immich: share the group account's people with everyone

chore(deps): update helm chart mariadb-operator to v26

.github/workflows/validate.yaml

@@ -18,7 +18,7 @@ concurrency:
 
 jobs:
   validate:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

actual-budget/helm-actual-budget.yaml

@@ -12,7 +12,7 @@ spec:
   project: default
   source:
     repoURL: https://community-charts.github.io/helm-charts
-    targetRevision: 1.8.9
+    targetRevision: 1.9.5
     chart: actualbudget
     helm:
       values: |

apps/templates/envoy-gateway-helm.yaml

@@ -12,7 +12,7 @@ spec:
     repoURL: docker.io/envoyproxy
     chart: gateway-helm
     # v1.9 supports Kubernetes 1.33 to 1.36
-    targetRevision: v1.9.2
+    targetRevision: 1.9.3
     helm:
       values: |
         config:

authentik/postgresql-cluster.yaml

@@ -6,7 +6,7 @@ spec:
   instances: 1
   # Pinned so a new operator default (PostgreSQL 18 since CNPG 1.26.3) can't
   # start an in-place major upgrade. CNPG filled this in at creation.
-  imageName: ghcr.io/cloudnative-pg/postgresql:17.4
+  imageName: ghcr.io/cloudnative-pg/postgresql:17.11
   primaryUpdateStrategy: unsupervised
   # WAL archiving and base backups to Garage, see postgresql-backup.yaml
   plugins:

dns/cronjob.yaml

@@ -13,7 +13,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: sync
-          image: python:3.12-alpine
+          image: python:3.15-alpine
           command:
             - sh
             - -c

docs/immich-scouts-online.md

@@ -27,7 +27,9 @@ view, and everything is shared with everyone automatically.
 - **immich has no user groups**; albums are shared per user, as viewer or
   editor. The owner and editors of an album may add users and change
   their roles. Search only covers your own photos and those of partners
-  you show in your timeline.
+  you show in your timeline. People (face recognition) are per user too,
+  and a partner's library doesn't bring its people along; since 3.3 a
+  user can share people with the users in their cluster group.
 
 ## Design
 
@@ -46,7 +48,10 @@ view, and everything is shared with everyone automatically.
   every user into every album of the group account (`fotoupload@`), as
   editor or viewer by quota; the group account's library as a partner of
   everyone, shown in the timeline; album invitations for albums older than
-  a week hidden; sessions of OAuth users older than 30 days ended. Albums
+  a week hidden; sessions of OAuth users older than 30 days ended;
+  everyone in the group account's cluster group with its people shared
+  (names editable by those who may upload, added 2026-10-28, when nobody
+  but the group account could search by face). Albums
   that kaderleden create get the group account as editor first (in the
   database, since the API only lets an album's owner or editors share
   it), so they go to everyone too; names starting with "Privé"/"Prive"

freshrss/freshrss-deployment.yaml

@@ -23,7 +23,7 @@ spec:
         io.kompose.service: freshrss
     spec:
       initContainers:
-        - image: alpine/git:v2.52.0
+        - image: alpine/git:v2.54.0
           name: git
           command:
           - git
@@ -74,7 +74,7 @@ spec:
               value: Europe/Amsterdam
           # 1.30.3 ships PHP 8.4.27, which fixes CVE-2026-109618 and
           # CVE-2026-109619.
-          image: freshrss/freshrss:1.30.3
+          image: freshrss/freshrss:1.30.4
           name: freshrss
           ports:
             - containerPort: 80

immich/share-sync.yaml

@@ -8,6 +8,10 @@
 # - the group account's library is shared as a partner and shown in
 #   everyone's timeline, so search covers it (immich only searches your own
 #   and your timeline partners' photos);
+# - everyone is put in the group account's cluster group and gets its
+#   people (person sharing, immich 3.3): people are per user, and a partner
+#   library doesn't bring its people along. Those who may upload can name
+#   them, for everyone;
 # - the invitation notifications for albums older than a week are hidden,
 #   or a new member would get one per album;
 # - sessions of OAuth users older than SESSION_MAX_AGE_DAYS are ended, so
@@ -15,8 +19,11 @@
 #   Online.
 # Albums and partners go through the API. Joining other people's albums
 # (the API only lets an album's owner or editors share it), the timeline
-# flag (which only the receiving user can set), the notifications and the
-# sessions go straight to the database.
+# flag and the cluster group (which only the receiving user can set or
+# accept), sharing the people (the API wants person.update, which the
+# group's key lacks, and with password login off nobody can log in as the
+# group to add it), the notifications and the sessions go straight to the
+# database.
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -24,6 +31,7 @@ metadata:
   namespace: immich
 data:
   sync.py: |
+    import collections
     import json
     import os
     import subprocess
@@ -129,6 +137,62 @@ data:
         'UPDATE partner SET "inTimeline" = true WHERE "sharedById" = :\'group\' AND NOT "inTimeline"',
         group=group_id,
     )
+    # What accepting an invitation to the group account's cluster group does
+    # (ClusterGroupService.acceptRequest): the person groups only the member
+    # has people in move along. Members with people in groups that others
+    # also have people in are left alone; that only happens after sharing.
+    for (email,) in sql(
+        """
+        BEGIN;
+        CREATE TEMP TABLE moving ON COMMIT DROP AS
+        SELECT u.id FROM "user" u, "user" g
+        WHERE g.id = :'group' AND u.id = ANY (:'members'::uuid[])
+          AND u."clusterGroupId" <> g."clusterGroupId"
+          AND NOT EXISTS (
+            SELECT 1 FROM person p
+            JOIN person o ON o."personGroupId" = p."personGroupId" AND o."ownerId" <> p."ownerId"
+            WHERE p."ownerId" = u.id
+          );
+        UPDATE person_group SET "clusterGroupId" = (SELECT "clusterGroupId" FROM "user" WHERE id = :'group')
+        WHERE id IN (SELECT p."personGroupId" FROM person p JOIN moving m ON m.id = p."ownerId");
+        DELETE FROM cluster_group_request
+        WHERE "userId" IN (SELECT id FROM moving)
+          AND "clusterGroupId" = (SELECT "clusterGroupId" FROM "user" WHERE id = :'group');
+        UPDATE "user" SET "clusterGroupId" = (SELECT "clusterGroupId" FROM "user" WHERE id = :'group')
+        WHERE id IN (SELECT id FROM moving)
+        RETURNING email;
+        COMMIT;
+        """,
+        group=group_id,
+        members="{" + ",".join(members) + "}",
+    ):
+        print(f"put {email} in the group's cluster group", flush=True)
+    # What PUT /people/users does for the group account: its people, with
+    # their names, in every member's people list and search filters. Write
+    # access (naming people, for everyone) for those who may upload.
+    shared = sql(
+        """
+        INSERT INTO person_user ("personGroupId", "sharedById", "sharedWithId", role)
+        SELECT p."personGroupId", p."ownerId", m.id, m.role::person_user_role_enum
+        FROM person p
+        JOIN "user" g ON g.id = p."ownerId"
+        CROSS JOIN unnest(:'ids'::uuid[], :'roles'::text[]) AS m(id, role)
+        JOIN "user" u ON u.id = m.id AND u."clusterGroupId" = g."clusterGroupId"
+        WHERE p."ownerId" = :'group' AND NOT p."isHidden"
+          AND NOT EXISTS (
+            SELECT 1 FROM person_user pu
+            WHERE pu."personGroupId" = p."personGroupId" AND pu."sharedById" = p."ownerId"
+              AND pu."sharedWithId" = m.id AND pu.role = m.role::person_user_role_enum
+          )
+        ON CONFLICT ("personGroupId", "sharedById", "sharedWithId") DO UPDATE SET role = EXCLUDED.role
+        RETURNING "sharedWithId", role
+        """,
+        group=group_id,
+        ids="{" + ",".join(wanted) + "}",
+        roles="{" + ",".join("read" if role == "viewer" else "write" for role in wanted.values()) + "}",
+    )
+    for (uid, role), count in sorted(collections.Counter(map(tuple, shared)).items()):
+        print(f"share {count} people with {members[uid]} ({role})", flush=True)
     sql(
         """
         UPDATE notification SET "deletedAt" = now()

mariadb-operator/operator-crds-helm.yaml

@@ -13,7 +13,7 @@ spec:
   source:
     chart: mariadb-operator-crds
     repoURL: https://mariadb-operator.github.io/mariadb-operator
-    targetRevision: 25.10.4
+    targetRevision: 26.10.2
   syncPolicy:
     automated:
       prune: true

mariadb-operator/operator-helm.yaml

@@ -13,7 +13,7 @@ spec:
   source:
     chart: mariadb-operator
     repoURL: https://mariadb-operator.github.io/mariadb-operator
-    targetRevision: 25.10.4
+    targetRevision: 26.10.2
     helm:
       values: |
         resources: