C1(valkey-mirror): swap paperless and immich to local valkey

Switches paperless redis sidecar and immich-valkey to the locally-built
registry.ops.eblu.me/blumeops/valkey image. Sidecars are stateless
(paperless: no PV, immich: emptyDir cache) so this is a clean tag swap.

Drops the DR-2026-04 TODO in paperless about multi-arch redis — resolved
by this mirror.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

argocd/manifests/immich/kustomization.yaml

@@ -19,4 +19,5 @@ images:
   - name: ghcr.io/immich-app/immich-machine-learning
     newTag: v2.6.3
   - name: docker.io/valkey/valkey
-    newTag: "8.1-alpine"
+    newName: registry.ops.eblu.me/blumeops/valkey
+    newTag: v8.1.6-r0-946fa75

argocd/manifests/paperless/kustomization.yaml

@@ -14,9 +14,6 @@ resources:
 images:
   - name: registry.ops.eblu.me/blumeops/paperless
     newTag: v2.20.13-07f52e9
-  # TODO(DR-2026-04): authentik-redis is amd64-only (nix-built on ringtail).
-  # Was running under QEMU emulation before. Switched to upstream valkey
-  # during DR recovery. Build a multi-arch blumeops/redis or keep upstream.
   - name: docker.io/library/redis
-    newName: docker.io/valkey/valkey
+    newName: registry.ops.eblu.me/blumeops/valkey
-    newTag: "8.1-alpine"
+    newTag: v8.1.6-r0-946fa75

containers/valkey/container.py

@@ -0,0 +1,47 @@
+"""Valkey — native Dagger build.
+
+Alpine 3.22 base with the `valkey` apk package (8.1.x — Redis-compatible).
+Mirrors `docker.io/valkey/valkey:8.1-alpine`, used by paperless and immich
+as a cache/queue sidecar.
+"""
+
+import dagger
+from dagger import dag
+
+from blumeops.containers import oci_labels
+
+# Alpine 3.22 ships valkey 8.1.6-r0. Alpine 3.23 jumps to 9.0 — hold on 3.22
+# to keep this a 1:1 swap for the upstream `valkey:8.1-alpine` image.
+VERSION = "8.1.6-r0"
+
+ALPINE_BASE = "alpine:3.22"
+
+
+async def build(src: dagger.Directory) -> dagger.Container:
+    ctr = (
+        dag.container()
+        .from_(ALPINE_BASE)
+        .with_exec(["apk", "add", "--no-cache", f"valkey={VERSION}"])
+        .with_exec(["mkdir", "-p", "/data"])
+        .with_exec(["chown", "valkey:valkey", "/data"])
+        .with_workdir("/data")
+        .with_exposed_port(6379)
+        .with_user("valkey")
+        .with_default_args(
+            args=[
+                "valkey-server",
+                "--bind",
+                "0.0.0.0",
+                "--protected-mode",
+                "no",
+                "--dir",
+                "/data",
+            ]
+        )
+    )
+    return oci_labels(
+        ctr,
+        title="Valkey",
+        description="Valkey high-performance key/value datastore (Redis-compatible)",
+        version=VERSION,
+    )

docs/changelog.d/valkey-mirror.infra.md

@@ -0,0 +1 @@
+Mirror Valkey 8.1 locally as `registry.ops.eblu.me/blumeops/valkey`. Replaces direct pulls of `docker.io/valkey/valkey:8.1-alpine` for paperless and immich sidecars. Built via native Dagger pipeline on Alpine 3.22. Stateless swap — no data migration. Authentik's nix-built Redis remains separate.

service-versions.yaml

@@ -125,6 +125,18 @@ services:
     upstream-source: https://github.com/immich-app/immich/releases
     notes: Kustomize manifests with upstream images
 
+  - name: valkey
+    type: argocd
+    last-reviewed: 2026-05-01
+    current-version: "8.1.6-r0"
+    upstream-source: https://pkgs.alpinelinux.org/package/v3.22/community/aarch64/valkey
+    notes: >-
+      Shared Alpine-built valkey image, used as a sidecar/cache by paperless
+      (sidecar) and immich (separate Deployment). Mirrors the upstream
+      docker.io/valkey/valkey:8.1-alpine. Pinned to Alpine 3.22 for valkey 8.1.x;
+      Alpine 3.23 jumps to 9.0. Distinct from authentik-redis (nix-built Redis
+      8.x) which has its own entry.
+
   - name: external-secrets
     type: argocd
     last-reviewed: 2026-03-25