homelab/k8s/apps/immich/kustomization.yaml at f5e100ee32a122229910171240b7ceea0e88acd6 - homelab - Gitea: Git with a cup of tea

rock/homelab

Files

T

Story Crater Bot 61a1975669 feat: deploy Immich with Authentik OIDC, rock as admin

Self-hosted photo backup (Google Photos replacement) - raw manifests,
no Helm chart, self-contained under k8s/apps/immich including its own
CNPG Postgres. Media PVC shares the cp-3 HDD 2TB/2TB with
paperless-media.

Postgres is pg18, not this repo's usual 16.2: CNPG's official pgvector
extension image (ghcr.io/cloudnative-pg/pgvector) is only published
for pg18, loaded via CNPG's ImageVolume extension mechanism (operator
1.30.0 / k8s 1.36.1 both support it). Immich auto-manages CREATE
EXTENSION itself at startup.

OIDC via a new "immich_role" Authentik scope mapping (homelab-admins/
immich-admins -> "admin" claim, else "user"), consumed by Immich's
OAuth roleClaim setting which re-syncs isAdmin on every login - more
reliable than Immich's racy first-user-is-admin fallback. Config
composed into an immich-oidc Secret and mounted as IMMICH_CONFIG_FILE,
matching the paperless-oidc pattern. k8s RBAC (immich-operator Role +
oidc:immich-admins binding) mirrors paperless/rbac.yaml.

immich namespace pre-created in k8s/infra/databases/namespaces.yaml
(not just immich's own CreateNamespace=true) since the iam PostSync
job's RoleBinding needs it to exist before wave 8.

2026-08-25 18:21:28 -07:00

15 lines

349 B

YAML

Raw Blame History

 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: immich
 resources:
   - db.yaml
   - pvc.yaml
   - configmap.yaml
   - redis.yaml
   - deployment.yaml
   - service.yaml
   - ingress.yaml
   - rbac.yaml
 # immich-oidc Secret written by the PostSync provisioning Job in
 # k8s/infra/iam (same as paperless-oidc) - not duplicated here.