pin immich ver to 2.7.5

clusters/base/apps/immich/helmrelease-ml.yaml

@@ -19,8 +19,12 @@ spec:
             # need specific host devices (e.g. /dev/dri) that aren't set up
             # on these nodes. Switch tags later if that changes.
             image:
+              # pinned to match immich-server's version (see
+              # helmrelease-server.yaml) - server and ML communicate over
+              # an internal API contract that isn't guaranteed compatible
+              # across versions.
               repository: ghcr.io/immich-app/immich-machine-learning
-              tag: release
+              tag: v2.7.5
             env:
               TZ: Europe/Moscow
             resources:

clusters/base/apps/immich/helmrelease-server.yaml

@@ -76,7 +76,16 @@ spec:
           app:
             image:
               repository: ghcr.io/immich-app/immich-server
-              tag: release
+              # pinned to match the DB backup being restored
+              # (immich-db-backup-20260711T020000-v2.7.5-pg14.19.sql.gz) -
+              # a newer server expects a newer DB schema than what that
+              # backup contains, so it has to match at restore time. Once
+              # the restore is done and v2.7.5 has come up cleanly against
+              # it, bump back to "release" - v2.7.5's own migrations will
+              # carry the schema forward from there, which is the safe
+              # supported upgrade path (vs. jumping straight to a much
+              # newer server against a much older schema).
+              tag: v2.7.5
             env:
               TZ: Europe/Moscow
               DB_HOSTNAME: immich-postgres

clusters/base/apps/immich/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: immich-secrets
     namespace: photo
 stringData:
-    DB_PASSWORD: ENC[AES256_GCM,data:7BQqb2tlNQoAF425YgOkz/0r5iBvdTOzevB+xiuWe+Q=,iv:jHE5uXm1oclkKVXIo3VcOLl6blMkBTVHrKZ82qVWGd8=,tag:6B6Q+mGijw/1wCSC20LIpA==,type:str]
+    DB_PASSWORD: ENC[AES256_GCM,data:qIyLbynKRWbr+HkLKHMPIYKwMY2mfnWeiuji9Ami/RE=,iv:taGELFgp++UOkjJ301AYb+PI93qXJ134yPeyLkC1Vm0=,tag:PpJKK9kxpzp9PeXVBrVlDA==,type:str]
 sops:
     age:
         - recipient: age1wmm8qrqnjzvd5nkraed6ylrsxlpn3ru7d7zettdudj7y9sg9dd2su0u3mr
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtUlF1eWQ3eGltOGtHOGFw
-            bWlMVGc4dXlndFYvZFNWWlJxMVBkSkdXZlVzCjFCRjhoVmllNzA5a0NRQ3Exbkgv
-            cC9YYnJJTTdYeHdsTVNFWXRwKzV2L0UKLS0tIGltN2hNaTg4QzVsTzloMjFSSXFM
-            Y0JpWUNXTWFvdnFsZGJnS2tpSzBGSzAKdU/0sAbymYEimuxQAdlsPc+Q8iSf4D4f
-            L6pwX9bs9SElnhOhbmI3gZLhLaa9aUTMEZ+MwtQtKP8Oy33ee9vMSQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2MHhJaytNWEhlSzBzY2Zt
+            cUpUZ2UwRTlPWUZHTUkyS1hLZk9qUExTdnc0CkNDOVhkYmRxaG1nckJqQ1lDeEhF
+            bjJtWGlvWDRJdmpZNkI2NHViTHdMOWMKLS0tIE1zNURyWkJpV1JOc09jbEZmeHp1
+            VFpZT3I0YThVVXBwTVp0Tk5Qd0tQNVEKU5hd7cj0iWJcQFvzD9VowNgnRQOAjajJ
+            CaPwQNOqanQ2AesaWEFAAk6ND5AvUW7f2rdk6gA2O9lkoPuVtMtLlg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:49Z"
-    mac: ENC[AES256_GCM,data:Sn9XA5Nn7JecKW4nnIQuiNMntQ5JP0V2+BmcxwPiT/K3A/41H86lCT4poSkj9z7ItJZY4YbeBqut4icm0c68K6KSUAqobenF/ff6lJoz6zKN8eHXjoCHZqIQVN5nik8kIh9+orKgIGc5vjHN5uLTgR6P0/tIp1MwbnzQGPPV1RM=,iv:Ot60wynniwMgUgMXaNh3uyZIFP1hJYRVgMKNhSoTwhU=,tag:MvroN6a49BPkoxYiM6Z5sw==,type:str]
+    lastmodified: "2026-08-26T10:28:58Z"
+    mac: ENC[AES256_GCM,data:xxoauF7/+GAST+o0gGJV+Ezwsg8C5OZgXqkrkyvDt0eVmRgRAN9Oa/OMRGFJP07eNRmGtYv23IzW8f0yCqp8Oxg5YBPES3jKlG0q41rIykvtJ0PGWnn94WY5lQOPg1PC8XezihrEByncu2WyD3nPL3p3LwMG1JjNnWXEN854K3s=,iv:LmmM/koypOWhr+Po8e75zRihhKsbMyQf302dCVSy6tk=,tag:XHC6M4bCsEnVcD6ZnJZPeQ==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0