From 088741003f15836a8a8c7aa0ef4193c2df196ae9 Mon Sep 17 00:00:00 2001
From: Paul Payne <paul@payne.io>
Date: Sun, 8 Jun 2025 09:18:07 -0700
Subject: [PATCH] Refactor Immich configuration to use templated values for
 images, ports, and storage. Remove obsolete config maps and secrets.

---
 apps/immich/config/example.env               | 21 ------
 apps/immich/db-init-job.yaml                 | 29 +++-----
 apps/immich/deployment-machine-learning.yaml | 12 +---
 apps/immich/deployment-microservices.yaml    | 23 +++----
 apps/immich/deployment-server.yaml           | 25 ++++---
 apps/immich/ingress.yaml                     |  6 +-
 apps/immich/kustomization.yaml               | 71 --------------------
 apps/immich/manifest.yaml                    | 15 +++++
 apps/immich/pvc.yaml                         |  4 +-
 apps/immich/service.yaml                     |  4 +-
 10 files changed, 58 insertions(+), 152 deletions(-)
 delete mode 100644 apps/immich/config/example.env

diff --git a/apps/immich/config/example.env b/apps/immich/config/example.env
deleted file mode 100644
index c546c07..0000000
--- a/apps/immich/config/example.env
+++ /dev/null
@@ -1,21 +0,0 @@
-IMMICH_DOMAIN=immich.$DOMAIN
-IMMICH_STORAGE=100Gi
-IMMICH_CACHE_STORAGE=10Gi
-TZ=UTC
-IMMICH_SERVER_IMAGE=ghcr.io/immich-app/immich-server:release
-IMMICH_ML_IMAGE=ghcr.io/immich-app/immich-machine-learning:release
-DB_HOSTNAME=postgres.postgres
-DB_PORT=5432
-DB_USERNAME=immich
-DB_DATABASE_NAME=immich
-POSTGRES_ADMIN_USER=$POSTGRES_USER
-REDIS_HOSTNAME=redis.redis
-REDIS_PORT=6379
-MACHINE_LEARNING_WORKERS=1
-MACHINE_LEARNING_MODEL_TTL=300
-IMMICH_ENV=production
-IMMICH_LOG_LEVEL=info
-
-# Secrets
-DB_PASSWORD=
-POSTGRES_ADMIN_PASSWORD=$POSTGRES_PASSWORD
diff --git a/apps/immich/db-init-job.yaml b/apps/immich/db-init-job.yaml
index f22eb42..f7ff10f 100644
--- a/apps/immich/db-init-job.yaml
+++ b/apps/immich/db-init-job.yaml
@@ -21,12 +21,12 @@ spec:
                 END IF;
               END
               \$\$;
-              
+
               SELECT 'CREATE DATABASE ${DB_DATABASE_NAME}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '${DB_DATABASE_NAME}')\gexec
               ALTER DATABASE ${DB_DATABASE_NAME} OWNER TO ${DB_USERNAME};
               GRANT ALL PRIVILEGES ON DATABASE ${DB_DATABASE_NAME} TO ${DB_USERNAME};
               EOF
-              
+
               # Connect to the immich database and enable required extensions
               PGPASSWORD=${POSTGRES_ADMIN_PASSWORD} psql -h ${DB_HOSTNAME} -U postgres -d ${DB_DATABASE_NAME} <<EOF
               DO \$\$
@@ -52,26 +52,17 @@ spec:
             - name: POSTGRES_ADMIN_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: secrets
-                  key: POSTGRES_ADMIN_PASSWORD
+                  name: postgres-secrets
+                  key: password
             - name: DB_HOSTNAME
-              valueFrom:
-                configMapKeyRef:
-                  name: config
-                  key: DB_HOSTNAME
+              value: "{{ .config.apps.immich.dbHostname }}"
             - name: DB_DATABASE_NAME
-              valueFrom:
-                configMapKeyRef:
-                  name: config
-                  key: DB_DATABASE_NAME
+              value: "{{ .config.apps.immich.dbUsername }}"
             - name: DB_USERNAME
-              valueFrom:
-                configMapKeyRef:
-                  name: config
-                  key: DB_USERNAME
+              value: "{{ .config.apps.immich.dbUsername }}"
             - name: DB_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: secrets
-                  key: DB_PASSWORD
-      restartPolicy: OnFailure
\ No newline at end of file
+                  name: immich-secrets
+                  key: dbPassword
+      restartPolicy: OnFailure
diff --git a/apps/immich/deployment-machine-learning.yaml b/apps/immich/deployment-machine-learning.yaml
index ef7d623..b9470fc 100644
--- a/apps/immich/deployment-machine-learning.yaml
+++ b/apps/immich/deployment-machine-learning.yaml
@@ -15,20 +15,14 @@ spec:
         component: machine-learning
     spec:
       containers:
-        - image: ghcr.io/immich-app/immich-machine-learning:release
+        - image: "{{ .config.apps.immich.mlImage }}"
           name: immich-machine-learning
           ports:
-            - containerPort: 3003
+            - containerPort: {{ .config.apps.immich.mlPort }}
               protocol: TCP
-          envFrom:
-            - configMapRef:
-                name: config
           env:
             - name: TZ
-              valueFrom:
-                configMapKeyRef:
-                  key: TZ
-                  name: config
+              value: "{{ .config.apps.immich.timezone }}"
           volumeMounts:
             - mountPath: /cache
               name: immich-cache
diff --git a/apps/immich/deployment-microservices.yaml b/apps/immich/deployment-microservices.yaml
index 5ff8e29..4989507 100644
--- a/apps/immich/deployment-microservices.yaml
+++ b/apps/immich/deployment-microservices.yaml
@@ -20,23 +20,22 @@ spec:
         component: microservices
     spec:
       containers:
-        - image: ghcr.io/immich-app/immich-server:release
+        - image: "{{ .config.apps.immich.serverImage }}"
           name: immich-microservices
-          envFrom:
-            - secretRef:
-                name: secrets
-            - configMapRef:
-                name: config
           env:
             - name: REDIS_HOSTNAME
-              value: redis.redis.svc.cluster.local
+              value: "{{ .config.apps.immich.redisHostname }}"
             - name: DB_HOSTNAME
-              value: postgres.postgres.svc.cluster.local
-            - name: TZ
+              value: "{{ .config.apps.immich.dbHostname }}"
+            - name: DB_USERNAME
+              value: "{{ .config.apps.immich.dbUsername }}"
+            - name: DB_PASSWORD
               valueFrom:
-                configMapKeyRef:
-                  key: TZ
-                  name: config
+                secretKeyRef:
+                  name: immich-secrets
+                  key: dbPassword
+            - name: TZ
+              value: "{{ .config.apps.immich.timezone }}"
             - name: IMMICH_WORKERS_EXCLUDE
               value: api
           volumeMounts:
diff --git a/apps/immich/deployment-server.yaml b/apps/immich/deployment-server.yaml
index 6a029c8..7f7937f 100644
--- a/apps/immich/deployment-server.yaml
+++ b/apps/immich/deployment-server.yaml
@@ -20,26 +20,25 @@ spec:
         component: server
     spec:
       containers:
-        - image: ghcr.io/immich-app/immich-server:release
+        - image: "{{ .config.apps.immich.serverImage }}"
           name: immich-server
           ports:
-            - containerPort: 2283
+            - containerPort: {{ .config.apps.immich.serverPort }}
               protocol: TCP
-          envFrom:
-            - secretRef:
-                name: secrets
-            - configMapRef:
-                name: config
           env:
             - name: REDIS_HOSTNAME
-              value: redis.redis.svc.cluster.local
+              value: "{{ .config.apps.immich.redisHostname }}"
             - name: DB_HOSTNAME
-              value: postgres.postgres.svc.cluster.local
-            - name: TZ
+              value: "{{ .config.apps.immich.dbHostname }}"
+            - name: DB_USERNAME
+              value: "{{ .config.apps.immich.dbUsername }}"
+            - name: DB_PASSWORD
               valueFrom:
-                configMapKeyRef:
-                  key: TZ
-                  name: config
+                secretKeyRef:
+                  name: immich-secrets
+                  key: dbPassword
+            - name: TZ
+              value: "{{ .config.apps.immich.timezone }}"
             - name: IMMICH_WORKERS_EXCLUDE
               value: microservices
           volumeMounts:
diff --git a/apps/immich/ingress.yaml b/apps/immich/ingress.yaml
index 40423fc..b5ed973 100644
--- a/apps/immich/ingress.yaml
+++ b/apps/immich/ingress.yaml
@@ -4,11 +4,11 @@ kind: Ingress
 metadata:
   name: immich-public
   annotations:
-    external-dns.alpha.kubernetes.io/target: your.immich.domain
+    external-dns.alpha.kubernetes.io/target: "{{ .config.apps.immich.domain }}"
     external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
 spec:
   rules:
-    - host: your.immich.domain
+    - host: "{{ .config.apps.immich.domain }}"
       http:
         paths:
           - path: /
@@ -21,4 +21,4 @@ spec:
   tls:
     - secretName: wildcard-internal-wild-cloud-tls
       hosts:
-        - your.immich.domain
+        - "{{ .config.apps.immich.domain }}"
diff --git a/apps/immich/kustomization.yaml b/apps/immich/kustomization.yaml
index 8aa8d24..7d78a89 100644
--- a/apps/immich/kustomization.yaml
+++ b/apps/immich/kustomization.yaml
@@ -16,74 +16,3 @@ resources:
   - pvc.yaml
   - service.yaml
   - db-init-job.yaml
-configMapGenerator:
-  - name: config
-    envs:
-      - config/config.env
-secretGenerator:
-  - name: secrets
-    envs:
-      - config/secrets.env
-
-replacements:
-  - source:
-      kind: ConfigMap
-      name: config
-      fieldPath: data.DOMAIN
-    targets:
-      - select:
-          kind: Ingress
-          name: immich-public
-        fieldPaths:
-          - metadata.annotations.[external-dns.alpha.kubernetes.io/target]
-  - source:
-      kind: ConfigMap
-      name: config
-      fieldPath: data.IMMICH_DOMAIN
-    targets:
-      - select:
-          kind: Ingress
-          name: immich-public
-        fieldPaths:
-          - spec.rules.0.host
-          - spec.tls.0.hosts.0
-  - source:
-      kind: ConfigMap
-      name: config
-      fieldPath: data.IMMICH_STORAGE
-    targets:
-      - select:
-          kind: PersistentVolumeClaim
-          name: immich-pvc
-        fieldPaths:
-          - spec.resources.requests.storage
-  - source:
-      kind: ConfigMap
-      name: config
-      fieldPath: data.IMMICH_CACHE_STORAGE
-    targets:
-      - select:
-          kind: PersistentVolumeClaim
-          name: immich-cache-pvc
-        fieldPaths:
-          - spec.resources.requests.storage
-  - source:
-      kind: ConfigMap
-      name: config
-      fieldPath: data.IMMICH_SERVER_IMAGE
-    targets:
-      - select:
-          kind: Deployment
-          name: immich-server
-        fieldPaths:
-          - spec.template.spec.containers.0.image
-  - source:
-      kind: ConfigMap
-      name: config
-      fieldPath: data.IMMICH_ML_IMAGE
-    targets:
-      - select:
-          kind: Deployment
-          name: immich-machine-learning
-        fieldPaths:
-          - spec.template.spec.containers.0.image
diff --git a/apps/immich/manifest.yaml b/apps/immich/manifest.yaml
index c720d94..5857b82 100644
--- a/apps/immich/manifest.yaml
+++ b/apps/immich/manifest.yaml
@@ -6,3 +6,18 @@ icon: https://immich.app/assets/images/logo.png
 requires:
   - name: redis
   - name: postgres
+defaultConfig:
+  serverImage: ghcr.io/immich-app/immich-server:release
+  mlImage: ghcr.io/immich-app/immich-machine-learning:release
+  timezone: UTC
+  serverPort: 2283
+  mlPort: 3003
+  storage: 250Gi
+  cacheStorage: 10Gi
+  redisHostname: redis.redis.svc.cluster.local
+  dbHostname: postgres.postgres.svc.cluster.local
+  dbUsername: immich
+  domain: immich.example.com
+requiredSecrets:
+  - apps.immich.dbPassword
+  - apps.postgres.password
diff --git a/apps/immich/pvc.yaml b/apps/immich/pvc.yaml
index c38967d..432fd97 100644
--- a/apps/immich/pvc.yaml
+++ b/apps/immich/pvc.yaml
@@ -9,7 +9,7 @@ spec:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 250Gi
+      storage: {{ .config.apps.immich.storage }}
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -21,4 +21,4 @@ spec:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 10Gi
+      storage: {{ .config.apps.immich.cacheStorage }}
diff --git a/apps/immich/service.yaml b/apps/immich/service.yaml
index 131a865..f857462 100644
--- a/apps/immich/service.yaml
+++ b/apps/immich/service.yaml
@@ -9,7 +9,7 @@ metadata:
 spec:
   ports:
     - port: 3001
-      targetPort: 2283
+      targetPort: {{ .config.apps.immich.serverPort }}
   selector:
     app: immich
     component: server
@@ -25,7 +25,7 @@ metadata:
     app: immich-machine-learning
 spec:
   ports:
-    - port: 3003
+    - port: {{ .config.apps.immich.mlPort }}
   selector:
     app: immich
     component: machine-learning