Track post-setup work for dar-es-balat

[Kabilan108]

Follow-up work intentionally deferred from the initial NAS setup:

• Configure scoped Restic backups for sietch and jacurutu (Configure scoped Restic backups from sietch and jacurutu to dar-es-balat #12).
• Process and import the Google Photos Takeout export using docs/handoffs/2026-08-04-google-photos-takeout-import-handoff.md.
• Migrate the Jellyfin library to the NAS over read-only LAN NFSv4; then remove the obsolete tailnet NFS grant.
• Add an encrypted off-NAS backup for irreplaceable data.
• Install the second disk and expand the SHR pool with redundancy.
• Reserve the future jacurutu dock address and move its backup transport to wired LAN.
• Revisit and narrow jacurutu broad tailnet access once fleet workflows stabilize.
• Design actual IoT isolation with a VLAN-capable router or access point.

Current rollout closes after both Google Drive mirrors complete, the DSM firewall is tightened, and final smoke tests pass.

References:

• docs/nas-network-policy.md
• Configure scoped Restic backups from sietch and jacurutu to dar-es-balat #12

[Kabilan108]

Consider looking at how Ben Davis set up his homelab servers
https://www.davis7.sh/home-server

[Kabilan108]

Google Photos migration is complete.

Current NAS state:

• The historical Google Photos export is imported into Synology Photos Shared Space, with ongoing Pixel uploads kept separate.
• The photo share has scheduled Btrfs snapshots every six hours; at closeout DSM showed 29 restore points with 14 daily, 8 weekly, 12 monthly, and the 5 latest snapshots retained.
• The initial NAS rollout is complete: DSM and Photos use Tailscale, the DSM firewall is default-deny, and LAN SMB access is limited to the authorized sietch address.
• Both Google Drive download-only mirrors are up to date and protected by scheduled snapshots.
• Scoped SMB backup shares and service accounts exist; client-side Restic setup remains tracked in Configure scoped Restic backups from sietch and jacurutu to dar-es-balat #12.
• Jellyfin/NFS migration, an independent off-NAS backup, the second SHR disk, the future jacurutu wired reservation, and IoT segmentation remain deferred in this issue.