chore: upgrade Immich db to PG 18

manifests/dashboard/chart.yaml

@@ -1,32 +1,21 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
-  name: kubernetes-dashboard
+  name: headlamp
 spec:
-  url: https://kubernetes.github.io/dashboard/
+  url: "https://kubernetes-sigs.github.io/headlamp/"
   interval: "24h"
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
-  name: kubernetes-dashboard
+  name: headlamp
 spec:
   interval: "24h"
   chart:
     spec:
-      chart: kubernetes-dashboard
+      chart: headlamp
       sourceRef:
         kind: HelmRepository
-        name: kubernetes-dashboard
+        name: headlamp
       interval: "24h"
-  values:
-    app:
-      settings:
-        global:
-          clusterName: Hellings Home
-          itemsPerPage: 25
-      ingress:
-        enabled: true
-        hosts:
-          - dashboard.shire-zebra.ts.net
-        ingressClassName: tailscale

manifests/dashboard/ingress.yaml

@@ -0,0 +1,14 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dashboard-tailscale
+spec:
+  ingressClassName: tailscale
+  defaultBackend:
+    service:
+      name: headlamp
+      port:
+        number: 3001
+  tls:
+    - hosts:
+        - headlamp

manifests/dashboard/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - namespace.yaml
   - chart.yaml
   - user.yaml
+  - ingress.yaml

manifests/databases/immich.yaml

@@ -1,89 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: immich
-spec:
-  imageName: "ghcr.io/corentingiraud/cnpg-pgvector-vectorchord:16-migration"
-  #imageName: "ghcr.io/tensorchord/cloudnative-pgvecto.rs:16-v0.3.0"
-  #postgresUID: 1
-  instances: 1
-  storage:
-    size: 60Gi
-  primaryUpdateStrategy: unsupervised
-  postgresql:
-    shared_preload_libraries:
-      - vectors.so
-      - vchord.so
-
-  bootstrap:
-    recovery:
-      source: origin
-    # initdb:
-    #   database: immich
-    #   owner: immich
-    #   secret:
-    #     name: postgres-user-immich
-    #   dataChecksums: true
-    #   postInitApplicationSQL:
-    #     - ALTER SYSTEM SET search_path TO "$user", public, vectors;
-    #     - SET search_path TO "$user", public, vectors;
-    #     - CREATE EXTENSION IF NOT EXISTS "cube";
-    #     - CREATE EXTENSION IF NOT EXISTS "earthdistance";
-    #     - GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "immich";
-
-  externalClusters:
-    - name: origin
-      plugin:
-        name: barman-cloud.cloudnative-pg.io
-        parameters:
-          barmanObjectName: k3sbackup-objectstore
-          serverName: pgvector
-
-  managed:
-    roles:
-      - name: immich
-        ensure: present
-        comment: Immich DB user
-        login: true
-        superuser: true
-        passwordSecret:
-          name: postgres-user-immich
-
-  plugins:
-    - name: barman-cloud.cloudnative-pg.io
-      isWALArchiver: true
-      parameters:
-        barmanObjectName: k3sbackup-objectstore
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: database-immich
-spec:
-  name: immich
-  owner: immich
-  cluster:
-    name: immich
-  extensions:
-    - name: vectors
-      ensure: present
-    - name: vectorchord
-      ensure: present
-    - name: cube
-      ensure: present
-    - name: earthdistance
-      ensure: present
----
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: immich-backup
-spec:
-  immediate: true # Create one when this is added to the cluster
-  schedule: "0 2 0 * * *" # 1AM, nightly
-  backupOwnerReference: self
-  cluster:
-    name: immich
-  method: plugin
-  pluginConfiguration:
-    name: barman-cloud.cloudnative-pg.io

manifests/databases/kustomization.yaml

@@ -7,5 +7,4 @@ resources:
   - postgres-gitlab.yaml
   - postgres-pgadmin.yaml
   - postgres-matrix.yaml
-  - immich.yaml
   - ingress.yaml

manifests/databases/secrets.yaml

@@ -133,37 +133,3 @@ spec:
       remoteRef:
         key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
         property: password
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: postgres-user-immich
-  namespace: db
-spec:
-  target:
-    name: postgres-user-immich
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        username: |-
-          {{ .username }}
-        password: |-
-          {{ .password }}
-  data:
-    - secretKey: username
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f
-        property: username
-    - secretKey: password
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f
-        property: password

manifests/helm/external-secrets.yaml

@@ -31,3 +31,6 @@ spec:
     crds:
       create: true
     includeCRDs: true
+    webhook:
+      certManager:
+        enable: true

manifests/helm/kyverno.yaml

@@ -22,7 +22,7 @@ spec:
   chart:
     spec:
       chart: kyverno
-      version: "1.17.1"
+      version: "3.7.1"
       sourceRef:
         kind: HelmRepository
         name: kyverno

manifests/immich/chart.yaml

@@ -34,7 +34,7 @@ spec:
             image:
               tag: v2.7.5
             env:
-              DB_HOSTNAME: immich-rw.db.svc.cluster.local
+              DB_HOSTNAME: immich-rw
               DB_DATABASE_NAME: immich
               DB_USERNAME:
                 valueFrom:

manifests/immich/database.yaml

@@ -0,0 +1,161 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: immich
+spec:
+  imageName: "ghcr.io/tensorchord/cloudnative-vectorchord:18"
+  #postgresUID: 1
+  instances: 1
+  storage:
+    size: 60Gi
+  primaryUpdateStrategy: unsupervised
+  postgresql:
+    shared_preload_libraries:
+      - vchord.so
+
+  bootstrap:
+    # Use these with the name "immich-1" to restore from the backups
+    recovery:
+      source: origin
+    # Use these two lines in order to restore from the other database,
+    # once it has restored from the WALs
+    #pg_basebackup:
+    #  source: restore
+    # Use this block to bootstrap the cluster, if you don't have backups.
+    # What are you doing without backups, you chump?!
+    # initdb:
+    #   database: immich
+    #   owner: immich
+    #   secret:
+    #     name: postgres-user-immich
+    #   dataChecksums: true
+    #   postInitApplicationSQL:
+    #     - ALTER SYSTEM SET search_path TO "$user", public, vectors;
+    #     - SET search_path TO "$user", public, vectors;
+    #     - CREATE EXTENSION IF NOT EXISTS "cube";
+    #     - CREATE EXTENSION IF NOT EXISTS "earthdistance";
+    #     - GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "immich";
+
+  externalClusters:
+    - name: origin
+      plugin:
+        name: barman-cloud.cloudnative-pg.io
+        parameters:
+          barmanObjectName: k3sbackup-objectstore
+          serverName: immich
+    - name: restore
+      connectionParameters:
+        host: immich-1-rw
+        user: streaming_replica
+        sslmode: verify-full
+      sslCert:
+        name: immich-1-replication
+        key: tls.crt
+      sslKey:
+        name: immich-1-replication
+        key: tls.key
+      sslRootCert:
+        name: immich-1-ca
+        key: ca.crt
+
+  managed:
+    roles:
+      - name: immich
+        ensure: present
+        comment: Immich DB user
+        login: true
+        superuser: true
+        passwordSecret:
+          name: postgres-user-immich
+
+  plugins:
+    - name: barman-cloud.cloudnative-pg.io
+      isWALArchiver: true
+      parameters:
+        barmanObjectName: k3sbackup-objectstore
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: database-immich
+spec:
+  name: immich
+  owner: immich
+  cluster:
+    name: immich
+  extensions:
+    - name: vectors
+      ensure: present
+    - name: vectorchord
+      ensure: present
+    - name: cube
+      ensure: present
+    - name: earthdistance
+      ensure: present
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: k3sbackup-externalsecret
+spec:
+  target:
+    name: k3sbackup-secret
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        username: |-
+          {{ .username }}
+        password: |-
+          {{ .password }}
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
+        property: username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
+        property: password
+
+---
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: k3sbackup-objectstore
+spec:
+  configuration:
+    destinationPath: "s3://k3sbackup/postgres"
+    endpointURL: "http://chronicles.thehellings.lan:9000/"
+    s3Credentials:
+      accessKeyId:
+        name: k3sbackup-secret
+        key: username
+      secretAccessKey:
+        name: k3sbackup-secret
+        key: password
+    wal:
+      compression: gzip
+  retentionPolicy: "30d"
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: immich-backup
+spec:
+  immediate: false # Create one when this is added to the cluster
+  schedule: "0 2 0 * * *" # 1AM, nightly
+  backupOwnerReference: self
+  cluster:
+    name: immich
+  method: plugin
+  pluginConfiguration:
+    name: barman-cloud.cloudnative-pg.io

manifests/immich/kustomization.yaml

@@ -2,8 +2,9 @@ namespace: immich
 
 resources:
   - namespace.yaml
-  - chart.yaml
   - postgres-user-secret.yaml
+  - database.yaml
+  - chart.yaml
   - pvc.yaml
   - ingress.yaml
   - backup.yaml

modules/nixos/kubernetes.nix

@@ -7,8 +7,8 @@
 let
   cfg = config.greg.kubernetes;
   cert-manager = pkgs.fetchurl {
-    url = "https://github.com/cert-manager/cert-manager/releases/download/v1.18.2/cert-manager.yaml";
+    url = "https://github.com/cert-manager/cert-manager/releases/download/v1.20.2/cert-manager.yaml";
-    sha256 = "0vx1nfyhl0rzb6psfxplq8pfp18mrrdk83n8rj2ph8q6r15vcih5";
+    sha256 = "sha256-HOEcrpEq3sxp5rtiNDX6/J7SFQX57/+YvXHXuA8B2x8=";
   };
   flux = pkgs.fetchurl {
     url = "https://github.com/fluxcd/flux2/releases/download/v2.7.2/install.yaml";