mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
399387bfb7
immich gets its settings from a Secret that ESO renders with the OAuth client secret from Vault. It keeps the settings that were in the database (external domain, login page message, storage template) and adds OAuth through authentik next to the password login, with auto register. With a config file the settings are read-only in the admin UI.
137 lines
5.0 KiB
YAML
137 lines
5.0 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: helm-immich
|
|
namespace: argocd
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
syncPolicy:
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
project: default
|
|
sources:
|
|
- chart: immich
|
|
# No scheme, so Argo CD pulls the chart from the OCI registry. Charts
|
|
# after 0.12.0 are only published there.
|
|
repoURL: ghcr.io/immich-app/immich-charts
|
|
targetRevision: 0.13.4
|
|
helm:
|
|
values: |
|
|
controllers:
|
|
main:
|
|
containers:
|
|
main:
|
|
image:
|
|
tag: v3.3.5
|
|
env:
|
|
REDIS_HOSTNAME: '{{ printf "%s-valkey" .Release.Name }}'
|
|
IMMICH_MACHINE_LEARNING_URL: '{{ printf "http://%s-machine-learning:3003" .Release.Name }}'
|
|
# External PostgreSQL (CloudNativePG)
|
|
DB_HOSTNAME: "immich-postgres-17-rw"
|
|
DB_USERNAME: "immich"
|
|
DB_DATABASE_NAME: "immich"
|
|
DB_PASSWORD:
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: immich-postgres-17-app
|
|
key: password
|
|
|
|
immich:
|
|
metrics:
|
|
# Enabling this will create the service monitors needed to monitor immich with the prometheus operator
|
|
enabled: false
|
|
persistence:
|
|
# Main data store for all photos shared between different components.
|
|
library:
|
|
# Automatically creating the library volume is not supported by this chart
|
|
# You have to specify an existing PVC to use
|
|
existingClaim: immich-claim
|
|
# The config file is a Secret rendered by ESO, since it holds the
|
|
# OAuth client secret (immich/immich-config.yaml).
|
|
configurationKind: Secret
|
|
existingConfiguration: immich-config
|
|
|
|
# Dependencies
|
|
|
|
valkey:
|
|
enabled: true
|
|
controllers:
|
|
main:
|
|
containers:
|
|
main:
|
|
image:
|
|
repository: docker.io/valkey/valkey
|
|
tag: 9.1.2-alpine@sha256:48332870af354a799964c0012ae1194a0bf2bf894eb508f945810596dc2d8d11
|
|
pullPolicy: IfNotPresent
|
|
persistence:
|
|
data:
|
|
enabled: true
|
|
# Optional: to keep job queues persistent, use a
|
|
# persistentVolumeClaim with size, accessMode and storageClass
|
|
type: emptyDir
|
|
|
|
# Immich components
|
|
|
|
server:
|
|
enabled: true
|
|
controllers:
|
|
main:
|
|
containers:
|
|
main:
|
|
image:
|
|
repository: ghcr.io/immich-app/immich-server
|
|
pullPolicy: IfNotPresent
|
|
# Node trusts its built-in roots, which still include the
|
|
# ones above the compromised eMudhra intermediates. Use
|
|
# patched-ca-bundle through OpenSSL until Node ships a fix.
|
|
env:
|
|
NODE_OPTIONS: --use-openssl-ca
|
|
SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
|
|
persistence:
|
|
patched-ca-bundle:
|
|
enabled: true
|
|
type: configMap
|
|
name: patched-ca-bundle
|
|
globalMounts:
|
|
- path: /etc/ssl/certs
|
|
readOnly: true
|
|
|
|
machine-learning:
|
|
enabled: true
|
|
controllers:
|
|
main:
|
|
containers:
|
|
main:
|
|
image:
|
|
repository: ghcr.io/immich-app/immich-machine-learning
|
|
pullPolicy: IfNotPresent
|
|
env:
|
|
TRANSFORMERS_CACHE: /cache
|
|
HF_XET_CACHE: /cache/huggingface-xet
|
|
MPLCONFIGDIR: /cache/matplotlib-config
|
|
# Trust store without the compromised eMudhra
|
|
# intermediates; requests would otherwise use certifi.
|
|
SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
|
|
REQUESTS_CA_BUNDLE: /etc/ssl/certs/ca-certificates.crt
|
|
persistence:
|
|
patched-ca-bundle:
|
|
enabled: true
|
|
type: configMap
|
|
name: patched-ca-bundle
|
|
globalMounts:
|
|
- path: /etc/ssl/certs
|
|
readOnly: true
|
|
cache:
|
|
enabled: true
|
|
# Optional: to avoid downloading the ML models every start, use
|
|
# a persistentVolumeClaim with size, accessMode and storageClass
|
|
type: emptyDir
|
|
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: immich
|