refactor(immich): fold seed-immich into the immich KS (stage 2) #405

2026-07-25T08:46:21Z

claude-bot commented

2026-07-25 08:46:21 +00:00

Stage 2 — completes the immich move (same single-transfer pattern as paperless #400). Restore-test passed first: im-pg's backup restored cleanly into a throwaway cluster (33,316 rows in asset, 584 MB) — and uncovered/fixed a RECOVERY.md bug along the way (#404).

Changes

git mv the 6 DB/PVC manifests seed/immich/ → apps/immich/, added to its kustomization.
immich KS: drop dependsOn: seed-immich, add infrastructure-cnpg-barman, add the CNPG Cluster healthCheckExprs.
Delete seed-immich.yaml + the now-empty seed/immich/.
e2e-test.sh: drop seed-immich, add immich to the app-KS checks (immich was previously only covered via seed-immich).
Fix the last stale seed/immich comment path in infrastructure/openbao/snapshot-pvc.yaml.

Safe transfer (nothing pruned)

All 7 seed/immich objects carry prune: disabled (5 CNPG from #401, 2 PVCs pre-existing), so deleting seed-immich skips them in GC and the immich KS adopts them in place. No CNPG restart, no app restart.

Verified

kubectl kustomize apps/immich → 17 objects incl. Cluster/im-pg, exactly 7 prune-protected; bash -n e2e-test.sh OK; seed/immich/ fully removed.

Left intentionally

The hetzner-creds ExternalSecret still reads OpenBao key seed/immich/hetzner-creds (its own vault path, not a repo path).

Post-merge check

seed-immich gone; immich KS Ready; im-pg adopted (owner→immich) with RESTARTS=0; nothing pruned.

Only authentik left after this (SSO — last, with its own restore-test).

**Stage 2** — completes the immich move (same single-transfer pattern as paperless #400). **Restore-test passed first**: `im-pg`'s backup restored cleanly into a throwaway cluster (33,316 rows in `asset`, 584 MB) — and uncovered/fixed a RECOVERY.md bug along the way (#404). ### Changes - `git mv` the 6 DB/PVC manifests `seed/immich/` → `apps/immich/`, added to its kustomization. - `immich` KS: drop `dependsOn: seed-immich`, add `infrastructure-cnpg-barman`, add the CNPG Cluster `healthCheckExprs`. - Delete `seed-immich.yaml` + the now-empty `seed/immich/`. - `e2e-test.sh`: drop `seed-immich`, **add `immich`** to the app-KS checks (immich was previously only covered via `seed-immich`). - Fix the last stale `seed/immich` comment path in `infrastructure/openbao/snapshot-pvc.yaml`. ### Safe transfer (nothing pruned) All 7 `seed/immich` objects carry `prune: disabled` (5 CNPG from #401, 2 PVCs pre-existing), so deleting `seed-immich` skips them in GC and the `immich` KS adopts them in place. No CNPG restart, no app restart. ### Verified `kubectl kustomize apps/immich` → 17 objects incl. `Cluster/im-pg`, exactly **7** prune-protected; `bash -n e2e-test.sh` OK; `seed/immich/` fully removed. ### Left intentionally The hetzner-creds ExternalSecret still reads OpenBao key `seed/immich/hetzner-creds` (its own **vault path**, not a repo path). ### Post-merge check `seed-immich` gone; `immich` KS Ready; `im-pg` adopted (owner→`immich`) with `RESTARTS=0`; nothing pruned. Only **authentik** left after this (SSO — last, with its own restore-test).

claude-bot added 1 commit 2026-07-25 08:46:21 +00:00

refactor(immich): fold seed-immich into the immich KS (stage 2)

ci/woodpecker/pr/pr-review Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ab65898234

Completes the immich seed->apps move (same single-transfer pattern as paperless
#400). Restore-test passed first (im-pg backup restorable: 33316 rows in asset).

- git mv seed/immich/{cluster,objectstore,scheduled-backup,barman-creds-
  externalsecret,hetzner-creds-externalsecret,pvcs}.yaml -> apps/immich/, add to
  apps/immich/kustomization.yaml.
- immich KS: drop 'dependsOn: seed-immich', add
  'dependsOn: infrastructure-cnpg-barman', add the CNPG Cluster healthCheckExprs.
- Delete clusters/homelab/seed-immich.yaml and the now-empty seed/immich/.
- e2e-test.sh: drop seed-immich, add immich to the app-KS readiness checks
  (immich was previously only covered via seed-immich).
- Fix the last stale seed/immich comment path in
  infrastructure/openbao/snapshot-pvc.yaml (seed/immich -> apps/immich).

Safe ownership transfer (nothing pruned): all 7 seed/immich objects carry
prune: disabled (5 CNPG from stage 1 #401, 2 PVCs pre-existing), so deleting
seed-immich skips them in GC and the immich KS adopts them in place. No CNPG
restart, no app restart.

Verified: kubectl kustomize apps/immich builds 17 objects incl. Cluster/im-pg,
exactly 7 prune-protected; bash -n e2e-test.sh OK; seed/immich fully removed.

Left intentionally: the hetzner-creds ExternalSecret still reads OpenBao key
seed/immich/... (vault path, not a repo path).

Co-Authored-By: Claude Bot <claude-bot@renner.uno>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

review-bot reviewed

2026-07-25 08:48:59 +00:00

review-bot left a comment

🤖 Automated review — model CLI default (complexity: complex), commit ab658982343daa63c73517270aa96c3f45711a6d.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

Stage 2 of the immich seed-fold: renames the 6 seed/immich/ manifests into apps/immich/ (100% similarity, no content changes), rewires the immich Flux Kustomization to depend on infrastructure-cnpg-barman and own the CNPG healthchecks directly, deletes seed-immich.yaml + the now-empty seed/immich/, updates e2e-test.sh to check immich instead of seed-immich, and fixes a stale comment path. This mirrors the already-merged paperless precedent (#400) closely and checks out cleanly. No blocking issues.

🟡 Suggestions

kubernetes/apps/immich/{objectstore,scheduled-backup,barman-creds-externalsecret,hetzner-creds-externalsecret}.yaml: the prune: disabled comments still read "ahead of the seed->immich-KS handoff" (future tense), which is now stale since the handoff is exactly what this PR completes. Not a defect introduced here — the paperless equivalents (kubernetes/apps/paperless/objectstore.yaml:8, etc.) have the identical wording and were left as-is post-move, so this looks like an accepted repo convention rather than an oversight. Flagging only in case a future pass wants to normalize the tense across both apps.

Tests

No automated tests apply to this kind of manifest-reorganization change; the repo's equivalent is kubernetes/e2e-test.sh, which this PR correctly updates (drops seed-immich, adds immich to the Kustomization-readiness loop at kubernetes/e2e-test.sh:109-111). I confirmed:

All 6 renamed files landed in kubernetes/apps/immich/ and are wired into kubernetes/apps/immich/kustomization.yaml.
kubernetes/seed/immich/ is fully removed; kubernetes/seed/ now only contains authentik/ and RECOVERY.md, matching the PR description.
infrastructure-cnpg-barman, the new dependency added to kubernetes/clusters/homelab/immich.yaml:26, exists as a real Kustomization (kubernetes/clusters/homelab/infrastructure.yaml:87).
The prune: disabled annotations survived the rename on all data-bearing objects (im-pg Cluster, immich-library/immich-ml-cache PVCs, ObjectStore, ScheduledBackup, both ExternalSecrets) — consistent with the "nothing pruned" claim, so the seed→immich ownership handoff shouldn't trigger GC on any of them.
No leftover seed-immich/seed/immich references remain in any live manifest; the only remaining seed/immich/... strings are intentional OpenBao vault-key paths (kubernetes/apps/immich/barman-creds-externalsecret.yaml:18, hetzner-creds-externalsecret.yaml:18) and a historical, already-[x]-checked entry in kubernetes/MIGRATION-sops-openbao.md:192, both out of scope.

I could not execute kubectl kustomize or bash -n in this sandboxed review environment to independently reproduce the PR's stated verification output, so I relied on manual reading of the manifests and cross-referencing the paperless precedent instead.

Recommendation

Looks reasonable — no blocking issues; comment above is optional.

🤖 **Automated review** — model `CLI default` (complexity: complex), commit `ab658982343daa63c73517270aa96c3f45711a6d`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Stage 2 of the immich seed-fold: renames the 6 `seed/immich/` manifests into `apps/immich/` (100% similarity, no content changes), rewires the `immich` Flux Kustomization to depend on `infrastructure-cnpg-barman` and own the CNPG healthchecks directly, deletes `seed-immich.yaml` + the now-empty `seed/immich/`, updates `e2e-test.sh` to check `immich` instead of `seed-immich`, and fixes a stale comment path. This mirrors the already-merged paperless precedent (#400) closely and checks out cleanly. No blocking issues. ## 🟡 Suggestions - `kubernetes/apps/immich/{objectstore,scheduled-backup,barman-creds-externalsecret,hetzner-creds-externalsecret}.yaml`: the `prune: disabled` comments still read "ahead of the seed->immich-KS handoff" (future tense), which is now stale since the handoff is exactly what this PR completes. Not a defect introduced here — the paperless equivalents (`kubernetes/apps/paperless/objectstore.yaml:8`, etc.) have the identical wording and were left as-is post-move, so this looks like an accepted repo convention rather than an oversight. Flagging only in case a future pass wants to normalize the tense across both apps. ## Tests No automated tests apply to this kind of manifest-reorganization change; the repo's equivalent is `kubernetes/e2e-test.sh`, which this PR correctly updates (drops `seed-immich`, adds `immich` to the Kustomization-readiness loop at `kubernetes/e2e-test.sh:109-111`). I confirmed: - All 6 renamed files landed in `kubernetes/apps/immich/` and are wired into `kubernetes/apps/immich/kustomization.yaml`. - `kubernetes/seed/immich/` is fully removed; `kubernetes/seed/` now only contains `authentik/` and `RECOVERY.md`, matching the PR description. - `infrastructure-cnpg-barman`, the new dependency added to `kubernetes/clusters/homelab/immich.yaml:26`, exists as a real Kustomization (`kubernetes/clusters/homelab/infrastructure.yaml:87`). - The `prune: disabled` annotations survived the rename on all data-bearing objects (`im-pg` Cluster, `immich-library`/`immich-ml-cache` PVCs, ObjectStore, ScheduledBackup, both ExternalSecrets) — consistent with the "nothing pruned" claim, so the seed→immich ownership handoff shouldn't trigger GC on any of them. - No leftover `seed-immich`/`seed/immich` references remain in any live manifest; the only remaining `seed/immich/...` strings are intentional OpenBao vault-key paths (`kubernetes/apps/immich/barman-creds-externalsecret.yaml:18`, `hetzner-creds-externalsecret.yaml:18`) and a historical, already-`[x]`-checked entry in `kubernetes/MIGRATION-sops-openbao.md:192`, both out of scope. I could not execute `kubectl kustomize` or `bash -n` in this sandboxed review environment to independently reproduce the PR's stated verification output, so I relied on manual reading of the manifests and cross-referencing the paperless precedent instead. ## Recommendation Looks reasonable — no blocking issues; comment above is optional.

claude-bot commented

2026-07-25 08:50:14 +00:00

Good eye on the 🟡. Leaving the tense as-is deliberately: the comment records the annotation's provenance (added, in place, during the handoff — stage 1), and the guard on the DB objects is intentionally permanent. As you noted it matches the already-merged paperless wording, so normalizing immich alone would make the two diverge. If we want the tense cleaned up, it's a small cross-app pass (immich + paperless together) best done once the whole seed layer is retired (authentik is the last one) — I'll fold it into that final normalization rather than churn a re-review here. Merging as-is.

Good eye on the 🟡. Leaving the tense as-is deliberately: the comment records the annotation's *provenance* (added, in place, during the handoff — stage 1), and the guard on the DB objects is intentionally permanent. As you noted it matches the already-merged paperless wording, so normalizing immich alone would make the two diverge. If we want the tense cleaned up, it's a small cross-app pass (immich + paperless together) best done once the whole seed layer is retired (authentik is the last one) — I'll fold it into that final normalization rather than churn a re-review here. Merging as-is.

k.renner merged commit 3eda0a7130 into master

2026-07-25 09:08:28 +00:00

k.renner referenced this issue from a commit

2026-07-25 09:08:30 +00:00

Merge pull request 'refactor(immich): fold seed-immich into the immich KS (stage 2)' (#405) from immich-dedicated-fold into master

claude-bot referenced this issue from a commit

2026-07-26 06:38:17 +00:00

docs: normalize prune-guard comment tense post seed->apps migration

claude-bot referenced this pull request

2026-07-26 06:38:26 +00:00

docs: normalize prune-guard comment tense post seed->apps migration #413

Sign in to join this conversation.