Story Crater Bot
61a1975669
Self-hosted photo backup (Google Photos replacement) - raw manifests, no Helm chart, self-contained under k8s/apps/immich including its own CNPG Postgres. Media PVC shares the cp-3 HDD 2TB/2TB with paperless-media. Postgres is pg18, not this repo's usual 16.2: CNPG's official pgvector extension image (ghcr.io/cloudnative-pg/pgvector) is only published for pg18, loaded via CNPG's ImageVolume extension mechanism (operator 1.30.0 / k8s 1.36.1 both support it). Immich auto-manages CREATE EXTENSION itself at startup. OIDC via a new "immich_role" Authentik scope mapping (homelab-admins/ immich-admins -> "admin" claim, else "user"), consumed by Immich's OAuth roleClaim setting which re-syncs isAdmin on every login - more reliable than Immich's racy first-user-is-admin fallback. Config composed into an immich-oidc Secret and mounted as IMMICH_CONFIG_FILE, matching the paperless-oidc pattern. k8s RBAC (immich-operator Role + oidc:immich-admins binding) mirrors paperless/rbac.yaml. immich namespace pre-created in k8s/infra/databases/namespaces.yaml (not just immich's own CreateNamespace=true) since the iam PostSync job's RoleBinding needs it to exist before wave 8.
35 lines
1.0 KiB
YAML
35 lines
1.0 KiB
YAML
# Two volumes:
|
|
#
|
|
# - media: original photos/videos + generated thumbnails/encoded videos.
|
|
# Shares the cp-3 USB HDD with paperless-media - the 4TB disk is split
|
|
# 2TB/2TB between the two (see k8s/apps/paperless/pvc.yaml), same
|
|
# StorageClass/disk tag, single replica (single disk, no redundancy
|
|
# possible - same tradeoff paperless already accepts).
|
|
# - ml-cache: downloaded ML model weights for immich-machine-learning
|
|
# (face detection / CLIP embeddings). Small, disposable (re-downloads on
|
|
# loss), but persisted so a pod restart doesn't re-pull multi-GB models -
|
|
# default 3-replica pool, not node-pinned.
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: immich-media
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
storageClassName: longhorn-paperless-media
|
|
resources:
|
|
requests:
|
|
storage: 2000Gi
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: immich-ml-cache
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
storageClassName: longhorn
|
|
resources:
|
|
requests:
|
|
storage: 5Gi
|