homelab/immich/k8s/immich.yaml

apiVersion: v1
kind: Service
metadata:
  name: immich-service
  namespace: immich
spec:
  selector:
    app: immich
  ports:
    - name: http
      port: 2283
      targetPort: 2283
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: immich-deployment
  namespace: immich
  labels:
    app: immich
spec:
  replicas: 2
  selector:
    matchLabels:
      app: immich
  template:
    metadata:
      labels:
        app: immich
    spec:
      containers:
        - name: immich
          image: ghcr.io/immich-app/immich-server:v3
          envFrom:
            - configMapRef:
                name: immich-config
            - secretRef:
                name: immich-secrets
          ports:
            - name: http
              containerPort: 2283
          volumeMounts:
            - name: immich-data
              mountPath: /data
          # The first boot runs migrations and warms the transcoder, which can
          # take minutes, so liveness has to wait on the startup probe.
          startupProbe:
            httpGet:
              path: /api/server/ping
              port: http
            failureThreshold: 60
            periodSeconds: 10
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              path: /api/server/ping
              port: http
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            httpGet:
              path: /api/server/ping
              port: http
            initialDelaySeconds: 30
            periodSeconds: 30
            timeoutSeconds: 5
          # Only the request is scheduled against, and the node is already
          # oversubscribed (5.58 of 6 cores requested) while actually running
          # at about 1.5. So the request states what this sits at while idle -
          # tens of millicores - and the limit leaves room for the burst that
          # matters: thumbnails, transcodes and metadata extraction.
          #
          # The limit used to be 2Gi, but the server OOMKilled on boot while
          # chewing through a backlog of unprocessed assets (API +Workers in
          # one container spike well past idle).
          resources:
            requests:
              cpu: "100m"
              memory: "512Mi"
            limits:
              cpu: "1500m"
              memory: "4Gi"
      volumes:
        - name: immich-data
          # The library lives on the node's own disk, not in a PVC. A PVC here
          # meant declaring a size up front for data that does not exist yet,
          # on a provisioner that cannot grow it, and the only copy of the
          # photos was one `kubectl delete namespace` away.
          #
          # Directory, not DirectoryOrCreate, on purpose: if sdc9 is not
          # mounted, this must fail loudly instead of quietly writing the
          # library onto the root filesystem.
          hostPath:
            path: /mnt/immich/library
            type: Directory