commit 10fb5b325b3feeee3d9dc4a6190f056ae514eb24
parent 0b7fe2f3d2aa63d7972784865720165c90462614
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Sat, 20 Dec 2025 23:04:30 +0100
hopefully set up immich right the first time
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
6 files changed, 150 insertions(+), 0 deletions(-)
diff --git a/apps/talos_cluster/immich/database-credentials.yaml b/apps/talos_cluster/immich/database-credentials.yaml
@@ -0,0 +1,24 @@
+host: pg-cluster-v2-rw.postgres-cluster.svc.cluster.local
+username: immich
+password: ENC[AES256_GCM,data:APqiJvrsqWccCfcCWB/RaOqarRsDA9pr8EiwX82BpIxCA5AbaNvJ7fdDybUoCLvzoCBWas/p7NLwlbmsSGKknQ==,iv:12CuKOXvPX8VaqNULDr7YNSdAkb247A6rK4tGEMIKa8=,tag:eGODqbv/IwHkh1Cnkbh4YA==,type:str]
+dbname: immich
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrTzdBaFpPRUFYdkExaHND
+ S1FsMEtZQlpMT2hPQ1EweWRFcUMzUGQ5ZnhzCmlNRmExU1JabXM1V2Z6UXFhUU5a
+ N0ZMS1ZXOFc3YTlRdTZJWGxkSVFKcDgKLS0tIEtGSGtYOVh4aTJRWENmeG1sZFF3
+ WXpsdGNhdDVZY0R5K0dhOVNDR1cwdDQKVkGzLfzw31VxPKJLkI0qUoH+I9Rb2pPU
+ A3R2o+9PGdfBUs7M2c6sepooDOrBcgAn4qDHA5LRGougIGnaO/0+dw==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-12-20T20:28:32Z"
+ mac: ENC[AES256_GCM,data:xiT5EmCue4/Eip/A9fmjNUSjo6RmlPzhLB6aFfc9myBCPYgilEP5UZ4NHX2uU9xvv2KFHIzHPZeD+PaaJK3qAxGAG7kUpFOGm3kU0Ta6UsVaaxU8jpc3+1a6QJX9ysHAG6XBq+TR74LlenZn488jPyK0leAK1xAzpmjuRg5UsMY=,iv:+SWaGJNmHeSu5aBKbPY/0OFEE78KeIbq8iIV96bs7JE=,tag:G7PUHfoC9FbZEUSU0cZ7GA==,type:str]
+ pgp: []
+ encrypted_regex: ^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/immich/kustomization.yaml b/apps/talos_cluster/immich/kustomization.yaml
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: immich
+resources:
+ - repository.yaml
+ - release.yaml
+ - route.yaml
+secretGenerator:
+ - name: immich-database
+ files:
+ - database-credentials.yaml
diff --git a/apps/talos_cluster/immich/release.yaml b/apps/talos_cluster/immich/release.yaml
@@ -0,0 +1,69 @@
+---
+# PVC for immich
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+ name: immmich-pvc
+ namespace: immich
+spec:
+ accessModes:
+ - ReadWriteMany
+ resources:
+ requests:
+ storage: 10Gi
+ storageClassName: longhorn
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+ name: immich
+ namespace: immich
+spec:
+ releaseName: immich
+ chartRef:
+ kind: OCIRepository
+ name: immich
+ namespace: immich
+ interval: 60m
+ values:
+ server:
+ controllers:
+ main:
+ containers:
+ main:
+ env:
+ DB_HOSTNAME:
+ valueFrom:
+ secretKeyRef:
+ name: immich-database
+ key: host
+ DB_USERNAME:
+ valueFrom:
+ secretKeyRef:
+ name: immich-database
+ key: username
+ DB_PASSWORD:
+ valueFrom:
+ secretKeyRef:
+ name: immich-database
+ key: password
+ DB_DATABASE_NAME:
+ valueFrom:
+ secretKeyRef:
+ name: immich-database
+ key: dbname
+ immich:
+ persistence:
+ library:
+ existingClaim: immmich-pvc
+ configuration: {}
+ configurationKind: ConfigMap
+ valkey:
+ enabled: false
+ persistence:
+ data:
+ enabled: true
+ size: 1Gi
+ type: emptyDir
+ accessMode: ReadWriteOnce
+ storageClass: longhorn
diff --git a/apps/talos_cluster/immich/repository.yaml b/apps/talos_cluster/immich/repository.yaml
@@ -0,0 +1,13 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+ name: immich
+ namespace: immich
+spec:
+ interval: 60m
+ url: oci://ghcr.io/immich-app/immich-charts/immich
+ layerSelector:
+ mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
+ operation: copy
+ ref:
+ semver: "^0.10.3"
diff --git a/apps/talos_cluster/immich/route.yaml b/apps/talos_cluster/immich/route.yaml
@@ -0,0 +1,32 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ name: immich
+ namespace: immich
+spec:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - immich.mtrnord.blog
+ rules:
+ - backendRefs:
+ - name: immich-main
+ port: 2283
+ timeouts:
+ request: 240s
+ backendRequest: 0s
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+ name: immich-compression
+ namespace: immich
+spec:
+ targetRef:
+ group: gateway.networking.k8s.io
+ kind: HTTPRoute
+ name: immich
+ compression:
+ - type: Gzip
+ - type: Brotli
diff --git a/apps/talos_cluster/kustomization.yaml b/apps/talos_cluster/kustomization.yaml
@@ -29,3 +29,4 @@ resources:
#- ./concourse
- ./weblate
#- ./sentry
+ - ./immich
