Clément Désiles
556fae86d9
'Writing manifest' is printed by podman pull on stderr (not stdout), so changed_when never matched, the Restart Immich handler never fired, and pods kept running the old image after upgrades. Matching on stderr would be wrong too: podman prints that line even when the image is unchanged. Compare the local image ID before/after pull instead, and notify the restart handler only when the tag resolves to a new image.
Immich Role
This Ansible role deploys Immich - a high performance self-hosted photo and video management solution - using Podman with k8s files.
Role Variables
See defaults/main.yml for all available variables and their default values.
Required Passwords
Both passwords must be set in your inventory (min 12 characters):
immich_postgres_password- PostgreSQL database passwordimmich_valkey_password- Valkey/Redis password
External Libraries
Mount host paths read-only into the server container via immich_external_libraries,
then add the in-container mount_path in the Immich UI
(Administration → External Libraries). The {{ ansible_user }} running the rootless
pod must have read access on the host path.
Troubleshooting
Valkey ACL Issues
Test Immich user credentials:
valkey-cli
AUTH immich <immich_valkey_password>
SELECT 0
PING
# Should return PONG
# Try a restricted command (should fail)
FLUSHDB
# Should return: (error) NOPERM
Going further: Immich GitHub Discussion #19727