immich

2026-08-21 15:23:58 +03:00
parent 85f758b76c
commit 6a94f95c1c
20 changed files with 385 additions and 87 deletions
@@ -0,0 +1,50 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: immich-ml
+  namespace: photo
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: immich
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      ml:
+        containers:
+          app:
+            # CPU-only: hardware-accelerated tags (-openvino, -cuda, etc)
+            # need specific host devices (e.g. /dev/dri) that aren't set up
+            # on these nodes. Switch tags later if that changes.
+            image:
+              repository: ghcr.io/immich-app/immich-machine-learning
+              tag: release
+            env:
+              TZ: Europe/Moscow
+            resources:
+              requests:
+                cpu: 500m
+                memory: 512Mi
+              limits:
+                memory: 4Gi
+
+    service:
+      app:
+        controller: ml
+        ports:
+          http:
+            port: 3003
+
+    persistence:
+      # caches downloaded ML models so they survive pod restarts instead of
+      # re-downloading (a few hundred MB) every time.
+      cache:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 10Gi
+        storageClass: longhorn-single-replica
+        retain: true
+        globalMounts:
+          - path: /cache
@@ -0,0 +1,65 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: immich-postgres
+  namespace: photo
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: immich
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      postgres:
+        containers:
+          app:
+            # immich requires this specific image - it bundles the
+            # vectorchord/pgvecto.rs extensions immich's DB schema depends
+            # on; a plain postgres image will not work.
+            image:
+              repository: ghcr.io/immich-app/postgres
+              tag: 14-vectorchord0.4.3-pgvectors0.2.0
+            env:
+              TZ: Europe/Moscow
+              POSTGRES_USER: postgres
+              POSTGRES_DB: immich
+              POSTGRES_INITDB_ARGS: "--data-checksums"
+              POSTGRES_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: immich-secrets
+                    key: DB_PASSWORD
+            resources:
+              requests:
+                cpu: 100m
+                memory: 256Mi
+              limits:
+                memory: 2Gi
+
+    service:
+      app:
+        controller: postgres
+        ports:
+          postgres:
+            port: 5432
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 10Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /var/lib/postgresql/data
+      # postgres' parallel query workers need real shared memory, not the
+      # default 64Mi container tmpfs - matches shm_size: 128mb in the
+      # original docker-compose.
+      dshm:
+        type: emptyDir
+        medium: Memory
+        sizeLimit: 128Mi
+        globalMounts:
+          - path: /dev/shm
@@ -0,0 +1,33 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: immich-redis
+  namespace: photo
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: immich
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      redis:
+        containers:
+          app:
+            image:
+              repository: docker.io/valkey/valkey
+              tag: "9"
+            resources:
+              requests:
+                cpu: 20m
+                memory: 32Mi
+              limits:
+                memory: 256Mi
+
+    service:
+      app:
+        controller: redis
+        ports:
+          redis:
+            port: 6379
@@ -0,0 +1,82 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: immich-server
+  namespace: photo
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: immich
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      server:
+        containers:
+          app:
+            image:
+              repository: ghcr.io/immich-app/immich-server
+              tag: release
+            env:
+              TZ: Europe/Moscow
+              DB_HOSTNAME: immich-postgres
+              DB_PORT: "5432"
+              DB_USERNAME: postgres
+              DB_DATABASE_NAME: immich
+              DB_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: immich-secrets
+                    key: DB_PASSWORD
+              REDIS_HOSTNAME: immich-redis
+              REDIS_PORT: "6379"
+              IMMICH_MACHINE_LEARNING_URL: http://immich-ml:3003
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 200m
+                memory: 512Mi
+              limits:
+                memory: 4Gi
+
+    service:
+      app:
+        controller: server
+        ports:
+          http:
+            port: 2283
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: photo.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: immich-tls
+            hosts:
+              - photo.aggtaa.com
+
+    persistence:
+      # brand new, dedicated library - deliberately not reusing the old
+      # docker-compose install's NAS data, and not nfs-photo either.
+      library:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 100Gi
+        storageClass: longhorn-single-replica
+        retain: true
+        globalMounts:
+          - path: /data
@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: immich
+  namespace: photo
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease-postgres.yaml
+  - helmrelease-redis.yaml
+  - helmrelease-ml.yaml
+  - helmrelease-server.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: immich-secrets
+    namespace: photo
+stringData:
+    DB_PASSWORD: ENC[AES256_GCM,data:7Pzt0sgMCbesVzcVNX63Hi8FmmR0WIlS1DeWhYn4EKA=,iv:Op9riDZatzmYYuQpzwfJ5J+rCTyzVK1WsLFECXQKwAY=,tag:0tI1N8eu70om9GEU109f5w==,type:str]
+sops:
+    age:
+        - recipient: age1wmm8qrqnjzvd5nkraed6ylrsxlpn3ru7d7zettdudj7y9sg9dd2su0u3mr
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5TTlvZVo0NGV6RitxWC9w
+            d1VoMWRJQkdpekY0QzEwTHprQkl6cURTL2o0Cm8wRnJYNVFMWTIxaFpZd0MzMm5w
+            NEw1QUpzUjBrSG5kZ25ZMVl2MVVFU2MKLS0tIGMzc3ZnNUwxV3NOaGRKajUyVnI5
+            dEpEQTd0RVh4RGdFRnluUXZmV1k0T2sKJPSsUQPrKpUKVUeSkfYGvaPjvbaZl+UI
+            UNBx6B5oLbiIaB2gRjEVSx1ppC+n1L+LYszGvFvRTJuLLCGXcEaCmA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:27:44Z"
+    mac: ENC[AES256_GCM,data:+bwvNRkXRw+cneVf+CLAxjGFHtnvfj6O0NZxSxcRqcWUSOvLcL+4Aevrun0vCk+49l9TED/U2TbpECVIH3f576UK4Ge0EP9enPsNBJezJURsTdCeWWXJHs/R+E8/agUDBU4zXGo9hmABu687V5e7c8U2ZCm1o7UdO4SdvUukSDM=,iv:275XCj4coFIxhIlmDmlxoYXIvnx5Z79oDEi3mtupXTk=,tag:o1tEkjNa3vfRVZTuxICMQw==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0