A lowly tech priest's attempt to please Mars
feat: recreate immich cluster
+107
+34
kubernetes/apps/storage/postgres/clusters/immich/certificate.yaml
+34
kubernetes/apps/storage/postgres/clusters/immich/certificate.yaml
···
1
+
apiVersion: v1
2
+
kind: Secret
3
+
metadata:
4
+
name: immich-cert
5
+
labels:
6
+
cnpg.io/reload: ""
7
+
---
8
+
apiVersion: cert-manager.io/v1
9
+
kind: Certificate
10
+
metadata:
11
+
name: immich-cert
12
+
spec:
13
+
secretName: immich-cert
14
+
usages:
15
+
- server auth
16
+
dnsNames:
17
+
- immich-rw
18
+
- immich-rw.postgres
19
+
- immich-rw.postgres.svc
20
+
- immich-rw.postgres.svc.cluster
21
+
- immich-rw.postgres.svc.cluster.local
22
+
- immich-r
23
+
- immich-r.postgres
24
+
- immich-r.postgres.svc
25
+
- immich-r.postgres.svc.cluster
26
+
- immich-r.postgres.svc.cluster.local
27
+
- immich-ro
28
+
- immich-ro.postgres
29
+
- immich-ro.postgres.svc
30
+
- immich-ro.postgres.svc.cluster
31
+
- immich-ro.postgres.svc.cluster.local
32
+
issuerRef:
33
+
kind: ClusterIssuer
34
+
name: service-cert
+42
kubernetes/apps/storage/postgres/clusters/immich/cluster.yaml
+42
kubernetes/apps/storage/postgres/clusters/immich/cluster.yaml
···
1
+
apiVersion: postgresql.cnpg.io/v1
2
+
kind: Cluster
3
+
metadata:
4
+
name: immich
5
+
spec:
6
+
instances: 2
7
+
8
+
imageCatalogRef:
9
+
apiGroup: postgresql.cnpg.io
10
+
kind: ImageCatalog
11
+
name: postgresql-with-vectors
12
+
major: 18
13
+
14
+
primaryUpdateStrategy: unsupervised
15
+
16
+
postgresql:
17
+
shared_preload_libraries: ["vchord.so"]
18
+
parameters:
19
+
pg_stat_statements.max: "10000"
20
+
pg_stat_statements.track: all
21
+
timezone: ${TIMEZONE}
22
+
23
+
enableSuperuserAccess: true
24
+
superuserSecret:
25
+
name: immich-cluster-superuser
26
+
27
+
storage:
28
+
storageClass: longhorn
29
+
size: 4Gi
30
+
walStorage:
31
+
storageClass: longhorn
32
+
size: 10Gi
33
+
34
+
plugins:
35
+
- name: barman-cloud.cloudnative-pg.io
36
+
isWALArchiver: true
37
+
parameters:
38
+
barmanObjectName: offsite-backup
39
+
40
+
certificates:
41
+
serverTLSSecret: immich-cert
42
+
serverCASecret: immich-cert
+31
kubernetes/apps/storage/postgres/clusters/immich/superuser-secrets.yaml
+31
kubernetes/apps/storage/postgres/clusters/immich/superuser-secrets.yaml
···
1
+
apiVersion: v1
2
+
kind: Secret
3
+
metadata:
4
+
name: immich-cluster-superuser
5
+
stringData:
6
+
username: ENC[AES256_GCM,data:NXioTCgTNZA=,iv:cIz0aeIeQ6jGJKfnkAgDtHfxF7Kg5R+p/qAJGrTtbyU=,tag:oY3UCNgVNxpNbo3T2bR2dA==,type:str]
7
+
password: ENC[AES256_GCM,data:KeaMSvixdbYRaQpFJVhDLM9vIzORZwXmT9KTPLiYNJw=,iv:q9aWs7PJxOMkDw3ax6JDEzY5Wox8YjbRoI20aWCJBSg=,tag:nMTwB4/QmhRwTamiZAvCFg==,type:str]
8
+
sops:
9
+
age:
10
+
- recipient: age13u6nqs8jgp268mya8rht9gyhu86cc53j74f5va65077rsrvkr9gsjeqk88
11
+
enc: |
12
+
-----BEGIN AGE ENCRYPTED FILE-----
13
+
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpb3Z3MXkzU0ZKUVFkOS9O
14
+
cjduMFVJV1lSL09EczR0N2dZb0VxL2ppdGhVCnJmYjBVK2syaW12MmVuWUxkWlBE
15
+
R0xHb3VIRVZuOXAyeEcxRjhaamkvNXMKLS0tIHUzQS9SNmJpUXd3WXBudUZvMHc4
16
+
RklZVXNMelVabGhENlY3UzY4ZU1ObkUKHnGrwru1sp/fsu1Cqi6SeEfkzw7J78Ab
17
+
6RqAj4WL6NPEoRT007Cs8Jmj/lOREeZOQVZcoStdo0SF9LIntc72AQ==
18
+
-----END AGE ENCRYPTED FILE-----
19
+
- recipient: age16tv9zf54wf4txwjx39wz9phw7zggtxe7k0p2lkhtx59u4he72erq4d9xh9
20
+
enc: |
21
+
-----BEGIN AGE ENCRYPTED FILE-----
22
+
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDLzM5VjYvVTE0bzhvQkF0
23
+
Nm1ra0JrOWVFb1ZSbktBUlpLQklzc0xqcG4wCkNDeWNLRzBKU2kxd1g0QkJ2Z25r
24
+
RktUTkl2Q3g2amVCSThNS1JIY0JFUkUKLS0tIE1ucVpkOC9sSEozOXYrZWhmZlpr
25
+
TWdHcjRIczV0OUVLV1krVGo3SmxBZDQKOuQiS4N+yu/Zo54M9fKXoxgDdRBaoBis
26
+
sIY0nu0n4VtaVqdqJd7JXbHYlSYscnmPINmjU/8w1bSl4QdONVloLQ==
27
+
-----END AGE ENCRYPTED FILE-----
28
+
lastmodified: "2026-02-13T22:12:50Z"
29
+
mac: ENC[AES256_GCM,data:eaQmVKrXQUcUhlXA4GH4Etl+dZVqRA/USYnsNTP9ZsUXpXxorsBKqI4Er7ILb8wFT3TLt/moG+txJbxvHNJHaZUgJJInSntMR+E8Rr1Om5Py1msh43Lkx12tV4E1y81/b5QrTacetaJiIrtC/DDzcIQEJ1hc2Id+twW7lZn0eYk=,iv:Uc3ftLy6B4Pof/kPlJUPOxZZQK+Ba3kBhvb4DNhIaMM=,tag:fuXHPUKXsR8GHvffiyLQ1A==,type:str]
30
+
encrypted_regex: ^(data|stringData)$
31
+
version: 3.11.0