homelab/k8s/apps/immich/deployment.yaml

# immich-server: pinned to talos-cp-3, same reasoning as paperless
# (deployment.yaml comment there) - immich-media is a ReadWriteOnce Longhorn
# volume with a single replica physically on that node's disk (shared with
# paperless-media on the same 4TB HDD). Recreate strategy for the same
# reason: two pods can't both attach an RWO volume.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: immich-server
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: immich-server
  template:
    metadata:
      labels:
        app: immich-server
    spec:
      serviceAccountName: immich
      nodeSelector:
        kubernetes.io/hostname: talos-cp-3
      containers:
        - name: immich-server
          image: ghcr.io/immich-app/immich-server:release
          ports:
            - containerPort: 2283
          envFrom:
            - configMapRef:
                name: immich-config
          env:
            - name: DB_USERNAME
              valueFrom:
                secretKeyRef:
                  name: immich-db-app
                  key: username
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: immich-db-app
                  key: password
            # Composed by k8s/infra/iam's provisioning script (system-config
            # JSON, oauth section) - see immich-oidc Secret.
            - name: IMMICH_CONFIG_FILE
              value: /config/immich.json
          resources:
            requests: { cpu: "500m", memory: "1Gi" }
            limits: { cpu: "2", memory: "4Gi" }
          volumeMounts:
            - name: media
              mountPath: /usr/src/app/upload
            - name: oidc-config
              mountPath: /config
              readOnly: true
      volumes:
        - name: media
          persistentVolumeClaim:
            claimName: immich-media
        - name: oidc-config
          secret:
            secretName: immich-oidc
            items:
              - key: config.json
                path: immich.json
---
# CPU-only for now - the cluster's one GPU node (worker-1) is already
# dedicated to llm-serving predictors. Not node-pinned: its cache PVC is on
# the default 3-replica pool, not the single-disk cp-3 HDD.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: immich-machine-learning
spec:
  replicas: 1
  selector:
    matchLabels:
      app: immich-machine-learning
  template:
    metadata:
      labels:
        app: immich-machine-learning
    spec:
      serviceAccountName: immich
      containers:
        - name: immich-machine-learning
          image: ghcr.io/immich-app/immich-machine-learning:release
          ports:
            - containerPort: 3003
          resources:
            requests: { cpu: "500m", memory: "1Gi" }
            limits: { cpu: "2", memory: "4Gi" }
          volumeMounts:
            - name: ml-cache
              mountPath: /cache
      volumes:
        - name: ml-cache
          persistentVolumeClaim:
            claimName: immich-ml-cache