feat(immich): Move to separate k8s namespace

README.md

@@ -65,6 +65,7 @@ Currently, the applications being deployed like this are:
 - `paperless-ngx`
 - `syncthing`
 - `pihole`
+- `immich`
 
 ## Known bugs
 

flake-parts/kubenix.nix

@@ -90,4 +90,6 @@
       "${self}/kubenix-modules/syncthing.nix" "syncthing" "syncthing";
     kubenix.pihole = mkDeployScriptAndManifest
       "${self}/kubenix-modules/pihole.nix" "pihole" "pihole";
+    kubenix.immich = mkDeployScriptAndManifest
+      "${self}/kubenix-modules/immich.nix" "immich" "immich";
   })

kubenix-modules/all.nix

@@ -5,7 +5,6 @@ let
     ./bind9
     ./dnsmasq.nix
     ./attic.nix
-    ./immich.nix
     # ./argo.nix
     # ./minecraft.nix
   ];

kubenix-modules/base.nix

@@ -73,6 +73,7 @@
           paperless = { };
           syncthing = { };
           pihole = { };
+          immich = { };
         };
 
         nodes =

kubenix-modules/immich.nix

@@ -1,188 +1,162 @@
 {
   kubernetes.resources = {
     deployments = {
-      immich-server = {
+      immich.spec = {
-        metadata.labels = {
+        selector.matchLabels = {
           app = "immich";
           component = "server";
         };
 
-        spec = {
+        strategy = {
-          selector.matchLabels = {
+          type = "RollingUpdate";
+
+          rollingUpdate = {
+            maxSurge = 0;
+            maxUnavailable = 1;
+          };
+        };
+
+        template = {
+          metadata.labels = {
             app = "immich";
             component = "server";
           };
 
-          strategy = {
+          spec = {
-            type = "RollingUpdate";
+            volumes.data.persistentVolumeClaim.claimName = "data";
 
-            rollingUpdate = {
+            enableServiceLinks = false;
-              maxSurge = 0;
-              maxUnavailable = 1;
-            };
-          };
 
-          template = {
+            containers.immich = {
-            metadata.labels = {
+              image = "ghcr.io/immich-app/immich-server:v1.108.0";
-              app = "immich";
+              imagePullPolicy = "Always";
-              component = "server";
+              ports.web.containerPort = 3001;
-            };
 
-            spec = {
+              env = {
-              volumes.data.persistentVolumeClaim.claimName = "immich";
+                TZ.value = "Europe/Amsterdam";
-
+                REDIS_HOSTNAME.value = "redis.immich.svc.cluster.local";
-              containers.immich = {
+                DB_HOSTNAME.value = "postgres.immich.svc.cluster.local";
-                image = "ghcr.io/immich-app/immich-server:v1.108.0";
+                DB_USERNAME.value = "postgres";
-                imagePullPolicy = "Always";
+                DB_PASSWORD.value = "ref+sops://secrets/kubernetes.yaml#/immich/databasePassword";
-                ports.web.containerPort = 3001;
+                DB_DATABASE_NAME.value = "immich";
-
+                IMMICH_MACHINE_LEARNING_URL.value = "http://ml.immich.svc.cluster.local";
-                env = {
-                  TZ.value = "Europe/Amsterdam";
-                  REDIS_HOSTNAME.value = "immich-redis.default.svc.cluster.local";
-                  DB_HOSTNAME.value = "immich-postgres.default.svc.cluster.local";
-                  DB_USERNAME.value = "postgres";
-                  DB_PASSWORD.value = "ref+sops://secrets/kubernetes.yaml#/immich/databasePassword";
-                  DB_DATABASE_NAME.value = "immich";
-                  IMMICH_MACHINE_LEARNING_URL.value = "http://immich-ml.default.svc.cluster.local";
-                };
-
-                volumeMounts = [{
-                  name = "data";
-                  mountPath = "/usr/src/app/upload";
-                }];
               };
+
+              volumeMounts = [{
+                name = "data";
+                mountPath = "/usr/src/app/upload";
+              }];
             };
           };
         };
       };
 
-      immich-ml = {
+      ml.spec = {
-        metadata.labels = {
+        selector.matchLabels = {
           app = "immich";
           component = "machine-learning";
         };
 
-        spec = {
+        template = {
-          selector.matchLabels = {
+          metadata.labels = {
             app = "immich";
             component = "machine-learning";
           };
 
-          template = {
+          spec = {
-            metadata.labels = {
+            volumes.cache.persistentVolumeClaim.claimName = "cache";
-              app = "immich";
-              component = "machine-learning";
-            };
 
-            spec = {
+            containers.machine-learning = {
-              volumes.cache.persistentVolumeClaim.claimName = "immich-cache";
+              image = "ghcr.io/immich-app/immich-machine-learning:v1.108.0";
+              imagePullPolicy = "Always";
+              ports.ml.containerPort = 3003;
+              env.MACHINE_LEARNING_WORKER_TIMEOUT.value = "600";
 
-              containers.machine-learning = {
+              volumeMounts = [{
-                image = "ghcr.io/immich-app/immich-machine-learning:v1.108.0";
+                name = "cache";
-                imagePullPolicy = "Always";
+                mountPath = "/cache";
-                ports.ml.containerPort = 3003;
+              }];
-                env.MACHINE_LEARNING_WORKER_TIMEOUT.value = "600";
-
-                volumeMounts = [{
-                  name = "cache";
-                  mountPath = "/cache";
-                }];
-              };
             };
           };
         };
       };
 
-      immich-redis = {
+      redis.spec = {
-        metadata.labels = {
+        selector.matchLabels = {
           app = "immich";
           component = "redis";
         };
 
-        spec = {
+        strategy = {
-          selector.matchLabels = {
+          type = "RollingUpdate";
+
+          rollingUpdate = {
+            maxSurge = 0;
+            maxUnavailable = 1;
+          };
+        };
+
+        template = {
+          metadata.labels = {
             app = "immich";
             component = "redis";
           };
 
-          strategy = {
+          spec = {
-            type = "RollingUpdate";
+            containers.redis = {
-
+              image = "docker.io/redis:6.2-alpine@sha256:d6c2911ac51b289db208767581a5d154544f2b2fe4914ea5056443f62dc6e900";
-            rollingUpdate = {
+              ports.redis.containerPort = 6379;
-              maxSurge = 0;
+              imagePullPolicy = "Always";
-              maxUnavailable = 1;
-            };
-          };
-
-          template = {
-            metadata.labels = {
-              app = "immich";
-              component = "redis";
-            };
-
-            spec = {
-              containers.redis = {
-                image = "docker.io/redis:6.2-alpine@sha256:d6c2911ac51b289db208767581a5d154544f2b2fe4914ea5056443f62dc6e900";
-                ports.redis.containerPort = 6379;
-                imagePullPolicy = "Always";
-              };
             };
           };
         };
       };
 
-      immich-database = {
+      database.spec = {
-        metadata.labels = {
+        selector.matchLabels = {
           app = "immich";
           component = "database";
         };
 
-        spec = {
+        strategy = {
-          selector.matchLabels = {
+          type = "RollingUpdate";
+
+          rollingUpdate = {
+            maxSurge = 0;
+            maxUnavailable = 1;
+          };
+        };
+
+        template = {
+          metadata.labels = {
             app = "immich";
             component = "database";
           };
 
-          strategy = {
+          spec = {
-            type = "RollingUpdate";
+            volumes.data.persistentVolumeClaim.claimName = "database";
 
-            rollingUpdate = {
+            containers.postgres = {
-              maxSurge = 0;
+              image = "docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0";
-              maxUnavailable = 1;
+              imagePullPolicy = "Always";
-            };
+              command = [ "postgres" ];
-          };
+              args = [ "-c" "shared_preload_libraries=vectors.so" "-c" "search_path=\"$$user\", public, vectors" "-c" "logging_collector=on" "-c" "max_wal_size=2GB" "-c" "shared_buffers=512MB" "-c" "wal_compression=on" ];
+              ports.postgres.containerPort = 5432;
+              securityContext.runAsUser = 999;
+              securityContext.runAsGroup = 999;
 
-          template = {
+              env = {
-            metadata.labels = {
+                POSTGRES_PASSWORD.value = "ref+sops://secrets/kubernetes.yaml#/immich/databasePassword";
-              app = "immich";
+                POSTGRES_USER.value = "postgres";
-              component = "database";
+                POSTGRES_DB.value = "immich";
-            };
+                POSTGRES_INITDB_ARGS.value = "--data-checksums";
-
+                PGDATA.value = "/pgdata/data";
-            spec = {
-              volumes.data.persistentVolumeClaim.claimName = "immich-db";
-
-              containers.postgres = {
-                image = "docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0";
-                imagePullPolicy = "Always";
-                command = [ "postgres" ];
-                args = [ "-c" "shared_preload_libraries=vectors.so" "-c" "search_path=\"$$user\", public, vectors" "-c" "logging_collector=on" "-c" "max_wal_size=2GB" "-c" "shared_buffers=512MB" "-c" "wal_compression=on" ];
-                ports.postgres.containerPort = 5432;
-                securityContext.runAsUser = 999;
-                securityContext.runAsGroup = 999;
-
-                env = {
-                  POSTGRES_PASSWORD.value = "ref+sops://secrets/kubernetes.yaml#/immich/databasePassword";
-                  POSTGRES_USER.value = "postgres";
-                  POSTGRES_DB.value = "immich";
-                  POSTGRES_INITDB_ARGS.value = "--data-checksums";
-                  PGDATA.value = "/pgdata/data";
-                };
-
-                volumeMounts = [{
-                  name = "data";
-                  mountPath = "/pgdata";
-                }];
               };
+
+              volumeMounts = [{
+                name = "data";
+                mountPath = "/pgdata";
+              }];
             };
           };
         };
@@ -190,7 +164,7 @@
     };
 
     services = {
-      immich-server.spec = {
+      server.spec = {
         selector = {
           app = "immich";
           component = "server";
@@ -202,7 +176,7 @@
         };
       };
 
-      immich-redis.spec = {
+      redis.spec = {
         selector = {
           app = "immich";
           component = "redis";
@@ -214,7 +188,7 @@
         };
       };
 
-      immich-ml.spec = {
+      ml.spec = {
         selector = {
           app = "immich";
           component = "machine-learning";
@@ -226,7 +200,7 @@
         };
       };
 
-      immich-postgres.spec = {
+      postgres.spec = {
         selector = {
           app = "immich";
           component = "database";
@@ -239,18 +213,32 @@
       };
     };
 
-    persistentVolumeClaims.immich-cache.spec = {
+    persistentVolumeClaims.cache.spec = {
       accessModes = [ "ReadWriteOnce" ];
       resources.requests.storage = "5Gi";
     };
   };
 
-  lab.ingresses.immich-test = {
+  lab = {
-    host = "immich.kun.is";
+    ingresses.immich = {
+      host = "immich.kun.is";
 
-    service = {
+      service = {
-      name = "immich-server";
+        name = "server";
-      portName = "web";
+        portName = "web";
+      };
+    };
+
+    longhorn.persistentVolumeClaim = {
+      data = {
+        volumeName = "immich";
+        storage = "50Gi";
+      };
+
+      database = {
+        volumeName = "immich-db";
+        storage = "5Gi";
+      };
     };
   };
 }

kubenix-modules/volumes.nix

@@ -34,8 +34,6 @@
       bazarr.storage = "25Mi";
       attic.storage = "15Gi";
       attic-db.storage = "150Mi";
-      immich.storage = "50Gi";
-      immich-db.storage = "5Gi";
     };
 
     longhorn.persistentVolume = {
@@ -55,6 +53,8 @@
       syncthing.storage = "400Mi";
       pihole-data.storage = "750Mi";
       pihole-dnsmasq.storage = "16Mi";
+      immich.storage = "50Gi";
+      immich-db.storage = "5Gi";
     };
 
     nfsVolumes = {