Story Crater Bot
61a1975669
Self-hosted photo backup (Google Photos replacement) - raw manifests, no Helm chart, self-contained under k8s/apps/immich including its own CNPG Postgres. Media PVC shares the cp-3 HDD 2TB/2TB with paperless-media. Postgres is pg18, not this repo's usual 16.2: CNPG's official pgvector extension image (ghcr.io/cloudnative-pg/pgvector) is only published for pg18, loaded via CNPG's ImageVolume extension mechanism (operator 1.30.0 / k8s 1.36.1 both support it). Immich auto-manages CREATE EXTENSION itself at startup. OIDC via a new "immich_role" Authentik scope mapping (homelab-admins/ immich-admins -> "admin" claim, else "user"), consumed by Immich's OAuth roleClaim setting which re-syncs isAdmin on every login - more reliable than Immich's racy first-user-is-admin fallback. Config composed into an immich-oidc Secret and mounted as IMMICH_CONFIG_FILE, matching the paperless-oidc pattern. k8s RBAC (immich-operator Role + oidc:immich-admins binding) mirrors paperless/rbac.yaml. immich namespace pre-created in k8s/infra/databases/namespaces.yaml (not just immich's own CreateNamespace=true) since the iam PostSync job's RoleBinding needs it to exist before wave 8.
36 lines
1.1 KiB
YAML
36 lines
1.1 KiB
YAML
# Scoped operator access for immich-admins: restart/config-edit rights on
|
|
# just this service's own resources, nothing CNPG-managed (immich-db-*) or
|
|
# provisioning-managed (immich-oidc). Same pattern as
|
|
# k8s/apps/paperless/rbac.yaml. Inert until kube-apiserver's OIDC wiring
|
|
# lands (--oidc-groups-claim=groups, --oidc-groups-prefix=oidc:).
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: immich-operator
|
|
rules:
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments"]
|
|
resourceNames: ["immich-server", "immich-machine-learning"]
|
|
verbs: ["get", "list", "watch", "update", "patch"]
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
resourceNames: ["immich-config"]
|
|
verbs: ["get", "list", "watch", "update", "patch"]
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
resourceNames: ["immich-oidc"]
|
|
verbs: ["get", "list", "watch", "update", "patch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: immich-admins-binding
|
|
subjects:
|
|
- kind: Group
|
|
name: "oidc:immich-admins"
|
|
apiGroup: rbac.authorization.k8s.io
|
|
roleRef:
|
|
kind: Role
|
|
name: immich-operator
|
|
apiGroup: rbac.authorization.k8s.io
|