Route Immich through its Argo-managed service

apps/immich/README.md

@@ -31,3 +31,16 @@ Immich-owned are imported, leaving all other applications' keys untouched.
 The old Podman stack and host PostgreSQL must remain available as rollback
 sources until the new application, database, monitoring, and routes have been
 verified. Never run both Immich servers against `/mnt/Bilder` concurrently.
+
+The migration dumps are retained with mode `0600` under
+`/home/feedc0de/immich-app/backups/k8s-migration-20261022/`. The source
+PostgreSQL database and shared Valkey keys were left intact. After the new
+instance begins accepting writes, a rollback must first stop the Kubernetes
+server and ML pods with `./immich-storage-offline.sh`, then dump the *current*
+Kubernetes database and restore it to the preserved host PostgreSQL before
+starting Podman. The new database stores the media root as
+`/usr/src/app/upload`; the old Compose file mounts it at `/data`, so change that
+mount to `/usr/src/app/upload` when restoring the new database. Do not restore
+the pre-migration dump after new writes, because it would discard them. Keep
+the Ceph-backed PostgreSQL/Valkey volumes and `/mnt/Bilder` untouched until
+rollback is no longer needed.

apps/immich/resources/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
 - alerts.yaml
 - dashboard.yaml
 - library-storage.yaml
+- routes.yaml

apps/immich/resources/routes.yaml

@@ -0,0 +1,46 @@
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: immich-upload
+  namespace: immich
+spec:
+  forwardingTimeouts:
+    dialTimeout: 30s
+    responseHeaderTimeout: 3600s
+    readIdleTimeout: 3600s
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: immich
+  namespace: immich
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`immich.brunner.ninja`)
+      services:
+        - kind: Service
+          name: immich-server
+          port: http
+          passHostHeader: true
+          serversTransport: immich-upload
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: photos
+  namespace: immich
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`photos.brunner.ninja`)
+      services:
+        - kind: Service
+          name: immich-server
+          port: http
+          passHostHeader: true
+          serversTransport: immich-upload

apps/traefik/routes/_deleted/README.md

@@ -0,0 +1,2 @@
+Retired route/service definitions are kept here for reference only. This
+directory is intentionally outside the Traefik Argo CD directory source.