archy/apps/immich-redis/manifest.yml

app:
  id: immich-redis
  name: Immich Redis
  version: "7-alpine"
  description: Valkey (Redis-compatible) cache for Immich.

  # Named by app_id (immich-redis) = archy-net alias = server's REDIS_HOSTNAME.

  container:
    image: 146.59.87.168:3000/lfg2025/valkey:7-alpine
    pull_policy: if-not-present
    network: archy-net

  dependencies: []

  resources:
    memory_limit: 128Mi

  security:
    capabilities: [SETGID, SETUID]
    readonly_root: false
    network_policy: isolated

  ports: []

  volumes: []

  environment: []

  health_check:
    type: tcp
    endpoint: localhost:6379
    interval: 30s
    timeout: 5s
    retries: 3
feat(immich): scaffold registry manifests for postgres/redis/server (not yet live) immich becomes a manifest-driven stack (the legacy install_immich_stack — hardcoded podman run + sudo chown — is the anti-pattern being retired). Three image-only manifests modelled on the btcpay stack + the live .228 container config: - immich-postgres / immich-redis / immich-server on archy-net; container_name set to the underscore form (immich_postgres/_redis/_server) so the server's DB_HOSTNAME/REDIS_HOSTNAME aliases resolve. - generated_secrets: [immich-db-password] (idempotent — reuses the live secret on existing nodes; postgres is already initialised with it). - server depends on postgres+redis (install ordering); upload bind preserved. Inert for now: not added to the UI catalog and install_immich_stack still the default, so nothing installs these until the orchestrator wiring + on-node ownership (data_uid) validation lands. Schema validated by the all-manifests round-trip test. See docs/PRODUCTION-MASTER-PLAN.md §6. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 2026-06-21 05:53:58 -04:00			`app:`
			`id: immich-redis`
			`name: Immich Redis`
			`version: "7-alpine"`
			`description: Valkey (Redis-compatible) cache for Immich.`

feat(immich): manifest-driven stack via orchestrator — live-migrated on .228 Completes the immich migration off the legacy hardcoded install_immich_stack (podman run + sudo chown) to the registry-manifest + orchestrator path. Validated live on .228 (clean single set, healthy v2.7.4, data dir ownership correct). - install_immich_stack now tries install_stack_via_orchestrator(immich_stack_app_ids) first; legacy remains only as the no-manifests fallback. - immich-{postgres,redis,server} manifests corrected from live findings: * named by app_id (dropped container_name override) — using container_name spawned DUPLICATE containers (app_id-named install vs name-override reconcile) on the same PGDATA, which corrupted a postgres cluster. Server reaches its siblings via app_id aliases (DB_HOSTNAME=immich-postgres, REDIS=immich-redis). * immich-postgres data_uid 100998:100998 (postgres drops to container 999 → host 100998 under rootless; verified the fresh dir is chowned correctly). * immich-server version "release"→"2.7.4" (manifest validation requires a digit; the bad version made the manifest silently skip → partial orchestrator install → legacy fallback → the duplicate corruption above). - HARDEN install_stack_via_orchestrator: only fall back to the legacy installer when NOTHING was installed yet. An "unknown app_id" AFTER a member is up now errors instead of double-creating containers on shared data (the corruption root cause). - Strict the all-manifests round-trip test: fail (not skip) on any invalid shipped manifest — this gap let the bad immich-server version through. Known follow-up (pre-existing, platform-wide): orchestrator-installed backends (immich, btcpay-db) run as podman --restart, not Quadlet, and podman-restart.service is disabled on .228 → reboot-survival gap independent of this migration. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 2026-06-21 07:08:45 -04:00			`# Named by app_id (immich-redis) = archy-net alias = server's REDIS_HOSTNAME.`
feat(immich): scaffold registry manifests for postgres/redis/server (not yet live) immich becomes a manifest-driven stack (the legacy install_immich_stack — hardcoded podman run + sudo chown — is the anti-pattern being retired). Three image-only manifests modelled on the btcpay stack + the live .228 container config: - immich-postgres / immich-redis / immich-server on archy-net; container_name set to the underscore form (immich_postgres/_redis/_server) so the server's DB_HOSTNAME/REDIS_HOSTNAME aliases resolve. - generated_secrets: [immich-db-password] (idempotent — reuses the live secret on existing nodes; postgres is already initialised with it). - server depends on postgres+redis (install ordering); upload bind preserved. Inert for now: not added to the UI catalog and install_immich_stack still the default, so nothing installs these until the orchestrator wiring + on-node ownership (data_uid) validation lands. Schema validated by the all-manifests round-trip test. See docs/PRODUCTION-MASTER-PLAN.md §6. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 2026-06-21 05:53:58 -04:00
			`container:`
			`image: 146.59.87.168:3000/lfg2025/valkey:7-alpine`
			`pull_policy: if-not-present`
			`network: archy-net`

			`dependencies: []`

			`resources:`
			`memory_limit: 128Mi`

			`security:`
			`capabilities: [SETGID, SETUID]`
			`readonly_root: false`
			`network_policy: isolated`

			`ports: []`

			`volumes: []`

			`environment: []`

			`health_check:`
			`type: tcp`
			`endpoint: localhost:6379`
			`interval: 30s`
			`timeout: 5s`
			`retries: 3`