The library that is not a copy: an external-library rule for Immich
- date
- 20260724
- what happened
- Immich, a self-hosted photo manager, was set up to index roughly 135,000 photo and video assets by referencing existing source trees in place rather than importing copies. Its database holds thumbnails and metadata for those trees, so deleting a source file deletes the photo, not a backup of it.
- what it cost
- Nothing yet, by design, but the exposure is total: several terabytes had exactly one copy each, and nothing in the interface distinguishes a managed asset from an externally referenced one.
- what changed
- A written list of external-library paths that may never be deleted, because deleting one destroys the only copy of the photos it references, plus a verification script that hashes a source tree and confirms every file is indexed before any source is considered for retirement.
- the check now
- An external-library source is never retired. Only a managed upload, a copy inside the application's own storage, can be retired, and only after the verification script confirms every source file by hash and the copy is in the backup set. Never infer that a file has been imported from what the interface displays.
Self-hosted media tools that promise not to duplicate your library often do exactly what they say. They hold pointers, not copies. Immich was installed to manage roughly 135,000 photos and videos (counted at setup, 20260724), and to keep storage sane it was pointed at existing folders rather than given a fresh copy of everything. That is the efficient design and also the trap. From inside the application, an externally referenced photo and an internally stored one look identical. There is no visual cue that says “if you delete the file behind this thumbnail, the photo is gone everywhere, including from here”.
The project built a permanent list of trees that may never be deleted, and a small script that proves by hash that every file in a candidate-for-retirement folder is present and indexed before anyone touches the source. The distinction the tool draws internally, a managed asset it copied into its own storage versus an external asset it merely references, is the whole safety boundary, and it is not surfaced anywhere an operator would look during a cleanup.
The general lesson travels well beyond photo management. Any tool that advertises “no duplication” is making a promise about where the only copy lives, and that promise is worth writing down explicitly rather than trusting the interface to remind you at the moment it matters.
Source: node0 lessons v0.1, lesson 3.2. Sanitized: checklist v0.1, 20260921; folder names, family and business context, script name; voice pass 20260921. Part of oznog.com/node0.