job "immich" {
  group "immich" {
    network {
      mode = "bridge"
      port "http" {
        to = 2283
      }
    }
    service {
      connect {
        sidecar_service {
          proxy {
            # TODO https://docs.immich.app/administration/postgres-standalone#prerequisites
            upstreams {
              destination_name = "postgres"
              local_bind_port  = 5432
            }
          }
        }
      }
    }

    task "immich-server" {
      driver = "docker"

      config {
        image = "ghcr.io/immich-app/immich-server:release"
        ports = ["http"]
      }

      service {
        name = "immich"
        port = "http"

        tags = [
          "traefik.enable=true",
          "traefik.http.routers.immich.middlewares=auth@file",
          "traefik.http.routers.immich-token.rule=Host(`c3ll7nbevl5j4j8rcnfxnr95q48fuayz-immich.othrayte.one`)",
        ]

        # Use the Immich server ping endpoint
        # See: https://api.immich.app/endpoints/server/pingServer
        check {
          name     = "alive"
          type     = "http"
          path     = "/api/server/ping"
          method   = "GET"
          port     = "http"
          interval = "10s"
          timeout  = "2s"
        }
      }

      env {
        IMMICH_LOG_LEVEL                 = "log"
        TZ                               = "Australia/Melbourne"
        REDIS_HOSTNAME                   = "localhost"
        DB_HOSTNAME                      = "localhost"
        IMMICH_IGNORE_MOUNT_CHECK_ERRORS = "true" # Let immich start whilst we figure out what's wrong with the mount permissions
      }

      volume_mount {
        volume      = "unraid_appdata_immich"
        destination = "/data"
        read_only   = false
      }

      volume_mount {
        volume      = "unraid_media_photosvideos"
        destination = "/data/library"
        read_only   = false
      }

      volume_mount {
        volume      = "unraid_media_immich_encodedvideo"
        destination = "/data/encoded-video"
        read_only   = false
      }

      volume_mount {
        volume      = "unraid_mediadump_photosvideos"
        destination = "/data/upload"
        read_only   = false
      }

      resources {
        cpu        = 200
        memory     = 512
        memory_max = 1500
      }

      template {
        data        = <<EOH
DB_USERNAME="immich"
DB_PASSWORD="{{ with nomadVar "nomad/jobs/immich" }}{{ .database_pw }}{{ end }}"
EOH
        destination = "secrets/db.env"
        env         = true # Load the file as environment variables
      }
    }

    volume "unraid_appdata_immich" {
      type            = "csi"
      read_only       = false
      source          = "unraid_appdata_immich"
      access_mode     = "single-node-writer"
      attachment_mode = "file-system"

      mount_options {
        mount_flags = ["uid=1000", "gid=1000"]
      }
    }

    volume "unraid_media_photosvideos" {
      type            = "csi"
      read_only       = false
      source          = "unraid_media_photosvideos"
      access_mode     = "single-node-writer"
      attachment_mode = "file-system"

      mount_options {
        mount_flags = ["uid=1000", "gid=1000"]
      }
    }

    volume "unraid_media_immich_encodedvideo" {
      type            = "csi"
      read_only       = false
      source          = "unraid_media_immich_encodedvideo"
      access_mode     = "single-node-writer"
      attachment_mode = "file-system"

      mount_options {
        mount_flags = ["uid=1000", "gid=1000"]
      }
    }

    volume "unraid_mediadump_photosvideos" {
      type            = "csi"
      read_only       = false
      source          = "unraid_mediadump_photosvideos"
      access_mode     = "single-node-writer"
      attachment_mode = "file-system"

      mount_options {
        mount_flags = ["uid=1000", "gid=1000"]
      }
    }

    task "immich-machine-learning" {
      driver = "docker"
      config {
        image = "ghcr.io/immich-app/immich-machine-learning:release"
      }

      resources {
        cpu        = 200
        memory     = 500
        memory_max = 2000
      }
    }

    task "redis" {
      driver = "docker"

      config {
        image = "docker.io/valkey/valkey:8-bookworm@sha256:fea8b3e67b15729d4bb70589eb03367bab9ad1ee89c876f54327fc7c6e618571"
      }

      resources {
        cpu        = 30
        memory     = 10
        memory_max = 50
      }
    }

    task "tailscale" {
      driver = "docker"

      config {
        image = "tailscale/tailscale:latest"
      }

      env = {
        TS_HOSTNAME   = "immich"
        TS_EXTRA_ARGS = "--advertise-tags=tag:nomad"
      }

      resources {
        cpu        = 100
        memory     = 100
        memory_max = 300
      }

      lifecycle {
        hook    = "prestart"
        sidecar = true
      }

      template {
        data        = <<EOH
TS_AUTHKEY="{{ with nomadVar "nomad/jobs/immich" }}{{ .tailscale_oauthsecret }}{{ end }}?ephemeral=true"
EOH
        destination = "secrets/ts_oauth.env"
        env         = true # Load the file as environment variables
      }
    }
  }
}