From abed3296367b78358493db52dd8418cc5eb02df5 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 25 Aug 2026 18:49:09 -0700
Subject: [PATCH] fix: add postInitApplicationSQL for pgvector, app role isn't
 superuser

immich-server crash-looped on "permission denied to create extension
vector" - pgvector's control file isn't marked trusted, and CNPG's
app owner role isn't superuser (enableSuperuserAccess: false).
Documents the fix for future cluster rebuilds; the live cluster
already had CREATE EXTENSION run manually via the postgres pod's
local socket.
---
 k8s/apps/immich/db.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/k8s/apps/immich/db.yaml b/k8s/apps/immich/db.yaml
index ac3fbc2..112db47 100644
--- a/k8s/apps/immich/db.yaml
+++ b/k8s/apps/immich/db.yaml
@@ -32,6 +32,14 @@ spec:
       encoding: UTF8
       localeCollate: C
       localeCType: C
+      # CREATE EXTENSION vector requires superuser (pgvector's control file
+      # isn't marked trusted) and the "app" owner role isn't one
+      # (enableSuperuserAccess: false, repo convention) - postInitApplicationSQL
+      # runs as superuser during initdb, before the app ever connects. Only
+      # fires on a fresh bootstrap; the live cluster already had this run
+      # manually once (kubectl exec ... psql -U postgres -c 'CREATE EXTENSION').
+      postInitApplicationSQL:
+        - "CREATE EXTENSION IF NOT EXISTS vector;"
   enableSuperuserAccess: false
   resources:
     requests: { memory: "512Mi", cpu: "250m" }