiles.home-assistant.enable) {
+      services.home-assistant.config.rest_command.ntfy_send = {
+        url = "http://${hostName}:${toString cfg.port}/${cfg.topic}";
+        method = "POST";
+        payload = "{{ message }}";
+        content_type = "text/plain";
+        username = "homeassistant";
+        password = "!secret ntfy_password";
+        headers = {
+          Title = "{{ title | default('Home Assistant') }}";
+          Priority = "{{ priority | default('default') }}";
+        };
+      };
+    })
+  ];
+```
+
+(The first `mkIf cfg.enable` block is identical to Task 1's config body — it is repeated here because the whole `config` assignment is being replaced with the `mkMerge` form.)
+
+- [ ] **Step 2: Format the file**
+
+Run: `nixfmt-rfc-style modules/environments/ntfy/default.nix`
+Expected: exits 0, no diff on re-run.
+
+- [ ] **Step 3: Evaluate the configuration**
+
+Run: `nix eval '.#nixosConfigurations.jupiter.config.system.build.toplevel.drvPath'`
+Expected: prints a `.drv` path, no evaluation errors (confirms the `rest_command` merges cleanly into the HA config the home-assistant module already defines).
+
+- [ ] **Step 4: Confirm the rest_command evaluated into HA config**
+
+Run: `nix eval --json '.#nixosConfigurations.jupiter.config.services.home-assistant.config.rest_command.ntfy_send'`
+Expected JSON includes `"url":"http://jupiter:2586/ha"`, `"username":"homeassistant"`, and `"password":"!secret ntfy_password"`.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add modules/environments/ntfy/default.nix
+git commit -m "feat(ntfy): wire Home Assistant rest_command publisher
+
+Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>"
+```
+
+---
+
+## Operator steps (run by the user on jupiter — not part of the agent's task loop)
+
+These require the host and manual credentials, so they are performed by the user after the branch is merged/deployed:
+
+1. Deploy: `sudo nixos-rebuild switch --flake '.#jupiter'`
+2. Create ntfy users:
+   ```bash
+   ntfy user add homeassistant            # set a password
+   ntfy access homeassistant ha write-only
+   ntfy user add --role=admin admin
+   ```
+3. Add the publisher password to Home Assistant secrets:
+   ```yaml
+   # /var/lib/hass/secrets.yaml
+   ntfy_password: <the homeassistant user's password>
+   ```
+4. Restart Home Assistant, then test from an automation / Developer Tools:
+   ```yaml
+   service: rest_command.ntfy_send
+   data:
+     message: "ntfy test"
+     title: "Home Assistant"
+     priority: high
+   ```
+5. Subscribe from the ntfy app as `admin` to receive the message.
+
+---
+
+## Self-Review
+
+**Spec coverage:**
+- Module structure + options → Task 1. ✔
+- Server config (deny-all, port, firewall) → Task 1 (steps 1, 6). ✔
+- Homepage tile → Task 1. ✔
+- Registration in `default.nix` + enable on jupiter → Task 1 (steps 2–3). ✔
+- HA `rest_command` wiring, gated on HA profile, `!secret` password → Task 2. ✔
+- Manual provisioning runbook → Operator steps section. ✔
+- Verification (eval/build + nixfmt) → per-task steps. ✔
+- Out-of-scope items (no seeding, no sops, no reverse proxy) → honored; no tasks added for them. ✔
+
+**Placeholder scan:** No TBD/TODO/"handle edge cases". The one "similar to Task 1" note is accompanied by the full repeated code, per the no-placeholders rule. ✔
+
+**Type consistency:** `cfg.port`/`cfg.topic`/`cfg.haIntegration.enable` defined in Task 1 and used identically in Task 2. `rest_command.ntfy_send` name consistent across Task 2 and operator steps. Homepage tile shape matches sibling modules. ✔

docs/superpowers/plans/2026-07-26-jellyfin-hw-transcoding.md

@@ -1,154 +0,0 @@
-# Jellyfin Hardware Transcoding (jupiter) Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Give jupiter's Jellyfin service access to the Intel iGPU's VAAPI render node so Quick Sync hardware transcoding can be enabled, instead of every transcode falling back to CPU.
-
-**Architecture:** One NixOS module change (`modules/environments/jellyfin/default.nix`) grants the `jellyfin` systemd service supplementary access to the `video`/`render` groups and installs `libva-utils` for verification. This is declarative and build-verifiable from the Mac. Enabling Quick Sync inside Jellyfin's own dashboard, and the on-machine verification, is a manual step run by the user on jupiter after deploy — the NixOS module has no option for it and this environment's convention is that the assistant never SSHes into jupiter directly (see `docs/superpowers/specs/2026-07-26-jellyfin-hw-transcoding.md`).
-
-**Tech Stack:** NixOS (flake-parts), nixpkgs `services.jellyfin` module, VAAPI/`intel-media-driver`, `libva-utils`.
-
-## Global Constraints
-
-- No SSH from the assistant into jupiter — all on-machine commands are given to the user to run and paste back.
-- Follow the existing profile pattern in `modules/environments/jellyfin/default.nix` (`config = lib.mkIf cfg.enable { ... }`); don't introduce a new toggle option — hardcode the hardware-acceleration wiring on, per the approved spec.
-- Verify locally via `nix eval` / `nix build` before asking the user to deploy.
-
----
-
-### Task 1: Grant Jellyfin access to the iGPU and verify the build
-
-**Files:**
-- Modify: `modules/environments/jellyfin/default.nix`
-
-**Interfaces:**
-- Produces: `systemd.services.jellyfin.serviceConfig.SupplementaryGroups = [ "video" "render" ];` — verified via `nix eval` in Step 2.
-
-- [ ] **Step 1: Add the device-access config and `libva-utils` package**
-
-Read the current file first (`modules/environments/jellyfin/default.nix`), then edit the `config = lib.mkIf cfg.enable { ... }` block so it reads:
-
-```nix
-  config = lib.mkIf cfg.enable {
-    services.jellyfin = {
-      enable = true;
-      openFirewall = true;
-    };
-
-    environment.systemPackages = [ pkgs.libva-utils ];
-
-    my.homepage.services = [
-      {
-        group = "Media";
-        name = "Jellyfin";
-        description = "Media server";
-        href = "http://${hostName}:${toString port}";
-        icon = "jellyfin.png";
-      }
-    ];
-
-    systemd.services.jellyfin = {
-      after = [ "network-online.target" ];
-      serviceConfig.SupplementaryGroups = [
-        "video"
-        "render"
-      ];
-    };
-  };
-```
-
-Note the two existing `systemd.services.jellyfin` keys (`after`) and the new `serviceConfig.SupplementaryGroups` now live in the same attrset — don't create a second `systemd.services.jellyfin = { ... }` block, it would overwrite the first.
-
-- [ ] **Step 2: Verify the rendered config with `nix eval`**
-
-Run (from the repo root on the Mac):
-
-```bash
-nix eval '.#nixosConfigurations.jupiter.config.systemd.services.jellyfin.serviceConfig.SupplementaryGroups' \
-  --extra-experimental-features 'nix-command flakes'
-```
-
-Expected output: `[ "video" "render" ]`
-
-- [ ] **Step 3: Verify the machine still builds**
-
-Run:
-
-```bash
-nix build '.#nixosConfigurations.jupiter.config.system.build.toplevel' \
-  --extra-experimental-features 'nix-command flakes' --no-link
-```
-
-Expected: build succeeds with no errors (may take a while; watch for any evaluation error mentioning `jellyfin` or `libva-utils`).
-
-- [ ] **Step 4: Format and commit**
-
-```bash
-nixfmt-rfc-style modules/environments/jellyfin/default.nix
-git add modules/environments/jellyfin/default.nix
-git commit -m "feat(jellyfin): grant iGPU access for Quick Sync hardware transcoding"
-```
-
----
-
-### Task 2: Deploy on jupiter and enable Quick Sync (user-executed)
-
-**Files:** none (on-machine deploy + Jellyfin dashboard UI)
-
-**Interfaces:**
-- Consumes: the `SupplementaryGroups` change from Task 1, already merged into the flake.
-
-These steps run **on jupiter**, by the user — paste the output back so we can confirm each one before moving to the next.
-
-- [ ] **Step 1: Deploy**
-
-```bash
-sudo nixos-rebuild switch --flake '.#jupiter'
-```
-
-Expected: switch succeeds, no errors mentioning `jellyfin`.
-
-- [ ] **Step 2: Confirm the service picked up the new groups**
-
-```bash
-systemctl show jellyfin -p SupplementaryGroups
-systemctl status jellyfin --no-pager
-```
-
-Expected: `SupplementaryGroups=video render` (order may vary) and the service is `active (running)`.
-
-- [ ] **Step 3: Confirm VAAPI driver loads**
-
-```bash
-vainfo
-```
-
-Expected: output starts with something like `vainfo: VA-API version: 1.x` and `Driver version: Intel iHD driver`, followed by a list of supported VAProfiles/VAEntrypoints (e.g. `VAProfileH264Main : VAEntrypointVLD`, `VAEntrypointEncSlice`).
-
-If this instead prints a permissions or "no VA display" error, paste it back — that means the group grant isn't reaching the process and Task 1 needs a follow-up fix (e.g. the jellyfin service may be more sandboxed than expected, requiring an explicit `DeviceAllow=char-drm rw` in `serviceConfig` as well).
-
-- [ ] **Step 4: Enable Quick Sync in the Jellyfin dashboard**
-
-In the Jellyfin web UI:
-1. **Dashboard → Playback**.
-2. Hardware acceleration: **Intel QuickSync (QSV)**.
-3. VA-API device: `/dev/dri/renderD128`.
-4. Enable hardware decoding for the codecs your library uses (H264 at minimum).
-5. If the library has HDR content, enable tone-mapping.
-6. Save.
-
-- [ ] **Step 5: Functional check**
-
-Play a file that requires transcoding (or force a lower quality in the client's playback settings to trigger one), then:
-
-```bash
-journalctl -u jellyfin -n 50 --no-pager
-```
-
-Look for a line referencing `qsv` or `vaapi` in the transcode command. Separately, watch CPU usage (`htop`) during playback — it should stay low on the core doing the transcode, rather than pegging at 100%, since the iGPU is now doing the encode/decode work.
-
-## Self-Review Notes
-
-- Spec coverage: NixOS change (Task 1) ✓, manual dashboard step (Task 2 Step 4) ✓, verification via `vainfo`/build (Task 1 Step 2-3, Task 2 Step 3) ✓, functional check (Task 2 Step 5) ✓. Toggle option explicitly excluded per approved spec — not present, correctly.
-- No placeholders — every step has literal commands/code.
-- `SupplementaryGroups` key/value matches exactly between Task 1 (produced) and Task 2 (consumed/checked).

docs/superpowers/plans/2026-08-05-immich-nixos-module.md

@@ -1,299 +0,0 @@
-# Immich NixOS Module Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
->
-> **Note on nature:** Task 1 is repo work verifiable with `nix build` (no runtime tests exist for declarative config). Tasks 2–6 are a **manual migration runbook executed on jupiter by the operator** — they are destructive and cannot be run from the dev machine (mibook). Do not attempt to automate or execute Tasks 2–6 from an agent session; present them for the operator to run and confirm.
-
-**Goal:** Replace jupiter's docker-compose Immich with the native `services.immich` NixOS module, preserving all data (albums, faces, shares, library).
-
-**Architecture:** A standard `my.profiles.immich` module wraps `services.immich` (native Postgres+VectorChord over unix socket, Redis, server, machine-learning). Media stays at the default local `/var/lib/immich`. The existing docker Postgres dump is restored same-version (2.7.5 → 2.7.5, no schema/vector migration). GPU is exposed for VAAPI/QSV transcoding.
-
-**Tech Stack:** NixOS (flake-parts), `services.immich` from nixpkgs 25.11, PostgreSQL, Intel QSV/VAAPI, docker (source only).
-
-## Global Constraints
-
-- Machine: **jupiter** only. Do not enable on mibook.
-- Immich version: source docker == target nixpkgs == **2.7.5** (stable). No `package` override. Do NOT bump nixpkgs Immich during this work.
-- Media location: default `/var/lib/immich` (local disk). Do not point at the NAS.
-- Database: local PostgreSQL over **unix socket + peer auth** — no password, no sops secret.
-- HW accel: **video transcoding only**. ML stays on CPU (`machine-learning.enable = true`, no OpenVINO).
-- Access: LAN + VPN, `openFirewall = true`, port **2283**. No reverse proxy/TLS.
-- Rebuild command: `sudo nixos-rebuild switch --flake '.#jupiter'`.
-- Build-check command: `nix build '.#nixosConfigurations.jupiter.config.system.build.toplevel'`.
-- Format Nix with `nixfmt-rfc-style` before committing.
-- Do not delete docker DB or upload data until Task 6 sign-off.
-
----
-
-## File Structure
-
-- **Create** `modules/environments/immich/default.nix` — the `my.profiles.immich` module (single responsibility: declare Immich).
-- **Modify** `modules/environments/default.nix` — add `./environments/immich` to the import list.
-- **Modify** `machines/jupiter/environments.nix` — set `immich.enable = true`.
-
-No other files change. The DB/media migration touches only runtime state on jupiter, not the repo.
-
----
-
-### Task 1: Author the `immich` profile module
-
-**Files:**
-- Create: `modules/environments/immich/default.nix`
-- Modify: `modules/environments/default.nix` (import list)
-- Modify: `machines/jupiter/environments.nix` (`my.profiles.immich.enable`)
-
-**Interfaces:**
-- Produces: NixOS option `my.profiles.immich.enable` (bool). When true, configures `services.immich`, adds `immich` user to `video`/`render` groups, and appends an entry to `my.homepage.services`.
-- Consumes: existing `my.homepage.services` aggregator; `config.networking.hostName`.
-
-- [ ] **Step 1: Read a reference module to match repo style**
-
-Read `modules/environments/jellyfin/default.nix` (same shape: `cfg`, `hostName`, `port`, `mkIf`, `my.homepage.services`). Match its formatting and header-comment convention.
-
-- [ ] **Step 2: Create the module file**
-
-Create `modules/environments/immich/default.nix`:
-
-```nix
-# Immich self-hosted photo & video server
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.my.profiles.immich;
-  hostName = config.networking.hostName;
-  port = 2283;
-in
-{
-  options.my.profiles.immich = with lib; {
-    enable = mkEnableOption "Immich photo server";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.immich = {
-      enable = true;
-      host = "0.0.0.0";
-      inherit port;
-      openFirewall = true;
-      mediaLocation = "/var/lib/immich";
-      machine-learning.enable = true;
-      accelerationDevices = [ "/dev/dri/renderD128" ];
-      settings.server.externalDomain = "http://${hostName}:${toString port}";
-    };
-
-    # The native module does not add GPU groups; required for VAAPI/QSV transcoding.
-    users.users.immich.extraGroups = [
-      "video"
-      "render"
-    ];
-
-    my.homepage.services = [
-      {
-        group = "Media";
-        name = "Immich";
-        description = "Photo & video server";
-        href = "http://${hostName}:${toString port}";
-        icon = "immich.png";
-      }
-    ];
-  };
-}
-```
-
-- [ ] **Step 3: Register the module in the environments import list**
-
-Open `modules/environments/default.nix` and add `./environments/immich` (or `./immich`, matching the exact relative style already used in that file — check how `jellyfin` is listed and mirror it).
-
-- [ ] **Step 4: Enable it on jupiter**
-
-In `machines/jupiter/environments.nix`, inside the `my.profiles = { ... }` block, add:
-
-```nix
-    immich.enable = true;
-```
-
-- [ ] **Step 5: Format**
-
-Run: `nixfmt-rfc-style modules/environments/immich/default.nix`
-
-- [ ] **Step 6: Build-check (this is the "test")**
-
-Run: `nix build '.#nixosConfigurations.jupiter.config.system.build.toplevel'`
-Expected: builds successfully. If it fails on an unknown option (e.g. `accelerationDevices`, `settings.server.externalDomain`), reconcile against the module at `$(nix eval --raw '.#nixosConfigurations.jupiter.pkgs.path')/nixos/modules/services/web-apps/immich.nix` and fix.
-
-- [ ] **Step 7: Confirm the option evaluates on**
-
-Run: `nix eval '.#nixosConfigurations.jupiter.config.services.immich.enable'`
-Expected: `true`
-
-- [ ] **Step 8: Commit**
-
-```bash
-git add modules/environments/immich/default.nix modules/environments/default.nix machines/jupiter/environments.nix
-git commit -m "feat(jupiter): add native Immich profile module"
-```
-
----
-
-### Task 2: Pre-flight & backup on jupiter (operator-run)
-
-**Files:** none (runtime state on jupiter). Run all commands on jupiter.
-
-**Interfaces:**
-- Produces: `immich-db.sql` dump file and a known-good copy/snapshot of the docker upload folder; recorded `UPLOAD_LOCATION` path and DB container name.
-
-- [ ] **Step 1: Record docker facts**
-
-From the docker-compose dir on jupiter, note `UPLOAD_LOCATION`, the DB service/container name, and `POSTGRES_USER`/`POSTGRES_DB` from `.env`/compose. Confirm server version is **2.7.5** (web UI footer or `docker exec <server> immich --version`). If it is not 2.7.5, STOP — this plan assumes a same-version restore.
-
-- [ ] **Step 2: Stop the docker stack (DB may stay up for the dump)**
-
-Run: `docker compose stop immich-server immich-machine-learning` (leave the DB container running).
-
-- [ ] **Step 3: Dump the database**
-
-Run: `docker exec -t <db-container> pg_dumpall --clean --if-exists --username=<POSTGRES_USER> > ~/immich-db.sql`
-Expected: a non-trivial `immich-db.sql` (check it is not near-empty: `wc -l ~/immich-db.sql`).
-
-- [ ] **Step 4: Stop the DB and record the media size**
-
-Run: `docker compose down` then `du -sh <UPLOAD_LOCATION>` and note the size. Do NOT copy yet. Do NOT delete anything.
-
----
-
-### Task 3: First switch — let the module create empty state (operator-run)
-
-**Files:** none at runtime (repo change already committed in Task 1). Run on jupiter after pulling the committed branch.
-
-**Interfaces:**
-- Consumes: `immich-db.sql`, `UPLOAD_LOCATION` from Task 2.
-- Produces: an `immich` system user, an empty `immich` Postgres DB + role, and `/var/lib/immich` created with correct ownership, with services then stopped.
-
-- [ ] **Step 1: Deploy the config**
-
-On jupiter, check out the branch containing Task 1's commit and run:
-`sudo nixos-rebuild switch --flake '.#jupiter'`
-Expected: `immich-server`, `immich-machine-learning`, postgres, and redis units come up; UI reachable at `http://jupiter:2283` showing a fresh/empty instance.
-
-- [ ] **Step 2: Stop immich so data can be swapped underneath**
-
-Run: `sudo systemctl stop immich-server immich-machine-learning`
-Expected: both inactive. PostgreSQL and Redis stay running.
-
-- [ ] **Step 3: Verify the DB and user exist**
-
-Run: `sudo -u postgres psql -c '\l' | grep immich` and `sudo -u postgres psql -c '\du' | grep immich`
-Expected: an `immich` database and `immich` role are present.
-
----
-
-### Task 4: Restore database and media (operator-run, destructive)
-
-**Files:** none in repo. Run on jupiter. This overwrites the freshly-created empty DB.
-
-**Interfaces:**
-- Consumes: `immich-db.sql`, `<UPLOAD_LOCATION>`, the running NixOS PostgreSQL.
-- Produces: the migrated DB and populated `/var/lib/immich`.
-
-- [ ] **Step 1: Restore the dump into the NixOS Postgres**
-
-`pg_dumpall` output includes role/DB creation. Load it as the `postgres` superuser over the unix socket:
-Run: `sudo -u postgres psql -f ~/immich-db.sql`
-Expected: completes without fatal errors. Harmless "role already exists"/"database already exists" notices are OK because of `--clean --if-exists`. If the immich DB ends up owned by the wrong role, reassign: `sudo -u postgres psql -c 'ALTER DATABASE immich OWNER TO immich;'`.
-
-- [ ] **Step 2: Sanity-check the restored data**
-
-Run: `sudo -u postgres psql -d immich -c 'SELECT count(*) FROM assets;'`
-Expected: a count matching your library size (non-zero). If the table name differs by version, list tables with `\dt` and check an obviously-populated one.
-
-- [ ] **Step 3: Move the media into the default location**
-
-Immich's upload folder holds subdirs `library/ upload/ thumbs/ encoded-video/ profile/ backups/`. Move (not copy, if same filesystem) the contents of `<UPLOAD_LOCATION>` into `/var/lib/immich`:
-Run: `sudo rsync -aHAX --info=progress2 <UPLOAD_LOCATION>/ /var/lib/immich/`
-(Use `rsync` — safe if partially interrupted. Keep the source until Task 6 sign-off.)
-
-- [ ] **Step 4: Fix ownership**
-
-Run: `sudo chown -R immich:immich /var/lib/immich`
-Expected: everything under `/var/lib/immich` owned by `immich`.
-
----
-
-### Task 5: Start and verify (operator-run)
-
-**Files:** none. Run on jupiter.
-
-**Interfaces:**
-- Consumes: migrated DB + media from Task 4.
-- Produces: a running, verified native Immich.
-
-- [ ] **Step 1: Start the server and watch logs**
-
-Run: `sudo systemctl start immich-server && journalctl -u immich-server -f`
-Expected: it connects to the DB, runs same-version startup checks (no destructive migration since 2.7.5==2.7.5), and reports listening on 2283. Leave the follow running through the next step.
-
-- [ ] **Step 2: Start machine-learning**
-
-Run: `sudo systemctl start immich-machine-learning`
-Expected: active, no crash loop in `journalctl -u immich-machine-learning`.
-
-- [ ] **Step 3: Functional spot-check in the web UI**
-
-At `http://jupiter:2283`: log in with an existing account; confirm the timeline loads; open an **album**; open the **People/faces** view; open a **shared link**; open one photo so a **thumbnail and its full original both load** (this proves DB↔file paths align after the media move).
-Expected: all present, images render.
-
-- [ ] **Step 4: Confirm homepage dashboard tile**
-
-Open the homepage dashboard; confirm the Immich tile appears under "Media" and links to `http://jupiter:2283`.
-
-- [ ] **Step 5: Enable and verify hardware transcoding**
-
-In Immich **Administration → Settings → Video Transcoding**, set hardware acceleration to **Quick Sync** (QSV) (or VAAPI). Trigger a transcode (upload/play a video that needs transcoding, or run the transcoding job). Then:
-Run: `journalctl -u immich-server | grep -iE 'qsv|vaapi|hwaccel|transcode'`
-Expected: log shows the hardware path in use, not a CPU-fallback error. Confirm `/dev/dri/renderD128` is accessible to the service (the `video`/`render` groups + `accelerationDevices` from Task 1 handle this).
-
----
-
-### Task 6: Sign-off and cleanup (operator-run)
-
-**Files:** none in repo. Merge the branch; then, only after a confidence window, remove docker.
-
-**Interfaces:**
-- Consumes: a verified running instance (Task 5).
-
-- [ ] **Step 1: Merge the feature branch**
-
-Open a PR from `feat/immich-nixos-module` into `main` and merge it (repo convention: PRs via the Gitea remote).
-
-- [ ] **Step 2: Confidence window**
-
-Use Immich normally for a few days. Keep the docker `<UPLOAD_LOCATION>` source copy and `~/immich-db.sql` untouched as the rollback path.
-
-- [ ] **Step 3: Rollback (only if needed, before cleanup)**
-
-If something is wrong: `sudo systemctl stop immich-server immich-machine-learning`, set `immich.enable = false` (or check out the pre-migration commit), `sudo nixos-rebuild switch --flake '.#jupiter'`, then `docker compose up -d` in the old stack. Original docker DB + upload folder are intact until Step 4.
-
-- [ ] **Step 4: Cleanup (after sign-off)**
-
-Remove the docker Immich stack (`docker compose down --rmi all --volumes` in the old dir if the DB volume is dedicated — verify first), delete the now-duplicated `<UPLOAD_LOCATION>` source, and remove `~/immich-db.sql`. Optionally disable the `docker` profile on jupiter if Immich was its only consumer (check other services first — jupiter's `docker.enable` may still be needed).
-
----
-
-## Self-Review
-
-**Spec coverage:**
-- Native `services.immich` → Task 1. ✓
-- Version target 2.7.5==stable, no override → Global Constraints + Task 2 Step 1. ✓
-- Media at default `/var/lib/immich` → Task 1 + Task 4 Step 3. ✓
-- DB migrate keep-everything → Tasks 2–4. ✓
-- HW transcoding only → Task 1 (`accelerationDevices`, groups) + Task 5 Step 5. ✓
-- LAN+VPN, port 2283, openFirewall, homepage tile → Task 1 + Task 5 Steps 3–4. ✓
-- Rollback path → Task 6 Step 3. ✓
-- Deferred (OpenVINO/NAS/proxy) → correctly absent. ✓
-
-**Placeholder scan:** No TBD/TODO; every command is concrete. Placeholders like `<db-container>`, `<UPLOAD_LOCATION>`, `<POSTGRES_USER>` are runtime values the operator reads in Task 2 Step 1 — intentional, not gaps.
-
-**Type consistency:** Option name `my.profiles.immich.enable` and path `/var/lib/immich` used consistently across all tasks. Media subfolder list matches between Task 4 Step 3 and the spec.

docs/superpowers/specs/2026-07-05-ntfy-module-design.md

@@ -0,0 +1,176 @@
+# ntfy self-hosted notification module — design
+
+Date: 2026-07-05
+Target machine: jupiter
+
+## Purpose
+
+Add a NixOS profile module that runs and configures a self-hosted
+[ntfy](https://ntfy.sh) notification server on jupiter, with authentication
+required, a homepage dashboard tile, and out-of-the-box plumbing so Home
+Assistant automations can publish push notifications.
+
+## Scope decisions (from brainstorming)
+
+- **Service:** ntfy (self-hosted server), not Apprise/Gotify/HA-only.
+- **Access control:** authentication required (`auth-default-access = deny-all`).
+- **Home Assistant:** the module wires an HA `rest_command` so automations can
+  send notifications out of the box.
+- **Credentials:** fully manual. The module runs the server and wires the HA
+  plumbing, but does **not** seed users or store any secret. The operator
+  provisions ntfy users/passwords by hand, and the only secret lives in Home
+  Assistant's `secrets.yaml` — never in the world-readable Nix store.
+
+## Module structure
+
+New module at `modules/environments/ntfy/default.nix` following the repo's
+standard profile pattern (`my.profiles.<name>` with `options` +
+`config = lib.mkIf cfg.enable { ... }`).
+
+Registration:
+1. Add `./ntfy` to the `imports` list in `modules/environments/default.nix`.
+2. Enable via `my.profiles.ntfy.enable = true;` in
+   `machines/jupiter/environments.nix`.
+
+### Options
+
+```nix
+options.my.profiles.ntfy = with lib; {
+  enable = mkEnableOption "ntfy notification server";
+
+  port = mkOption {
+    type = types.port;
+    default = 2586;
+    description = "HTTP port ntfy listens on.";
+  };
+
+  topic = mkOption {
+    type = types.str;
+    default = "ha";
+    description = "Topic Home Assistant publishes notifications to.";
+  };
+
+  haIntegration.enable = mkOption {
+    type = types.bool;
+    default = true;
+    description = "Wire a Home Assistant rest_command that publishes to ntfy.";
+  };
+};
+```
+
+## Server configuration
+
+```nix
+config = lib.mkIf cfg.enable {
+  services.ntfy-sh = {
+    enable = true;
+    settings = {
+      base-url            = "http://${hostName}:${toString cfg.port}";
+      listen-http         = ":${toString cfg.port}";
+      auth-file           = "/var/lib/ntfy-sh/user.db";
+      auth-default-access = "deny-all";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ cfg.port ];
+
+  my.homepage.services = [
+    {
+      group = "Services";
+      name = "ntfy";
+      description = "Push notifications";
+      href = "http://${hostName}:${toString cfg.port}";
+      icon = "ntfy.svg";
+    }
+  ];
+};
+```
+
+`hostName` is bound from `config.networking.hostName`, matching the pattern in
+the home-assistant and paperless modules.
+
+## Home Assistant wiring
+
+Applied only when ntfy, the HA integration flag, and the home-assistant profile
+are all enabled:
+
+```nix
+lib.mkIf (cfg.enable && cfg.haIntegration.enable
+          && config.my.profiles.home-assistant.enable) {
+  services.home-assistant.config.rest_command.ntfy_send = {
+    url = "http://${hostName}:${toString cfg.port}/${cfg.topic}";
+    method = "POST";
+    payload = "{{ message }}";
+    content_type = "text/plain";
+    username = "homeassistant";
+    password = "!secret ntfy_password";
+    headers = {
+      Title = "{{ title | default('Home Assistant') }}";
+      Priority = "{{ priority | default('default') }}";
+    };
+  };
+};
+```
+
+Notes:
+- `services.home-assistant.config` is an attrset that NixOS merges, so adding
+  `rest_command.ntfy_send` from this module composes with the config the
+  home-assistant module already defines.
+- `password = "!secret ntfy_password"` is a whole-value `!secret` reference. The
+  upstream home-assistant module unquotes such values when rendering the config
+  (the same mechanism the repo already relies on for `!include`), so the secret
+  resolves from `/var/lib/hass/secrets.yaml` at runtime and never enters the
+  Nix store. See `reference_nixos_ha_yaml_includes`.
+- `rest_command` is chosen over the `notify` REST platform because ntfy's
+  per-topic URL path plus header-based metadata map cleanly onto rest_command,
+  whereas the notify platform's fixed JSON payload fights ntfy's format.
+
+## Manual provisioning (operator runbook)
+
+Because credentials are fully manual, after the first `nixos-rebuild switch`
+run these once on jupiter:
+
+```bash
+# Dedicated publisher for Home Assistant, scoped to the ha topic
+ntfy user add homeassistant            # prompts for a password
+ntfy access homeassistant ha write-only
+
+# Admin account for the app / web UI
+ntfy user add --role=admin admin
+```
+
+Then add the homeassistant password to Home Assistant's secrets:
+
+```yaml
+# /var/lib/hass/secrets.yaml
+ntfy_password: <the homeassistant user's password>
+```
+
+Restart Home Assistant. Automations can then publish with:
+
+```yaml
+service: rest_command.ntfy_send
+data:
+  message: "Garage door left open"
+  title: "Alert"
+  priority: high
+```
+
+Subscribers (phone/desktop ntfy app) log in as `admin` (or another user granted
+read access) to receive messages.
+
+## Testing / verification
+
+- Build check: `nix build '.#nixosConfigurations.jupiter.config.system.build.toplevel'`
+  must succeed with the module enabled.
+- `nixfmt-rfc-style` clean on the new file.
+- Post-deploy manual verification (documented, not automated): create the users
+  above, publish a test message from HA, confirm it reaches a subscribed client.
+
+## Out of scope
+
+- No automated user/token seeding (explicitly deferred to manual provisioning).
+- No sops-nix setup (repo has dangling `config.sops.secrets` references, but
+  wiring up sops is a separate change and not required here).
+- No reverse-proxy / TLS termination (`behind-proxy` left default; LAN-only via
+  firewall).

docs/superpowers/specs/2026-07-26-jellyfin-hw-transcoding.md

@@ -1,145 +0,0 @@
-# Intel Quick Sync hardware transcoding for Jellyfin on jupiter
-
-## Problem
-
-Jellyfin streams stutter on jupiter whenever a client needs a transcode
-(unsupported codec/container, bitrate cap, or a client that can't
-direct-play). Transcoding currently runs entirely on CPU.
-
-jupiter's Intel iGPU is already usable at the OS level:
-
-- `hardware.graphics.enable = true` with `intel-media-driver` (the `iHD`
-  VAAPI driver) is configured in
-  `machines/jupiter/hardware-configuration.nix:20-27`.
-- The commented-out `i915.force_probe = "9a49"` kernel param there
-  corresponds to a Quick-Sync-capable Intel UHD iGPU, confirming the
-  hardware supports it.
-
-But `modules/environments/jellyfin/default.nix` never grants the
-`jellyfin` systemd service access to `/dev/dri`, so Jellyfin has no path
-to the GPU and silently falls back to software transcoding.
-
-## Goal
-
-Give the Jellyfin service access to the iGPU's VAAPI render node, so
-Quick Sync can be enabled in Jellyfin's own dashboard and transcodes are
-offloaded from the CPU.
-
-## Non-goals
-
-- Remote/external access or reverse-proxy tuning.
-- General CPU/RAM headroom review of jupiter.
-- A toggle option (`my.profiles.jellyfin.hardwareAcceleration.enable`) —
-  jupiter only has the one iGPU, so this is hardcoded on rather than
-  made configurable.
-
-## Design
-
-### NixOS change (declarative)
-
-In `modules/environments/jellyfin/default.nix`, inside the existing
-`config = lib.mkIf cfg.enable { ... }` block, grant the systemd service
-supplementary access to the `video` and `render` groups (the groups that
-own `/dev/dri/card*` and `/dev/dri/renderD*`):
-
-```nix
-systemd.services.jellyfin.serviceConfig.SupplementaryGroups = [
-  "video"
-  "render"
-];
-```
-
-This is additive to the existing `systemd.services.jellyfin.after = [
-"network-online.target" ];` block already in the file — both apply to
-the same service.
-
-Also add `libva-utils` to `environment.systemPackages` (or scoped to
-this module) so `vainfo` is available on jupiter to verify the driver
-loads correctly.
-
-### Manual step (not declarative)
-
-Jellyfin stores its transcoding/hardware-acceleration choice in its own
-internal `encoding.xml`, which the NixOS module does not expose as an
-option. After deploying the Nix change, one-time manual configuration in
-the Jellyfin dashboard is required:
-
-1. **Dashboard → Playback**.
-2. Hardware acceleration: **Intel QuickSync (QSV)**.
-3. VA-API device: `/dev/dri/renderD128`.
-4. Enable hardware decoding for the codecs your library actually uses
-   (H264 at minimum; HEVC/VP9 depending on iGPU generation).
-5. If any HDR content exists in the library, enable tone-mapping — this
-   is one of the more CPU-expensive operations Quick Sync can offload.
-
-## Verification
-
-Build-time (from the Mac, no SSH needed):
-
-```
-nix eval '.#nixosConfigurations.jupiter.config.systemd.services.jellyfin.serviceConfig.SupplementaryGroups' \
-  --extra-experimental-features 'nix-command flakes'
-```
-
-Expect `[ "video" "render" ]`.
-
-On jupiter after `sudo nixos-rebuild switch --flake '.#jupiter'`:
-
-```
-systemctl status jellyfin
-journalctl -u jellyfin -n 50 --no-pager
-vainfo
-```
-
-`vainfo` should list the `iHD` driver and print supported VAEntrypoints
-(VLD decode / encode profiles for H264/HEVC).
-
-Functional check: play a file on a client that forces transcoding (or
-force it manually via Jellyfin's playback quality setting), then in
-Jellyfin's dashboard **Activity/Now Playing** panel confirm the
-transcode reason and check that CPU usage on jupiter (`htop`) stays low
-during playback rather than pegging a core — Quick Sync offload should
-show up as low CPU, some GPU (`intel_gpu_top`) activity instead.
-
-## Open items
-
-- Exact supported codec list depends on the iGPU generation (device ID
-  `9a49`) — confirm via `vainfo` output once run, and enable only the
-  hardware decode paths it actually reports.
-
-## Post-deploy fix: two additional runtime packages required
-
-After the initial deploy (Task 1's `SupplementaryGroups` grant) and
-enabling QSV in the dashboard, HEVC HDR playback hung indefinitely
-(Direct Play worked for some titles; titles that needed a real
-transcode+tonemap never produced output). Root-caused via
-`journalctl -u jellyfin` and the per-session ffmpeg transcode log
-(`find / -xdev -iname '*ffmpeg-transcode*'`) — two separate runtimes
-were missing beyond `intel-media-driver` (which only provides VAAPI):
-
-1. **QSV session creation failed:** `Error creating a MFX session: -9`
-   / `Error initializing an MFX session: -3` on
-   `-init_hw_device qsv=qs@va`. VAAPI and QSV are separate runtimes on
-   Linux — QSV needs the oneVPL/MFX GPU implementation. Fix: added
-   `pkgs.vpl-gpu-rt` ("oneAPI Video Processing Library Intel GPU
-   implementation"; note `onevpl-intel-gpu` is the old, renamed
-   attribute) to `hardware.graphics.extraPackages` in
-   `machines/jupiter/hardware-configuration.nix`.
-
-2. **OpenCL device creation failed:** `Failed to get number of OpenCL
-   platforms: -1001` (`CL_PLATFORM_NOT_FOUND_KHR`) on
-   `-init_hw_device opencl=ocl@va`. The `tonemap_opencl` filter jellyfin
-   uses for HDR→SDR tone-mapping needs a working OpenCL ICD, which
-   nothing installed so far provides. Fix: added
-   `pkgs.intel-compute-runtime` ("Intel Graphics Compute Runtime oneAPI
-   Level Zero and OpenCL, supporting 12th Gen and newer" — matches
-   jupiter's Tiger Lake/Xe iGPU) to the same `extraPackages` list.
-
-Confirmed working end-to-end: HEVC HDR transcode with QSV encode +
-OpenCL tone-map runs at `speed=2.68x` realtime on jupiter's iGPU, and
-plays smoothly on Apple TV (JellyTV app).
-
-Both packages live in `machines/jupiter/hardware-configuration.nix`
-(`hardware.graphics.extraPackages`), alongside `intel-media-driver`,
-rather than in the jellyfin module itself — they're iGPU runtime
-capabilities, not something specific to the jellyfin service.

docs/superpowers/specs/2026-08-05-immich-nixos-module-design.md

@@ -1,121 +0,0 @@
-# Immich: Docker → NixOS module migration
-
-**Date:** 2026-08-05
-**Machine:** jupiter (home server, Intel iGPU)
-**Status:** Design approved, pending implementation plan
-
-## Goal
-
-Replace the existing docker-compose Immich deployment on jupiter with the
-native `services.immich` NixOS module, wrapped in the repo's standard
-`my.profiles.*` pattern. Preserve all existing data (albums, faces, shared
-links, metadata) and photo/video library.
-
-## Decisions
-
-| Topic | Decision |
-|-------|----------|
-| Approach | Native `services.immich` (nixpkgs), not `oci-containers` |
-| Version target | **Resolved: docker runs 2.7.5 == stable nixpkgs 2.7.5.** Use the stable module as-is; no `package` override. Same-version restore, no forward schema migration |
-| Media location | Default local path `/var/lib/immich`. NAS deferred to a future read-only external library |
-| Database | Migrate via dump/restore — keep everything |
-| HW acceleration | Video transcoding only (VAAPI/QSV via existing Intel graphics stack). ML on CPU |
-| Access | LAN + VPN only: open port 2283, register on homepage dashboard. No reverse proxy/TLS |
-
-### Deliberately deferred (YAGNI)
-- OpenVINO ML acceleration
-- NAS-backed external library
-- Reverse proxy / TLS / public hostname
-
-## Part 1 — The module
-
-New file `modules/environments/immich/default.nix` following the profile
-pattern; add `./environments/immich` to `modules/environments/default.nix`;
-enable `my.profiles.immich.enable = true` in
-`machines/jupiter/environments.nix`.
-
-```nix
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.my.profiles.immich;
-  hostName = config.networking.hostName;
-  port = 2283;
-in {
-  options.my.profiles.immich.enable = lib.mkEnableOption "Immich photo server";
-
-  config = lib.mkIf cfg.enable {
-    services.immich = {
-      enable = true;
-      # package = pkgs.unstable.immich;   # only if docker :release is > 2.7.5
-      host = "0.0.0.0";
-      inherit port;
-      openFirewall = true;
-      mediaLocation = "/var/lib/immich";
-      machine-learning.enable = true;
-      accelerationDevices = [ "/dev/dri/renderD128" ];
-      settings.server.externalDomain = "http://${hostName}:${toString port}";
-    };
-
-    # native module does not add GPU groups; needed for VAAPI/QSV transcoding
-    users.users.immich.extraGroups = [ "video" "render" ];
-
-    my.homepage.services = [{
-      group = "Media";
-      name = "Immich";
-      description = "Photo & video server";
-      href = "http://${hostName}:${toString port}";
-      icon = "immich.png";
-    }];
-  };
-}
-```
-
-**Provided for free by the native module:** local PostgreSQL with the required
-vector extension over a **unix socket + peer auth** (so no DB password / sops
-secret needed), Redis, `immich-server` and `immich-machine-learning` systemd
-units, the `immich` system user, and `mediaLocation` created via tmpfiles.
-
-**Transcoding is two parts:** (a) NixOS exposes the GPU device + `video`/`render`
-groups (above); (b) the hwaccel backend (QSV/VAAPI) is chosen in Immich's
-**admin → video transcoding** settings after cutover — a UI toggle, not Nix.
-
-## Part 2 — Migration runbook (on jupiter)
-
-### Pre-flight (hard blocker)
-1. Get running docker Immich version (`docker exec <server> immich --version` or web UI footer).
-2. **Resolved 2026-08-05: running version is 2.7.5, equal to stable nixpkgs.**
-   Use the stable module as-is (no `package` override). Kept for reference:
-   - running ≤ 2.7.5 → stable module as-is ← **this case**
-   - 2.7.6–3.0.3 → set `package = pkgs.unstable.immich`
-   - `> 3.0.3` → bump nixpkgs first; **stop and re-plan**
-3. Record docker `UPLOAD_LOCATION` and DB container name/credentials.
-
-### Backup (before touching anything)
-4. `docker compose down` (DB may stay up for the dump).
-5. Dump DB: `docker exec -t <db> pg_dumpall --clean --if-exists --username=postgres > immich-db.sql`
-6. Verify upload folder intact; note size (no copy yet).
-
-### Cutover
-7. Add the module to jupiter's `environments.nix` (leave `database.createDB` default).
-8. `sudo nixos-rebuild switch --flake '.#jupiter'` → creates user, empty DB + role, `mediaLocation`. Then `systemctl stop immich-server immich-machine-learning`.
-9. Restore the DB into the NixOS Postgres (drop the freshly-created empty `immich` DB, load `immich-db.sql`) per Immich's restore docs.
-10. Move media into `/var/lib/immich` (subfolders `library/`, `upload/`, `thumbs/`, `encoded-video/`, `profile/`); `chown -R immich:immich /var/lib/immich`.
-11. `systemctl start immich-server`; it runs schema migrations forward. Watch `journalctl -u immich-server -f`.
-
-### Verify
-12. UI at `http://jupiter:2283` loads; log in; spot-check albums, faces, a shared link, and that thumbnails/originals actually load.
-13. Homepage tile works.
-14. Enable QSV/VAAPI in admin settings; transcode one video; confirm `journalctl` shows the hw path, not a CPU fallback error.
-
-### Rollback
-Before deleting any docker data: `systemctl stop immich-*`, disable the profile,
-`nixos-rebuild switch`, `docker compose up -d`. Original docker DB + upload
-folder remain untouched until explicitly removed after a few days of confidence.
-
-## Known risk — RESOLVED
-
-The main risk was step 9 crossing the **pgvecto.rs → VectorChord** vector-extension
-boundary. With source and target both at **2.7.5**, both use VectorChord — no
-boundary crossing and no forward schema migration. The restore is a same-version
-dump/load. Residual risk is limited to routine dump/restore mechanics
-(roles, extension availability in the NixOS Postgres, ownership on restore).

flake.lock

@@ -21,11 +21,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1785627969,
+        "lastModified": 1778716662,
-        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
         "type": "github"
       },
       "original": {
@@ -42,11 +42,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1778716662,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
         "type": "github"
       },
       "original": {
@@ -60,17 +60,20 @@
         "flake-compat": [
           "nix"
         ],
+        "gitignore": [
+          "nix"
+        ],
         "nixpkgs": [
           "nix",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1783008725,
+        "lastModified": 1781733627,
-        "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=",
+        "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe",
+        "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39",
         "type": "github"
       },
       "original": {
@@ -89,11 +92,11 @@
         "nixpkgs-regression": "nixpkgs-regression"
       },
       "locked": {
-        "lastModified": 1786447342,
+        "lastModified": 1782337899,
-        "narHash": "sha256-jA79fFQUEsLcpmjWRrlOgVVFVKUQSD4zOZIRKEpEx88=",
+        "narHash": "sha256-Imevyelg3r2N5iDonnGdOKGRiB56m3HgVFAljTB3CLU=",
         "owner": "NixOS",
         "repo": "nix",
-        "rev": "da110e01d913bb32bdc06a301c3797e8c42b8ab7",
+        "rev": "3887a906b178836818a62e8eba666ad652e8a388",
         "type": "github"
       },
       "original": {
@@ -143,11 +146,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1786437054,
+        "lastModified": 1782379505,
-        "narHash": "sha256-I++HzBBAgQ17UaLVU6aSm1/7LDo6c9xr8rAbpByWywE=",
+        "narHash": "sha256-zPvPiU+a7pqtH47xrtZLNRABJKpOjfZQclDbcvNtH+I=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "6ed13b1d888d5cb07dbb0723eb1df86bbacd0b9c",
+        "rev": "603d3afd1b6145bd66e97ae38a34d91c95df70cf",
         "type": "github"
       },
       "original": {
@@ -158,11 +161,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1783148766,
+        "lastModified": 1780902259,
-        "narHash": "sha256-H9+N+GFtsbVC8ZniHliChM7ndizxtqVZs6bnGOLM3WQ=",
+        "narHash": "sha256-YMnBf9lk/LYgvqfmSSJuOGigtRs5Lsy26pJHVlR9yMY=",
-        "rev": "a50de1b7d8a586adc18d2395c19de7d6058e6030",
+        "rev": "bd0ff2d3eac24699c3664d5966b9ef36f388e2ca",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.4193.a50de1b7d8a5/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.1550.bd0ff2d3eac2/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -187,11 +190,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1785031560,
+        "lastModified": 1777168982,
-        "narHash": "sha256-OmshNvn2vupOFpYinLUu+1Dnpu4n7Q5N3ggGVNHpkUI=",
+        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "0e79af5e3d4dcfcd676ab5ba3f95d2e3352e078c",
+        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
         "type": "github"
       },
       "original": {
@@ -218,11 +221,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1786247143,
+        "lastModified": 1782467914,
-        "narHash": "sha256-qemNveuexlWhK0Qc6Y8o+gtSVTIj5xljzTAXQZxTHWA=",
+        "narHash": "sha256-inDx/w70OSJoJPqtKh0BrzAsbZZhpya7YgS43jHnhwg=",
-        "rev": "279b4a8275f032c566576b3f181fa0f27197f588",
+        "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1050399.279b4a8275f0/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1022855.e73de5be04e0/nixexprs.tar.xz"
       },
       "original": {
         "id": "nixpkgs",
@@ -245,11 +248,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1786313170,
+        "lastModified": 1782375420,
-        "narHash": "sha256-F5163SsL9xqCLcx8CS2Y5MeLA5z6mfgXGDiCBEqSnbo=",
+        "narHash": "sha256-f+/IH5ng5P91VHrhcNxqpW2RYDySD68V1fcX00COQy4=",
-        "rev": "fcb8fcd6bf2d0adecae5bd491afaaaf8311b758d",
+        "rev": "4062d36ebeae843c750011eef6b61ec9a9dbc9a9",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.7376.fcb8fcd6bf2d/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.3250.4062d36ebeae/nixexprs.tar.xz"
       },
       "original": {
         "id": "nixpkgs",

machines/jupiter/environments.nix

@@ -21,9 +21,9 @@ in
     sonarr.enable = true;
     jellyfin.enable = true;
     jellyseerr.enable = true;
-    immich.enable = true;
     development.enable = true;
     home-assistant.enable = true;
+    ntfy.enable = true;
 
     homepage.enable = true;
     paperless = {

machines/jupiter/hardware-configuration.nix

@@ -35,8 +35,6 @@
       #vaapiIntel         # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
       libva-vdpau-driver
       libvdpau-va-gl
-      vpl-gpu-rt # oneVPL/MFX runtime, required for QSV (h264_qsv/hevc_qsv) session creation
-      intel-compute-runtime # OpenCL runtime, required for tonemap_opencl (HDR tone-mapping)
     ];
   };
 

machines/mibook/configuration.nix

@@ -10,7 +10,6 @@
     ./disks.nix
     ./hardware-configuration.nix
     ./environments.nix
-    ./network.nix
     # ./system.nix use docker here
   ];
 
@@ -45,14 +44,6 @@
 
   services.openssh.enable = true;
 
-  # KDE (PowerDevil) power settings: do nothing on lid close while on AC power.
-  # Shipped as a system-wide default; KConfig cascades so a user's own
-  # ~/.config/powerdevilrc will override this if present.
-  environment.etc."xdg/powerdevilrc".text = ''
-    [AC][SuspendAndShutdown]
-    LidAction=0
-  '';
-
   system = {
     stateVersion = "23.05";
     autoUpgrade.enable = true;

machines/mibook/network.nix

@@ -1,8 +0,0 @@
-_: {
-  # Athena (local AI): allow LAN access to the Hermes web dashboard.
-  # Bound to 0.0.0.0:9119 in the athena docker stack; NixOS default-deny
-  # firewall otherwise blocks inbound connections from other devices.
-  networking.firewall.allowedTCPPorts = [
-    9119 # athena hermes dashboard
-  ];
-}

modules/environments/default.nix

@@ -7,6 +7,7 @@
     ./claude-code
     ./development
     ./home-assistant
+    ./ntfy
     ./hyprland
     ./zsh
     ./paperless
@@ -19,6 +20,5 @@
     ./sonarr
     ./jellyfin
     ./jellyseerr
-    ./immich
   ];
 }

modules/environments/immich/default.nix

@@ -1,52 +0,0 @@
-# Immich self-hosted photo & video server
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.my.profiles.immich;
-  hostName = config.networking.hostName;
-  port = 2283;
-in
-{
-  options.my.profiles.immich = with lib; {
-    enable = mkEnableOption "Immich photo server";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.immich = {
-      enable = true;
-      host = "0.0.0.0";
-      inherit port;
-      openFirewall = true;
-      mediaLocation = "/var/lib/immich";
-      machine-learning.enable = true;
-      accelerationDevices = [ "/dev/dri/renderD128" ];
-      # Setting `settings` puts Immich in config-file mode: the admin settings
-      # UI becomes read-only and system config is managed declaratively here.
-      settings = {
-        server.externalDomain = "http://${hostName}:${toString port}";
-        # Intel Quick Sync hardware transcoding (jupiter's iGPU).
-        ffmpeg.accel = "qsv";
-      };
-    };
-
-    # The native module does not add GPU groups; required for VAAPI/QSV transcoding.
-    users.users.immich.extraGroups = [
-      "video"
-      "render"
-    ];
-
-    my.homepage.services = [
-      {
-        group = "Media";
-        name = "Immich";
-        description = "Photo & video server";
-        href = "http://${hostName}:${toString port}";
-        icon = "immich.png";
-      }
-    ];
-  };
-}

modules/environments/jellyfin/default.nix

@@ -22,8 +22,6 @@ in
       openFirewall = true;
     };
 
-    environment.systemPackages = [ pkgs.libva-utils ];
-
     my.homepage.services = [
       {
         group = "Media";
@@ -36,10 +34,6 @@ in
 
     systemd.services.jellyfin = {
       after = [ "network-online.target" ];
-      serviceConfig.SupplementaryGroups = [
-        "video"
-        "render"
-      ];
     };
   };
 }

modules/environments/ntfy/default.nix

@@ -0,0 +1,74 @@
+# self-hosted push notification server (ntfy)
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.profiles.ntfy;
+  hostName = config.networking.hostName;
+in
+{
+  options.my.profiles.ntfy = with lib; {
+    enable = mkEnableOption "ntfy notification server";
+
+    port = mkOption {
+      type = types.port;
+      default = 2586;
+      description = "HTTP port ntfy listens on.";
+    };
+
+    topic = mkOption {
+      type = types.str;
+      default = "ha";
+      description = "Topic Home Assistant publishes notifications to.";
+    };
+
+    haIntegration.enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Wire a Home Assistant rest_command that publishes to ntfy.";
+    };
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      services.ntfy-sh = {
+        enable = true;
+        settings = {
+          base-url = "http://${hostName}:${toString cfg.port}";
+          listen-http = ":${toString cfg.port}";
+          auth-file = "/var/lib/ntfy-sh/user.db";
+          auth-default-access = "deny-all";
+        };
+      };
+
+      networking.firewall.allowedTCPPorts = [ cfg.port ];
+
+      my.homepage.services = [
+        {
+          group = "Services";
+          name = "ntfy";
+          description = "Push notifications";
+          href = "http://${hostName}:${toString cfg.port}";
+          icon = "ntfy.svg";
+        }
+      ];
+    })
+
+    (lib.mkIf (cfg.enable && cfg.haIntegration.enable && config.my.profiles.home-assistant.enable) {
+      services.home-assistant.config.rest_command.ntfy_send = {
+        url = "http://${hostName}:${toString cfg.port}/${cfg.topic}";
+        method = "POST";
+        payload = "{{ message }}";
+        content_type = "text/plain";
+        username = "homeassistant";
+        password = "!secret ntfy_password";
+        headers = {
+          Title = "{{ title | default('Home Assistant') }}";
+          Priority = "{{ priority | default('default') }}";
+        };
+      };
+    })
+  ];
+}