Story Crater Bot
61a1975669
Self-hosted photo backup (Google Photos replacement) - raw manifests, no Helm chart, self-contained under k8s/apps/immich including its own CNPG Postgres. Media PVC shares the cp-3 HDD 2TB/2TB with paperless-media. Postgres is pg18, not this repo's usual 16.2: CNPG's official pgvector extension image (ghcr.io/cloudnative-pg/pgvector) is only published for pg18, loaded via CNPG's ImageVolume extension mechanism (operator 1.30.0 / k8s 1.36.1 both support it). Immich auto-manages CREATE EXTENSION itself at startup. OIDC via a new "immich_role" Authentik scope mapping (homelab-admins/ immich-admins -> "admin" claim, else "user"), consumed by Immich's OAuth roleClaim setting which re-syncs isAdmin on every login - more reliable than Immich's racy first-user-is-admin fallback. Config composed into an immich-oidc Secret and mounted as IMMICH_CONFIG_FILE, matching the paperless-oidc pattern. k8s RBAC (immich-operator Role + oidc:immich-admins binding) mirrors paperless/rbac.yaml. immich namespace pre-created in k8s/infra/databases/namespaces.yaml (not just immich's own CreateNamespace=true) since the iam PostSync job's RoleBinding needs it to exist before wave 8.
49 lines
1.7 KiB
YAML
49 lines
1.7 KiB
YAML
# Dedicated CNPG Postgres for Immich. Same recipe as paperless-db/authentik-db
|
|
# (2 instances, default longhorn storage class) except the operand is
|
|
# PostgreSQL 18, not 16.2 - the official CNPG pgvector extension image
|
|
# (ghcr.io/cloudnative-pg/pgvector) is only published for pg18, no pg16 tags
|
|
# exist in that registry. Immich itself supports pg18 fine (immich-app's own
|
|
# postgres image already ships 18-vectorchord builds).
|
|
#
|
|
# pgvector loaded via CNPG's ImageVolume extension mechanism (CNPG 1.27+,
|
|
# k8s ImageVolume feature - both present here: operator is 1.30.0, cluster is
|
|
# v1.36.1). No shared_preload_libraries needed - pgvector doesn't require
|
|
# preload, just CREATE EXTENSION, which immich-server issues itself at
|
|
# startup. Distro/pg-major must match between the operand image and the
|
|
# extension image (both "18"+"trixie" here) - CNPG's own compatibility rule.
|
|
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: immich-db
|
|
annotations:
|
|
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
|
spec:
|
|
instances: 2
|
|
imageName: ghcr.io/cloudnative-pg/postgresql:18-minimal-trixie
|
|
postgresql:
|
|
extensions:
|
|
- name: pgvector
|
|
image:
|
|
reference: ghcr.io/cloudnative-pg/pgvector:0.8.1-18-trixie
|
|
bootstrap:
|
|
initdb:
|
|
database: immich
|
|
owner: app
|
|
encoding: UTF8
|
|
localeCollate: C
|
|
localeCType: C
|
|
enableSuperuserAccess: false
|
|
resources:
|
|
requests: { memory: "512Mi", cpu: "250m" }
|
|
limits: { memory: "2Gi", cpu: "1" }
|
|
storage:
|
|
size: 20Gi
|
|
storageClass: longhorn
|
|
affinity:
|
|
podAntiAffinityType: preferred
|
|
topologyKey: kubernetes.io/hostname
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|