---
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2beta1.json
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: &app immich-web
  namespace: default
spec:
  interval: 30m
  chart:
    spec:
      chart: app-template
      version: 2.0.3
      interval: 30m
      sourceRef:
        kind: HelmRepository
        name: bjw-s
        namespace: flux-system
  maxHistory: 2
  install:
    createNamespace: true
    remediation:
      retries: 3
  upgrade:
    cleanupOnFail: true
    remediation:
      retries: 3
  uninstall:
    keepHistory: false
  dependsOn:
    - name: immich-server
  values:
    defaultPodOptions:
      securityContext:
        runAsUser: 568
        runAsGroup: 568
        fsGroup: 568
        fsGroupChangePolicy: OnRootMismatch
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: *app
    controllers:
      main:
        strategy: RollingUpdate
        annotations:
          configmap.reloader.stakater.com/reload: &configMap immich-configmap
          secret.reloader.stakater.com/reload: &secret immich-secret
        containers:
          main:
            image:
              repository: ghcr.io/immich-app/immich-web
              tag: v1.84.0
            envFrom:
              - configMapRef:
                  name: *configMap
              - secretRef:
                  name: *secret
            resources:
              requests:
                cpu: 100m
                memory: 250Mi
    service:
      main:
        ports:
          http:
            port: 3000
    ingress:
      main:
        enabled: true
        className: nginx
        annotations:
          external-dns.home.arpa/enabled: "true"
          hajimari.io/appName: Immich
          nginx.ingress.kubernetes.io/configuration-snippet: |
            rewrite /api/(.*) /$1 break;
            set $forwarded_client_ip "";
            if ($http_x_forwarded_for ~ "^([^,]+)") {
              set $forwarded_client_ip $1;
            }
            set $client_ip $remote_addr;
            if ($forwarded_client_ip != "") {
              set $client_ip $forwarded_client_ip;
            }
          nignx.ingress.kubernetes.io/force-ssl-redirect: "true"
          nginx.ingress.kubernetes.io/proxy-body-size: "0"
          nginx.ingress.kubernetes.io/upstream-hash-by: "$client_ip"
        hosts:
          - host: &host photos.${SECRET_CLUSTER_DOMAIN}
            paths:
              - path: /
                service:
                  name: main
                  port: http
              - path: /api
                service:
                  name: immich-server
                  port: 3001
        tls:
          - hosts:
              - *host