immich/variables.yml

---

immich:

  # Name of this instance of immich
  instance: immich

  # Immich version
  version: v1.89.0

  # API server settings
  server:

    # Docker image to use
    image: ghcr.io/immich-app/immich-server:[[ .immich.version ]]

    # Additional env to set ni the container
    env:
      DB_URL: '{{ with secret "[[ .vault.prefix ]]database/creds/[[ .immich.instance ]]" }}postgres://{{ .Data.username }}:{{ urlquery .Data.password }}@localhost:5432/[[ .immich.instance ]]{{ end }}'
      TYPESENSE_API_KEY: '{{ with secret "[[ .vault.prefix ]]kv/service/[[ .immich.instance ]]" }}{{ .Data.data.typesense_api_key }}{{ end }}'
      NODE_OPTIONS: --max_old_space_size={{ env "NOMAD_MEMORY_LIMIT" | parseInt | divide 2 }}

    # Resource allocation
    resources:
      cpu: 300
      memory: 320

    # Wait for services to be ready before starting
    wait_for:
      - service: master.postgres[[ .consul.suffix ]]
      - service: '[[ .immich.instance ]]-ml[[ .consul.suffix ]]'

    consul:
      connect:
        # Connect to some services through the mesh
        upstreams:
          - destination_name: '[[ .immich.instance ]]-ml[[ .consul.suffix ]]'
            local_bind_port: 3003
          - destination_name: postgres[[ .consul.suffix ]]
            local_bind_port: 5432

    # The URL where Immich will be exposed to users
    public_url: https://immich.example.org

    # Controls how Traefik will expose the service
    traefik:
      enabled: true

      # Immich needs a specific CSP
      csp:
        default-src: "'self'"
        img-src: "'self' data: blob:"
        script-src: "'self' 'unsafe-inline' 'unsafe-eval'"
        style-src: "'self' 'unsafe-inline'"
        font-src: "'self' data:"
        worker-src: "'self' blob:"
        connect-src: "'self' https://maputnik.github.io https://*.cofractal.com https://fonts.openmaptiles.org"

      # Override the list of base middlewares as we need to remove csp-relaxed and rate-limits
      base_middlewares:
        - security-headers@file
        - hsts@file
        - compression@file
      middlewares: []

    # Use distinct Traefik settings for /share. This can be used for example to restrict the main app to trusted IP but allow /share from anywhere
    share:
      traefik:
        base_middlewares:
          - security-headers@file
          - hsts@file
          - compression@file
        middlewares: []

  # The microservices do the bulk of media handling (thumbnails etc.)
  microservices:

    # Docker image to use
    image: ghcr.io/immich-app/immich-server:[[ .immich.version ]]

    # Env vars to set in the container
    env:
      DB_URL: '{{ with secret "[[ .vault.prefix ]]database/creds/[[ .immich.instance ]]" }}postgres://{{ .Data.username }}:{{ urlquery .Data.password }}@localhost:5432/[[ .immich.instance ]]{{ end }}'
      TYPESENSE_API_KEY: '{{ with secret "[[ .vault.prefix ]]kv/service/[[ .immich.instance ]]" }}{{ .Data.data.typesense_api_key }}{{ end }}'
      NODE_OPTIONS: --max_old_space_size={{ env "NOMAD_MEMORY_LIMIT" | parseInt | divide 2 }}

    # Resource allocation
    resources:
      cpu: 500
      memory: 768

  # The machine learning
  machine_learning:

    # Machine learning is optional, and can be disabled
    enabled: true

    # The Docker image to use
    image: ghcr.io/immich-app/immich-machine-learning:[[ .immich.version ]]

    # Environment var to set in the container
    env: {}

    # Resource allocation
    resources:
      cpu: 1024
      memory: 1536

  # Typesense is a database for fast search result
  typesense:

    # Typesense is also an optional component and can be disabled
    enabled: true

    # DOcker image to use
    image: typesense/typesense:0.25.1

    # Environment var to set in the container
    env:
      TYPESENSE_API_KEY: '{{ with secret "[[ .vault.prefix ]]kv/service/[[ .immich.instance ]]" }}{{ .Data.data.typesense_api_key }}{{ end }}'

    # Resource allocation
    resources:
      cpu: 100
      memory: 512
      memory_max: 768

  # Redis task will use a common template
  # We just set custom resources allocation
  redis:
    resources:
      cpu: 20
      memory: 64

  # Volumes used for data persistance
  volumes:
    data:
      type: csi
      source: '[[ .immich.instance ]]-data'

    ml:
      type: csi
      source: '[[ .immich.instance ]]-ml'

    typesense:
      type: csi
      source: '[[ .immich.instance ]]-typesense'