From 9c87c0cb1ee636e571a640d87f1225d099fbeeb3 Mon Sep 17 00:00:00 2001
From: Paul Payne <paul@payne.io>
Date: Mon, 26 Oct 2026 16:20:23 +0000
Subject: [PATCH] Fix immich fsGroup, keila tz autoupdate, revert open-webui
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- immich: add fsGroup: 1000 so init container can write to PVC
- keila: set TZ_AUTOUPDATE=disabled to prevent tz library crash
  on read-only /opt/app/lib path in v0.30.3
- open-webui: revert to v0.9.5 — v0.12.x migration crashes on
  existing DB (duplicate column name: info_json)
---
 immich/versions/3/deployment-microservices.yaml | 1 +
 immich/versions/3/deployment-server.yaml        | 1 +
 keila/versions/0/deployment.yaml                | 2 ++
 open-webui/versions/0/deployment.yaml           | 2 +-
 open-webui/versions/0/manifest.yaml             | 2 +-
 5 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/immich/versions/3/deployment-microservices.yaml b/immich/versions/3/deployment-microservices.yaml
index 91ebece..4c3961e 100644
--- a/immich/versions/3/deployment-microservices.yaml
+++ b/immich/versions/3/deployment-microservices.yaml
@@ -19,6 +19,7 @@ spec:
       securityContext:
         runAsNonRoot: true
         runAsUser: 1000
+        fsGroup: 1000
         seccompProfile:
           type: RuntimeDefault
       initContainers:
diff --git a/immich/versions/3/deployment-server.yaml b/immich/versions/3/deployment-server.yaml
index c27c605..f0cda9b 100644
--- a/immich/versions/3/deployment-server.yaml
+++ b/immich/versions/3/deployment-server.yaml
@@ -19,6 +19,7 @@ spec:
       securityContext:
         runAsNonRoot: true
         runAsUser: 1000
+        fsGroup: 1000
         seccompProfile:
           type: RuntimeDefault
       initContainers:
diff --git a/keila/versions/0/deployment.yaml b/keila/versions/0/deployment.yaml
index 2d8b37f..fc93f65 100644
--- a/keila/versions/0/deployment.yaml
+++ b/keila/versions/0/deployment.yaml
@@ -58,6 +58,8 @@ spec:
               key: smtpPassword
         - name: MAILER_SMTP_FROM_EMAIL
           value: "{{ .smtp.from }}"
+        - name: TZ_AUTOUPDATE
+          value: "disabled"
         - name: DISABLE_REGISTRATION
           value: "{{ .disableRegistration }}"
         - name: KEILA_USER
diff --git a/open-webui/versions/0/deployment.yaml b/open-webui/versions/0/deployment.yaml
index f91be69..5ee0677 100644
--- a/open-webui/versions/0/deployment.yaml
+++ b/open-webui/versions/0/deployment.yaml
@@ -19,7 +19,7 @@ spec:
           type: RuntimeDefault
       containers:
       - name: open-webui
-        image: ghcr.io/open-webui/open-webui:v0.12.4
+        image: ghcr.io/open-webui/open-webui:v0.9.5
         imagePullPolicy: IfNotPresent
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/open-webui/versions/0/manifest.yaml b/open-webui/versions/0/manifest.yaml
index fc8d30e..b33516f 100644
--- a/open-webui/versions/0/manifest.yaml
+++ b/open-webui/versions/0/manifest.yaml
@@ -1,4 +1,4 @@
-version: 0.12.4
+version: 0.9.5-5
 defaultConfig:
   namespace: open-webui
   storage: 2Gi