From ae76682fc8fea2ffb9df2a425a5dfd2034b1004e Mon Sep 17 00:00:00 2001
From: Konstantin Renner <konstantin@renner.uno>
Date: Thu, 30 Apr 2026 18:07:01 +0200
Subject: [PATCH] fix(immich-seed,bootstrap): grant schema usage + bump MA
 timeout
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

immich seed Job: pre-creating extensions wasn't enough — vectors and
vchord create their own schemas (`vectors`, `vchord`) owned by postgres.
pg_restore under SET ROLE immich then hits "permission denied for
schema vectors" when CREATE TABLE face_search references
vectors.vector(512). Add GRANT USAGE, CREATE on those schemas to
TARGET_OWNER right after CREATE EXTENSION.

bootstrap.sh wait-apps: pipeline 825 timed out at music-assistant (10m).
On cold-start the wait timer for music-assistant starts while
velero-bootstrap-restore is still reconciling (~15min), eating most of
the 10m budget on the dependency. Bump to 30m (180 iters × 10s).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 kubernetes/apps/immich/seed-job.yaml | 10 ++++++++++
 kubernetes/bootstrap.sh              |  5 ++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/kubernetes/apps/immich/seed-job.yaml b/kubernetes/apps/immich/seed-job.yaml
index eaf564af..97e3f952 100644
--- a/kubernetes/apps/immich/seed-job.yaml
+++ b/kubernetes/apps/immich/seed-job.yaml
@@ -170,6 +170,16 @@ spec:
                 psql -U postgres -d "$TARGET_DB" -c "CREATE EXTENSION IF NOT EXISTS \"$ext\" CASCADE;" || log "extension $ext: failed (continuing)"
               done
 
+              # vectors / vchord extensions create their own schemas owned by
+              # postgres. pg_restore runs under SET ROLE $TARGET_OWNER, which
+              # then can't even reference vectors.vector(...) as a column type
+              # without USAGE on the schema. Grant USAGE+CREATE so the dump's
+              # CREATE TABLE face_search/smart_search succeeds.
+              for sch in vectors vchord; do
+                log "Granting access to schema $sch to $TARGET_OWNER"
+                psql -U postgres -d "$TARGET_DB" -c "GRANT USAGE, CREATE ON SCHEMA \"$sch\" TO \"$TARGET_OWNER\";" || log "grant on $sch: failed (continuing)"
+              done
+
               log "pg_restore /seed/legacy.dump → $TARGET_DB ..."
               pg_restore -U postgres -d "$TARGET_DB" \
                 --no-owner --no-privileges --role="$TARGET_OWNER" \
diff --git a/kubernetes/bootstrap.sh b/kubernetes/bootstrap.sh
index 9c0138d3..44a2b93b 100755
--- a/kubernetes/bootstrap.sh
+++ b/kubernetes/bootstrap.sh
@@ -300,7 +300,10 @@ if phase_runs wait-apps; then
     # cluster's bootstrap.recovery succeeding from that seed. Allow 20 min.
     wait_kustomization authentik        "Authentik"                                           120
     wait_kustomization monitoring       "kube-prometheus-stack (Loki + Prom + AM + Grafana)"  180
-    wait_kustomization music-assistant  "Music Assistant (small Garage tarball)"              60
+    # On cold-start, velero-bootstrap-restore takes ~15min before this KS
+    # can even start reconciling, so the wait timer can burn most of its
+    # budget on the dependency. 30min covers that + the actual reconcile.
+    wait_kustomization music-assistant  "Music Assistant (small Garage tarball)"              180
     wait_kustomization paperless        "Paperless (DB + ~3.5GB media Velero restore)"        180
     wait_kustomization home-assistant   "Home Assistant (HAOS backup → native restore)"       180
     # Measured ~70 min on a 70 GB library (17 min upload + 52 min extract).