# PostgreSQL Deployment for Immich
# Requires PostgreSQL 16 with the VectorChord (vchord) extension. Immich 3.x
# dropped pgvecto.rs, so we run the official Immich Postgres image which bundles
# VectorChord *and* pgvecto.rs (the "vectors"/pgvectors extension). Keeping the
# -pgvectors0.3.0 variant is mandatory during/after migration: our data dir was
# created by pgvecto.rs 0.3.0, so vectors.so must stay loadable to (a) read the
# existing catalog and (b) satisfy Immich 3.0.1, which preloads BOTH vchord.so
# and vectors.so. The image's entrypoint sets shared_preload_libraries from its
# own template (vchord.so, vectors.so); our previous tensorchord image set it via
# a command-line arg (not persisted in PGDATA), so the swap starts clean.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: immich-postgres
  namespace: services
spec:
  replicas: 1
  # Recreate (not RollingUpdate) so the old pod is fully terminated before
  # the new one starts. The hostPath PV points at an NFS-backed directory
  # mounted on every r-node, so RWO is not actually enforced across nodes:
  # under RollingUpdate the new pod can start on a different node and grab
  # the same data dir while the old pod still holds postgres' file locks,
  # producing "could not write to file postmaster.pid: Unknown error 512".
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: immich-postgres
  template:
    metadata:
      labels:
        app: immich-postgres
    spec:
      initContainers:
      - name: nfs-check-data
        image: busybox:stable
        command:
        - sh
        - -c
        - |
          test -f /mnt/.nfs-sentinel || (
            echo "ERROR: NFS sentinel missing at /mnt/.nfs-sentinel"
            echo "refusing to start; node likely has NFS unmounted"
            echo "pod would otherwise bind-mount the local-XFS shadow"
            exit 1
          )
        volumeMounts:
        - name: postgres-data
          mountPath: /mnt
          readOnly: true
      containers:
      - name: postgres
        image: ghcr.io/immich-app/postgres:16-vectorchord0.4.3-pgvector0.8.0-pgvectors0.3.0
        ports:
        - containerPort: 5432
        env:
        - name: POSTGRES_DB
          value: immich
        - name: POSTGRES_USER
          value: immich
        - name: POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              name: immich-db-secret
              key: password
        resources:
          requests:
            cpu: 100m
            memory: 512Mi
          limits:
            memory: 2Gi
        livenessProbe:
          exec:
            command:
            - /bin/sh
            - -c
            # pg_isready only checks the TCP port; the NFS check catches stale
            # file handles on the data directory after an NFS server restart.
            - pg_isready -U immich -d immich && test -f /var/lib/postgresql/data/global/pg_filenode.map
          initialDelaySeconds: 60
          periodSeconds: 30
          timeoutSeconds: 10
          failureThreshold: 6
        readinessProbe:
          exec:
            command:
            - /bin/sh
            - -c
            - pg_isready -U immich -d immich
          initialDelaySeconds: 15
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 6
        volumeMounts:
        - name: postgres-data
          mountPath: /var/lib/postgresql/data
      volumes:
      - name: postgres-data
        persistentVolumeClaim:
          claimName: immich-postgres-pvc
---
apiVersion: v1
kind: Service
metadata:
  name: immich-postgres
  namespace: services
spec:
  selector:
    app: immich-postgres
  ports:
    - protocol: TCP
      port: 5432
      targetPort: 5432