1b18748f51
Add borgmatic backups for authentik and immich databases
...
Closes the gap where only miniflux and teslamate were backed up.
Authentik (blumeops-pg) just needed a config entry. Immich (immich-pg)
required a new borgmatic managed role, ExternalSecret, Tailscale
service, and Caddy L4 proxy on port 5433.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-27 16:52:41 -07:00
8621996343
Add Immich photo management + migrate forge URLs ( #62 )
...
## Summary
- Migrate all ArgoCD app repo URLs from `indri.tail8d86e.ts.net:2200` to `forge.ops.eblu.me:2222`
- Add Immich self-hosted photo management service with:
- Helm chart deployment via ArgoCD
- PostgreSQL cluster with pgvecto.rs for AI vector search (immich-pg)
- NFS storage on sifaka for photo library (2Ti)
- Tailscale Ingress + Caddy proxy for `photos.ops.eblu.me`
- Machine learning service for face/object recognition
## Deployment and Testing
- [x] Update ArgoCD repo-creds-forge secret with new URL (one-time manual step)
- [ ] Sync `apps` to pick up new applications
- [ ] Sync all existing apps to verify new forge URL works
- [ ] Sync `blumeops-pg` to deploy immich-pg cluster
- [ ] Wait for immich-pg to be healthy
- [ ] Create immich-db secret from auto-generated password
- [ ] Sync `immich-storage` (PV, PVC, Ingress)
- [ ] Sync `immich` (Helm chart)
- [ ] Run `mise run provision-indri -- --tags caddy` to add photos.ops.eblu.me
- [ ] Verify Immich UI is accessible
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/62
2026-01-26 11:20:11 -08:00
