immich-postgres fix

clusters/base/apps/immich/helmrelease-postgres.yaml

@@ -53,7 +53,12 @@ spec:
         storageClass: longhorn
         retain: true
         globalMounts:
+          # subPath, not the raw mount root: a fresh Longhorn ext4 volume's
+          # root always contains a "lost+found" dir, and postgres's initdb
+          # refuses to initialize into a non-empty directory even when
+          # lost+found is the only thing in it.
           - path: /var/lib/postgresql/data
+            subPath: data
       # postgres' parallel query workers need real shared memory, not the
       # default 64Mi container tmpfs - matches shm_size: 128mb in the
       # original docker-compose.

clusters/base/apps/immich/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: immich-secrets
     namespace: photo
 stringData:
-    DB_PASSWORD: ENC[AES256_GCM,data:7Pzt0sgMCbesVzcVNX63Hi8FmmR0WIlS1DeWhYn4EKA=,iv:Op9riDZatzmYYuQpzwfJ5J+rCTyzVK1WsLFECXQKwAY=,tag:0tI1N8eu70om9GEU109f5w==,type:str]
+    DB_PASSWORD: ENC[AES256_GCM,data:UI7+BCaaqkUmRH7Vzi1uXgVx7w8kJG/UGMsVhltbcUQ=,iv:5ndFPYaWw7S3fBuV4mLv9+ghWzwz9fG3ZoRN4noiMOU=,tag:0Tc9sgfvxECJG0t+Hw88Mg==,type:str]
 sops:
     age:
         - recipient: age1wmm8qrqnjzvd5nkraed6ylrsxlpn3ru7d7zettdudj7y9sg9dd2su0u3mr
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5TTlvZVo0NGV6RitxWC9w
-            d1VoMWRJQkdpekY0QzEwTHprQkl6cURTL2o0Cm8wRnJYNVFMWTIxaFpZd0MzMm5w
-            NEw1QUpzUjBrSG5kZ25ZMVl2MVVFU2MKLS0tIGMzc3ZnNUwxV3NOaGRKajUyVnI5
-            dEpEQTd0RVh4RGdFRnluUXZmV1k0T2sKJPSsUQPrKpUKVUeSkfYGvaPjvbaZl+UI
-            UNBx6B5oLbiIaB2gRjEVSx1ppC+n1L+LYszGvFvRTJuLLCGXcEaCmA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTanhnRHAyV01WNGJNdkJK
+            eFdZRS9iMkJFK052SDkrVnM0YXdZYXdqYndRCjNwM0dySjFwTElrVFh6MVIwc05H
+            ZER0N1BDei85S0tXZnl4OFJKZzBXZ0kKLS0tIHErNjR3TFo4YnR2S0FZcUR0emsy
+            VjRDSHMvOHN3djNLcWVCMlBjZUQ4RzQKlqSUgBpenQS5G+1B2LM6C93d3jnnca/V
+            B2qB6BQUyIDYH+UlCGTOPADgtDf4a1LjBK6C9mBMGMH+zoFnwGs7Cg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:27:44Z"
-    mac: ENC[AES256_GCM,data:+bwvNRkXRw+cneVf+CLAxjGFHtnvfj6O0NZxSxcRqcWUSOvLcL+4Aevrun0vCk+49l9TED/U2TbpECVIH3f576UK4Ge0EP9enPsNBJezJURsTdCeWWXJHs/R+E8/agUDBU4zXGo9hmABu687V5e7c8U2ZCm1o7UdO4SdvUukSDM=,iv:275XCj4coFIxhIlmDmlxoYXIvnx5Z79oDEi3mtupXTk=,tag:o1tEkjNa3vfRVZTuxICMQw==,type:str]
+    lastmodified: "2026-08-26T10:27:53Z"
+    mac: ENC[AES256_GCM,data:wxOHa1xg3vP7SrswPZHV/OETMlaBIgjnf26RP53R5+jETJsCZWne89QBGpRZU4OIM0Ks7NiItbpkCDus6DObLJW2yhDEVZGefHwG8cVG5cniPl+UhsNjMxilKCfVd2q9RxvRCLFkr1WB56WuqLNQgKy/w5pYivLa6z28V3Z2gSo=,iv:7IlgbzYdxWzGtKiHtpcpzZGUEIAwQWCcu86EHU/R9+E=,tag:NW73nfHmCJuwAfCVIr1fjQ==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0