So I end up with 3 copies of all my photos, on 3 different providers (I mean... 2 different providers plus my homelab disk).
[1] https://immich.app/ [2] https://github.com/garethgeorge/backrest
It's mainly just rsync. When the phone was plugged in, the photos were accessible at a path like "/run/user/1000/gvfs/gphoto2:host=Apple_Inc._iPhone_abc123/".
Now I use Time Machine, but I still need to check whether it includes iCloud photos.
The script currently requires changing one or two folder paths at the top (more details in the script).