k8scd/immich/helm-immich.yaml

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: helm-immich
  namespace: argocd
  finalizers:
  - resources-finalizer.argocd.argoproj.io
spec:
  syncPolicy:
    syncOptions:
      - CreateNamespace=true
    automated:
      prune: true
      selfHeal: true
  project: default
  sources:
    - chart: immich
      # No scheme, so Argo CD pulls the chart from the OCI registry. Charts
      # after 0.12.0 are only published there.
      repoURL: ghcr.io/immich-app/immich-charts
      targetRevision: 0.13.4
      helm:
        values: |
          controllers:
            main:
              containers:
                main:
                  image:
                    tag: v3.3.5
                  env:
                    REDIS_HOSTNAME: '{{ printf "%s-valkey" .Release.Name }}'
                    IMMICH_MACHINE_LEARNING_URL: '{{ printf "http://%s-machine-learning:3003" .Release.Name }}'
                    # External PostgreSQL (CloudNativePG)
                    DB_HOSTNAME: "immich-postgres-17-rw"
                    DB_USERNAME: "immich"
                    DB_DATABASE_NAME: "immich"
                    DB_PASSWORD:
                      valueFrom:
                        secretKeyRef:
                          name: immich-postgres-17-app
                          key: password
            
          immich:
            metrics:
              # Enabling this will create the service monitors needed to monitor immich with the prometheus operator
              enabled: false
            persistence:
              # Main data store for all photos shared between different components.
              library:
                # Automatically creating the library volume is not supported by this chart
                # You have to specify an existing PVC to use
                existingClaim: immich-claim
            # The config file is a Secret rendered by ESO, since it holds the
            # OAuth client secret (immich/immich-config.yaml).
            configurationKind: Secret
            existingConfiguration: immich-config

          # Dependencies

          valkey:
            enabled: true
            controllers:
              main:
                containers:
                  main:
                    resources:
                      requests:
                        cpu: 10m
                        memory: 64Mi
                      limits:
                        memory: 256Mi
                    image:
                      repository: docker.io/valkey/valkey
                      tag: 9.1.2-alpine@sha256:48332870af354a799964c0012ae1194a0bf2bf894eb508f945810596dc2d8d11
                      pullPolicy: IfNotPresent
            persistence:
              data:
                enabled: true
                # Optional: to keep job queues persistent, use a
                # persistentVolumeClaim with size, accessMode and storageClass
                type: emptyDir

          # Immich components

          server:
            enabled: true
            controllers:
              main:
                containers:
                  main:
                    image:
                      repository: ghcr.io/immich-app/immich-server
                      pullPolicy: IfNotPresent
                    resources:
                      requests:
                        cpu: 100m
                        memory: 1280Mi
                      limits:
                        memory: 3Gi
                    # Node trusts its built-in roots, which still include the
                    # ones above the compromised eMudhra intermediates. Use
                    # patched-ca-bundle through OpenSSL until Node ships a fix.
                    env:
                      NODE_OPTIONS: --use-openssl-ca
                      SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
            persistence:
              patched-ca-bundle:
                enabled: true
                type: configMap
                name: patched-ca-bundle
                globalMounts:
                  - path: /etc/ssl/certs
                    readOnly: true

          machine-learning:
            enabled: true
            controllers:
              main:
                containers:
                  main:
                    image:
                      repository: ghcr.io/immich-app/immich-machine-learning
                      pullPolicy: IfNotPresent
                    # Idle at 240Mi; 884Mi with CLIP, face recognition and
                    # OCR loaded (2026-10-28, a test image through each).
                    resources:
                      requests:
                        cpu: 50m
                        memory: 1Gi
                      limits:
                        memory: 2Gi
                    env:
                      TRANSFORMERS_CACHE: /cache
                      HF_XET_CACHE: /cache/huggingface-xet
                      MPLCONFIGDIR: /cache/matplotlib-config
                      # The optimized models of v3.3.0: faster, less memory,
                      # and the same results, so no jobs to run again.
                      MACHINE_LEARNING_MODEL_REVISION: v2
                      # Trust store without the compromised eMudhra
                      # intermediates; requests would otherwise use certifi.
                      SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
                      REQUESTS_CA_BUNDLE: /etc/ssl/certs/ca-certificates.crt
            persistence:
              patched-ca-bundle:
                enabled: true
                type: configMap
                name: patched-ca-bundle
                globalMounts:
                  - path: /etc/ssl/certs
                    readOnly: true
              # The models and their one-off preparation, kept across restarts.
              # Downloaded again if lost, so no backups: the no-backup group
              # keeps it out of Longhorn's default one (backup-daily), and
              # Velero skips that label too (velero/skip-emptydir-policy.yaml).
              cache:
                enabled: true
                type: persistentVolumeClaim
                storageClass: longhorn
                accessMode: ReadWriteOnce
                size: 10Gi
                labels:
                  recurring-job.longhorn.io/source: enabled
                  recurring-job-group.longhorn.io/no-backup: enabled

  destination:
    server: https://kubernetes.default.svc
    namespace: immich