prepare immich for data volume split

clusters/base/apps/immich/helmrelease-server.yaml

@@ -14,6 +14,11 @@ spec:
     controllers:
       server:
         strategy: Recreate
+        # temporarily disabled while /data is being split into separate
+        # per-purpose Longhorn volumes (encoded-video, thumbs, backups,
+        # data) and the old combined "other" volume is preserved untouched
+        # as a fallback, remounted at /data-old.
+        replicas: 0
         podDisruptionBudget:
           maxUnavailable: "0"
         initContainers:
@@ -189,8 +194,53 @@ spec:
           server:
             mergerfs:
               - path: /dev/fuse
-      # everything immich keeps outside "library" (backups, encoded-video,
-      # profile, thumbs, upload) - plain volume, no mergerfs involved.
+      # split out of the old combined "other" volume below: each of these
+      # purposes now gets its own Longhorn volume instead of sharing one
+      # 200Gi disk, so a single hot subtree (e.g. thumbs) doesn't force
+      # replica rebuilds/relocation to drag the whole 200Gi with it.
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 20Gi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          server:
+            app:
+              - path: /data
+      encoded-video:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 100Gi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          server:
+            app:
+              - path: /data/encoded-video
+      thumbs:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 100Gi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          server:
+            app:
+              - path: /data/thumbs
+      backups:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 30Gi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          server:
+            app:
+              - path: /data/backups
+      # old combined volume (backups, encoded-video, profile, thumbs,
+      # upload) - kept mounted read-write as a fallback/reference copy at
+      # /data-old, untouched, until the split above is confirmed good.
       other:
         type: persistentVolumeClaim
         accessMode: ReadWriteOnce
@@ -200,4 +250,4 @@ spec:
         advancedMounts:
           server:
             app:
-              - path: /data
+              - path: /data-old

clusters/base/apps/immich/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: immich-secrets
     namespace: photo
 stringData:
-    DB_PASSWORD: ENC[AES256_GCM,data:RfniuH5QA/wwXnAKYbn9gsCj94I1aTN94lzQHNcLYvo=,iv:MFK4S1DwdQJcn5EZv1a2fhFCNdhvvOEydlg0xOrMMXk=,tag:zYPUsWIBf7JFCWPMTIsQwQ==,type:str]
+    DB_PASSWORD: ENC[AES256_GCM,data:LWU6HRmm8ynxoAbGsYJz+dToU3hLZHzKMYgcm2wBKPM=,iv:2Zm4ydVqDdruZZ8iBL/XUWVGlvVsTqy0RmcAPhHA3fY=,tag:GhlOdhCfJWvCPv3PdmxCqA==,type:str]
 sops:
     age:
         - recipient: age1wmm8qrqnjzvd5nkraed6ylrsxlpn3ru7d7zettdudj7y9sg9dd2su0u3mr
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4aUZyamxWQ3JzVWF0b1Rn
-            eEdSMGZhTm9Ca001ZDlBa1NpR0MrbWJUY0hFCjRTQ1hTZFJmNzRnejB0SmFhSzhT
-            dGFQL2FMNE1xR0pFK29FNWNTSjlRSW8KLS0tIElHZnE2bWdWalE5Z0dQV1ljSEd3
-            cVNvNTdNMm00c2x5R0pvZk4xblo5elEKfoF9hrtoBgAQyJwkIDx6ZFlfkzp2m/yQ
-            //c7LbjnDLG8Y3sqFDgd+odbsfZuYZz1hlfzsuG6jZ47hQA4Ioo6cw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOT2o0MHJuS0Q0dmtpRlNO
+            NjRseFQrWlNvZEI1NVRDWWt2eDlEN2pGQWtrCmU3WTdtVEdYOUdqV3JTQUpRU0lD
+            SzY3OXpQaWpKczZnM3p0YVUwK0JLYXcKLS0tIDBzTUxCYzIxWkNmMWJFbmhQQ3RM
+            K3d3b1dFbUJpOWMrQVBCNjZkWlNGVFEK8J6CMLAk63D4Skzkf2mGazJUSVN3dop+
+            i+5USt36EeosLxosbKwsRpM6fVIrByWxSSYZlQoePEECc8KJD5mYGA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:30:15Z"
-    mac: ENC[AES256_GCM,data:tpCZBIcSLzN5ei66eEBEcjdgKydqjSVMGN+Zw2tf7FF7yWj/slQQDrmdkhuGSxHKNPGYWYIXmoDaAF/h2jhBUWQNvtbpjX+YAlQv/WxMtYjzwEVCSwNScFUoMKdXTzz3KBTXq50RcscKRDFq+VSbGhRI6Vg8AmDhYsMIygG9kU4=,iv:B1+oAsouc24mf9jYniThxZCkxq88plr5xcbcSCI75Do=,tag:Dzbn4v4o0hvs2yzQPGrUpA==,type:str]
+    lastmodified: "2026-08-26T10:30:24Z"
+    mac: ENC[AES256_GCM,data:FllSD/TJ5vL4Csyc0NxttJm+88NrarrJkw5yw5ltnw/SH1n78ala1pF/ZLEeY7ioEPf8/3jA4vslY0qA9mfWOJDMRofj9rVn9dcJ0YrpTSz1wgpV8yvZ6Xr3gKN9l279r0l4/O8WGkn6EzBpr1uuVeTog6fPYJJ65tlmpjcFm0g=,iv:bBbmzhlq7JOp1z33WISPQ5J+Ex1Fq7JSglK7sHOShtQ=,tag:cgPvqf7td8l3tivYCE3Kvw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0