jishushell 0.6.5 → 0.7.3

package/apps/immich-container-lite.yaml

@@ -0,0 +1,337 @@
+id: immich-container-lite
+name: Immich Lite
+version: "1.0.2"
+jishushell:
+  min_version: "0.5.15"
+description: "Self-hosted photo and video backup/gallery without the machine-learning sidecar for low-memory devices."
+singleInstance: true
+
+# Low-memory variant of immich-container.yaml.
+# Differences from the full Immich AppSpec:
+# - omits immich-machine-learning and model-cache
+# - keeps database, redis, immich-server, and the same Immich Web UI provide
+# - intended for 4GB Raspberry Pi style testing where the full stack may stay pending
+
+network:
+  mode: docker-bridge
+  name: "jishushell-${instance.id}"
+
+tasks:
+  - name: database
+    role: sidecar
+    runtime: container
+    image: "ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23"
+    user: "0:0"
+    cap_add: ["CHOWN", "FOWNER", "DAC_OVERRIDE", "SETUID", "SETGID", "SETPCAP"]
+    env:
+      POSTGRES_PASSWORD: "postgres"
+      POSTGRES_USER: "postgres"
+      POSTGRES_DB: "immich"
+      POSTGRES_INITDB_ARGS: "--data-checksums"
+    resources:
+      cpu: "700m"
+      memory: "1024Mi"
+    ports:
+      - name: pg
+        port: 5432
+        visibility: internal
+    volumes:
+      - source: "~/.jishushell/apps/${instance.id}/postgres"
+        target: "/var/lib/postgresql/data"
+
+  - name: redis
+    role: sidecar
+    runtime: container
+    image: "docker.io/valkey/valkey:9@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9"
+    user: "0:0"
+    cap_add: ["CHOWN", "SETUID", "SETGID"]
+    resources:
+      cpu: "100m"
+      memory: "128Mi"
+    ports:
+      - name: redis
+        port: 6379
+        visibility: internal
+
+  - name: immich-server
+    role: service
+    runtime: container
+    image: "ghcr.io/immich-app/immich-server:v2"
+    user: "0:0"
+    cap_add: ["CHOWN", "FOWNER", "DAC_OVERRIDE", "SETUID", "SETGID", "SETPCAP", "NET_BIND_SERVICE"]
+    env:
+      UPLOAD_LOCATION: "./library"
+      DB_DATA_LOCATION: "./postgres"
+      TZ: "Asia/Shanghai"
+      IMMICH_VERSION: "v2"
+      DB_PASSWORD: "postgres"
+      DB_USERNAME: "postgres"
+      DB_DATABASE_NAME: "immich"
+    resources:
+      cpu: "1200m"
+      memory: "1536Mi"
+    ports:
+      - name: http
+        port: 2283
+        container_port: 2283
+        visibility: external
+    volumes:
+      - source: "~/.jishushell/apps/${instance.id}/library"
+        target: "/data"
+      - source: "~/.jishushell/files/photos/library"
+        target: "/external/photos"
+        readonly: true
+      - source: "/etc/localtime"
+        target: "/etc/localtime"
+        readonly: true
+    health:
+      http:
+        path: /api/server/ping
+        port: 2283
+      interval: "15s"
+      timeout: "5s"
+      retries: 8
+      start_period: "120s"
+
+provides:
+  - capability: "ui-immich"
+    kind: ui
+    interface: web-ui
+    task: "immich-server"
+    port: 2283
+    endpoint:
+      portName: http
+    path: "/"
+    protocol: "http"
+    visibility: "external"
+    embedded: "direct"
+    description: "Immich Web UI"
+
+lifecycle:
+  install:
+    - downloadImage: "docker.io/valkey/valkey:9@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9"
+    - downloadImage: "ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23"
+    - downloadImage: "ghcr.io/immich-app/immich-server:v2"
+      timeout_ms: 1800000
+      idle_timeout_ms: 1800000
+    - mkdir: "~/.jishushell/apps/${instance.id}/library"
+    - mkdir: "~/.jishushell/apps/${instance.id}/postgres"
+
+  post_start:
+    - run: |
+        set -eu
+
+        STATE_DIR="$HOME/.jishushell/apps/${instance.id}"
+        ENV_FILE="$STATE_DIR/.env"
+        mkdir -p "$STATE_DIR"
+        touch "$ENV_FILE"
+        chmod 600 "$ENV_FILE"
+
+        read_env() {
+          awk -F= -v key="$1" '$1 == key { value = substr($0, length(key) + 2) } END { if (value != "") print value }' "$ENV_FILE" 2>/dev/null || true
+        }
+
+        upsert_env() {
+          key="$1"
+          value="$2"
+          tmp="${ENV_FILE}.tmp"
+          awk -v key="$key" -v value="$value" '
+            BEGIN { updated = 0 }
+            index($0, key "=") == 1 { print key "=" value; updated = 1; next }
+            { print }
+            END { if (!updated) print key "=" value }
+          ' "$ENV_FILE" > "$tmp"
+          chmod 600 "$tmp"
+          mv "$tmp" "$ENV_FILE"
+        }
+
+        sync_openclaw() {
+          if [ -n "${JISHUSHELL_CORE_URL:-}" ] && [ -n "${JISHUSHELL_INTERNAL_TOKEN:-}" ]; then
+            curl -fsS -X POST \
+              -H "X-Jishushell-Internal-Token: $JISHUSHELL_INTERNAL_TOKEN" \
+              -H "X-Jishushell-Instance: ${instance.id}" \
+              "$JISHUSHELL_CORE_URL/api/integrations/immich/internal/sync-openclaw" >/dev/null || true
+          fi
+        }
+
+        IMMICH_API_KEY="$(read_env IMMICH_API_KEY)"
+        if [ -n "$IMMICH_API_KEY" ]; then
+          sync_openclaw
+          exit 0
+        fi
+
+        IMMICH_ADMIN_EMAIL="$(read_env IMMICH_ADMIN_EMAIL)"
+        if [ -z "$IMMICH_ADMIN_EMAIL" ]; then
+          IMMICH_ADMIN_EMAIL="admin@jishushell.local"
+          upsert_env IMMICH_ADMIN_EMAIL "$IMMICH_ADMIN_EMAIL"
+        fi
+
+        IMMICH_ADMIN_PASSWORD="$(read_env IMMICH_ADMIN_PASSWORD)"
+        if [ -z "$IMMICH_ADMIN_PASSWORD" ]; then
+          IMMICH_ADMIN_PASSWORD="JishuShell@2026"
+          upsert_env IMMICH_ADMIN_PASSWORD "$IMMICH_ADMIN_PASSWORD"
+        fi
+
+        find_immich_container() {
+          docker ps \
+            --format '{{.ID}}\t{{.Names}}\t{{.Label "com.hashicorp.nomad.job_name"}}\t{{.Label "com.hashicorp.nomad.task_name"}}' \
+            | awk -F '\t' -v instance="${instance.id}" '
+              $4 == "immich-server" && ($3 == instance || $3 == "jishushell-" instance) {
+                print $1;
+                found = 1;
+                exit;
+              }
+              $4 == "immich-server" && index($2, instance) > 0 { label_fallback = $1 }
+              $2 == "immich-server" || index($2, "immich-server-") == 1 { name_fallback = $1 }
+              END {
+                if (!found) {
+                  if (label_fallback) print label_fallback;
+                  else if (name_fallback) print name_fallback;
+                }
+              }
+            '
+        }
+
+        CONTAINER_ID=""
+        for attempt in $(seq 1 120); do
+          CONTAINER_ID="$(find_immich_container | head -n 1)"
+          if [ -n "$CONTAINER_ID" ]; then
+            break
+          fi
+          sleep 2
+        done
+        if [ -z "$CONTAINER_ID" ]; then
+          echo "immich-server container is not running" >&2
+          exit 1
+        fi
+
+        IMMICH_API_KEY="$(docker exec -i \
+          -e IMMICH_BOOTSTRAP_EMAIL="$IMMICH_ADMIN_EMAIL" \
+          -e IMMICH_BOOTSTRAP_PASSWORD="$IMMICH_ADMIN_PASSWORD" \
+          "$CONTAINER_ID" node - <<'NODE'
+        const baseUrl = "http://127.0.0.1:2283/api";
+        const email = process.env.IMMICH_BOOTSTRAP_EMAIL;
+        const password = process.env.IMMICH_BOOTSTRAP_PASSWORD;
+
+        const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+        function fatal(message) {
+          const error = new Error(message);
+          error.fatal = true;
+          throw error;
+        }
+
+        async function request(path, options = {}) {
+          const response = await fetch(`${baseUrl}${path}`, {
+            ...options,
+            headers: {
+              accept: "application/json",
+              "content-type": "application/json",
+              ...(options.headers ?? {}),
+            },
+          });
+          const text = await response.text();
+          let body = null;
+          if (text) {
+            try {
+              body = JSON.parse(text);
+            } catch {
+              body = null;
+            }
+          }
+          return { response, body, text };
+        }
+
+        async function login() {
+          const result = await request("/auth/login", {
+            method: "POST",
+            body: JSON.stringify({ email, password }),
+          });
+          if (result.response.ok && result.body?.accessToken) {
+            return result.body.accessToken;
+          }
+          return null;
+        }
+
+        async function bootstrap() {
+          let lastError = "Immich API is not ready";
+          for (let attempt = 0; attempt < 150; attempt += 1) {
+            try {
+              const ping = await request("/server/ping", { method: "GET" });
+              if (!ping.response.ok) {
+                lastError = `ping failed: HTTP ${ping.response.status} ${ping.text}`;
+                await sleep(2000);
+                continue;
+              }
+
+              let accessToken = await login();
+              if (!accessToken) {
+                const signUp = await request("/auth/admin-sign-up", {
+                  method: "POST",
+                  body: JSON.stringify({ email, password, name: "JishuShell" }),
+                });
+                if (signUp.response.status === 400 || signUp.response.status === 409) {
+                  fatal("Immich is already initialized and the stored JishuShell admin credentials did not work; set IMMICH_ADMIN_EMAIL/IMMICH_ADMIN_PASSWORD or IMMICH_API_KEY in the instance .env file");
+                }
+                if (!signUp.response.ok) {
+                  lastError = `admin sign-up failed: HTTP ${signUp.response.status} ${signUp.text}`;
+                  await sleep(2000);
+                  continue;
+                }
+                accessToken = await login();
+              }
+
+              if (!accessToken) {
+                throw new Error("unable to log in with the stored Immich admin credentials");
+              }
+
+              const apiKey = await request("/api-keys", {
+                method: "POST",
+                headers: { Authorization: `Bearer ${accessToken}` },
+                body: JSON.stringify({ name: "JishuShell", permissions: ["all"] }),
+              });
+              if (!apiKey.response.ok) {
+                throw new Error(`API key creation failed: HTTP ${apiKey.response.status} ${apiKey.text}`);
+              }
+              if (!apiKey.body?.secret) {
+                throw new Error("API key creation response did not include a secret");
+              }
+              console.log(apiKey.body.secret);
+              return;
+            } catch (error) {
+              if (error?.fatal) {
+                throw error;
+              }
+              lastError = error instanceof Error ? error.message : String(error);
+              await sleep(2000);
+            }
+          }
+          throw new Error(lastError);
+        }
+
+        bootstrap().catch((error) => {
+          console.error(error instanceof Error ? error.message : String(error));
+          process.exit(1);
+        });
+        NODE
+        )"
+
+        if [ -z "$IMMICH_API_KEY" ]; then
+          echo "Immich API key generation returned an empty secret" >&2
+          exit 1
+        fi
+        upsert_env IMMICH_API_KEY "$IMMICH_API_KEY"
+        sync_openclaw
+      timeout_ms: 420000
+
+  uninstall:
+    - run: >-
+        rm -rf
+        "$HOME/.jishushell/apps/${instance.id}/.env"
+        "$HOME/.jishushell/apps/${instance.id}/library"
+        "$HOME/.jishushell/apps/${instance.id}/postgres"
+      sudo: true
+      timeout_ms: 1800000
+    - deleteImage: "ghcr.io/immich-app/immich-server:v2"
+    - deleteImage: "ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23"
+    - deleteImage: "docker.io/valkey/valkey:9@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9"