From bdf43cf256fa67320e433b441332bc7fc59f8e8b Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Thu, 22 Oct 2026 12:03:34 +0200
Subject: [PATCH] Route Immich through its Argo-managed service

---
 apps/immich/README.md                         | 13 ++++++
 apps/immich/resources/kustomization.yaml      |  1 +
 apps/immich/resources/routes.yaml             | 46 +++++++++++++++++++
 apps/traefik/routes/_deleted/README.md        |  2 +
 ...ult-ingressroute-immich-brunner-ninja.json |  0
 ...ult-ingressroute-photos-brunner-ninja.json |  0
 ...default-service-legacy-immich-service.json |  0
 7 files changed, 62 insertions(+)
 create mode 100644 apps/immich/resources/routes.yaml
 create mode 100644 apps/traefik/routes/_deleted/README.md
 rename apps/traefik/routes/{ => _deleted}/default-ingressroute-immich-brunner-ninja.json (100%)
 rename apps/traefik/routes/{ => _deleted}/default-ingressroute-photos-brunner-ninja.json (100%)
 rename apps/traefik/routes/{ => _deleted}/default-service-legacy-immich-service.json (100%)

diff --git a/apps/immich/README.md b/apps/immich/README.md
index 60a62db..34bb6a5 100644
--- a/apps/immich/README.md
+++ b/apps/immich/README.md
@@ -31,3 +31,16 @@ Immich-owned are imported, leaving all other applications' keys untouched.
 The old Podman stack and host PostgreSQL must remain available as rollback
 sources until the new application, database, monitoring, and routes have been
 verified. Never run both Immich servers against `/mnt/Bilder` concurrently.
+
+The migration dumps are retained with mode `0600` under
+`/home/feedc0de/immich-app/backups/k8s-migration-20261022/`. The source
+PostgreSQL database and shared Valkey keys were left intact. After the new
+instance begins accepting writes, a rollback must first stop the Kubernetes
+server and ML pods with `./immich-storage-offline.sh`, then dump the *current*
+Kubernetes database and restore it to the preserved host PostgreSQL before
+starting Podman. The new database stores the media root as
+`/usr/src/app/upload`; the old Compose file mounts it at `/data`, so change that
+mount to `/usr/src/app/upload` when restoring the new database. Do not restore
+the pre-migration dump after new writes, because it would discard them. Keep
+the Ceph-backed PostgreSQL/Valkey volumes and `/mnt/Bilder` untouched until
+rollback is no longer needed.
diff --git a/apps/immich/resources/kustomization.yaml b/apps/immich/resources/kustomization.yaml
index 1268266..7088cae 100644
--- a/apps/immich/resources/kustomization.yaml
+++ b/apps/immich/resources/kustomization.yaml
@@ -4,3 +4,4 @@ resources:
 - alerts.yaml
 - dashboard.yaml
 - library-storage.yaml
+- routes.yaml
diff --git a/apps/immich/resources/routes.yaml b/apps/immich/resources/routes.yaml
new file mode 100644
index 0000000..052c58e
--- /dev/null
+++ b/apps/immich/resources/routes.yaml
@@ -0,0 +1,46 @@
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: immich-upload
+  namespace: immich
+spec:
+  forwardingTimeouts:
+    dialTimeout: 30s
+    responseHeaderTimeout: 3600s
+    readIdleTimeout: 3600s
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: immich
+  namespace: immich
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`immich.brunner.ninja`)
+      services:
+        - kind: Service
+          name: immich-server
+          port: http
+          passHostHeader: true
+          serversTransport: immich-upload
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: photos
+  namespace: immich
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`photos.brunner.ninja`)
+      services:
+        - kind: Service
+          name: immich-server
+          port: http
+          passHostHeader: true
+          serversTransport: immich-upload
diff --git a/apps/traefik/routes/_deleted/README.md b/apps/traefik/routes/_deleted/README.md
new file mode 100644
index 0000000..55e32c8
--- /dev/null
+++ b/apps/traefik/routes/_deleted/README.md
@@ -0,0 +1,2 @@
+Retired route/service definitions are kept here for reference only. This
+directory is intentionally outside the Traefik Argo CD directory source.
diff --git a/apps/traefik/routes/default-ingressroute-immich-brunner-ninja.json b/apps/traefik/routes/_deleted/default-ingressroute-immich-brunner-ninja.json
similarity index 100%
rename from apps/traefik/routes/default-ingressroute-immich-brunner-ninja.json
rename to apps/traefik/routes/_deleted/default-ingressroute-immich-brunner-ninja.json
diff --git a/apps/traefik/routes/default-ingressroute-photos-brunner-ninja.json b/apps/traefik/routes/_deleted/default-ingressroute-photos-brunner-ninja.json
similarity index 100%
rename from apps/traefik/routes/default-ingressroute-photos-brunner-ninja.json
rename to apps/traefik/routes/_deleted/default-ingressroute-photos-brunner-ninja.json
diff --git a/apps/traefik/routes/default-service-legacy-immich-service.json b/apps/traefik/routes/_deleted/default-service-legacy-immich-service.json
similarity index 100%
rename from apps/traefik/routes/default-service-legacy-immich-service.json
rename to apps/traefik/routes/_deleted/default-service-legacy-immich-service.json