Clément Désiles
5efc0b0d6e
certbot cannot issue for internal hostnames (*.nas.local), which made nginx-enabled services with internal names fail on deploy. Add a <service>_nginx_letsencrypt flag (default false) and computed <service>_nginx_ssl_certificate/_key paths: when off the vhost uses the shared self-signed cert (nginx_default_ssl_cert), when on it uses the Let's Encrypt lineage. Gate the certbot include on the flag and apply the pattern to all service roles (deluge, fdroid, gitea, grafana, immich, metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
Immich Role
This Ansible role deploys Immich - a high performance self-hosted photo and video management solution - using Podman with k8s files.
Prerequisites
The podman, postgres, valkey, and nginx roles must have been applied to the host first (they are shared services, intentionally not declared in meta/main.yml to keep immich deploys fast). Order them before immich in the playbook for fresh installs.
Role Variables
See defaults/main.yml for all available variables and their default values.
Required Passwords
Both passwords must be set in your inventory (min 12 characters):
immich_postgres_password- PostgreSQL database passwordimmich_valkey_password- Valkey/Redis password
External Libraries
Mount host paths read-only into the server container via immich_external_libraries,
then add the in-container mount_path in the Immich UI
(Administration → External Libraries). The {{ ansible_user }} running the rootless
pod must have read access on the host path.
Troubleshooting
Valkey ACL Issues
Test Immich user credentials:
valkey-cli
AUTH immich <immich_valkey_password>
SELECT 0
PING
# Should return PONG
# Try a restricted command (should fail)
FLUSHDB
# Should return: (error) NOPERM
Going further: Immich GitHub Discussion #19727