A Family Photo Vault is the optional native v2 photos workload with Immich on a host you control. It is present in the public v0.16.0 catalog but is not selected by the initial StackSpec.
Choose the host
- Use Basement Kit for local hardware and LAN-first access.
- Use Cloud Kit for an existing VPS or cloud host with a domain you control.
Plan storage and backups before importing a family library. Photos and videos often become the largest data set in a homelab.
Current release boundary
The released contract requires:
- the
photos workload with the immich alternative
- explicit site and node placement
- a supported workload adapter
- an opaque
database-password secret reference backed by local owner custody
The v0.16.0 CLI can validate and generate that contract, but the initial CUE-authored StackSpec contains no Photos workload. Local secret custody is created during init, and the release exposes no safe public post-init command to add it later.
Do not use a copied secret reference as a password and do not run a generic apply recipe from this page. Until the release provides a complete public authoring flow, this use case is planning guidance rather than an end-to-end install path.
Keep it maintainable
- Keep the StackSpec and verification output with the workspace.
- Change the StackSpec rather than generated application files.
- Size primary and backup storage for photo and video growth.
- Confirm a staged restore before relying on the service for irreplaceable photos.
- Create Immich accounts only after a future complete rollout verifies.
For the application-level steps, see Immich. 