From 5e2f295ab8d9f9f81308ca52daa67241b03f900b Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sun, 2 Aug 2026 20:42:33 +0000
Subject: [PATCH 1/3] =?UTF-8?q?feat(container)!:=20Update=20immich=20monor?=
 =?UTF-8?q?epo=20(v2.7.5=20=E2=9E=94=20v3.1.0)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../apps/default/immich/machine-learning/helmrelease.yaml       | 2 +-
 kubernetes/apps/default/immich/server/helmrelease.yaml          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/kubernetes/apps/default/immich/machine-learning/helmrelease.yaml b/kubernetes/apps/default/immich/machine-learning/helmrelease.yaml
index a6f619b116..36698b39ce 100644
--- a/kubernetes/apps/default/immich/machine-learning/helmrelease.yaml
+++ b/kubernetes/apps/default/immich/machine-learning/helmrelease.yaml
@@ -21,7 +21,7 @@ spec:
           main:
             image:
               repository: ghcr.io/immich-app/immich-machine-learning
-              tag: v2.7.5@sha256:a2501141440f10516d329fdfba2c68082e19eb9ba6016c061ac80d23beadf7f3
+              tag: v3.1.0@sha256:5a0839dc5303cd7215bcd2180a26aed3af41675aefb3e75e5157e9f10ad16e6e
             resources:
               requests:
                 cpu: 15m
diff --git a/kubernetes/apps/default/immich/server/helmrelease.yaml b/kubernetes/apps/default/immich/server/helmrelease.yaml
index fc3701d713..f58f5c7e3d 100644
--- a/kubernetes/apps/default/immich/server/helmrelease.yaml
+++ b/kubernetes/apps/default/immich/server/helmrelease.yaml
@@ -34,7 +34,7 @@ spec:
           main:
             image:
               repository: ghcr.io/immich-app/immich-server
-              tag: v2.7.5@sha256:c15bff75068effb03f4355997d03dc7e0fc58720c2b54ad6f7f10d1bc57efaa5
+              tag: v3.1.0@sha256:b434cb9287eea1471c9974845914d4dd328c9c2d652e446ed4930f99944f0ceb
             resources:
               requests:
                 cpu: 100m

From 0c0561ecfe85425b9bdb38c4a70d6733d9300713 Mon Sep 17 00:00:00 2001
From: Tanguille <91473554+Tanguille@users.noreply.github.com>
Date: Fri, 7 Aug 2026 23:09:19 +0200
Subject: [PATCH 2/3] fix(crowdsec): whitelist successful jellyfin traffic from
 crawl detection

Jellyfin clients request dozens of unique /HomeScreen/CachedImage and
/Items/<id>/Images URIs per page load, tripping http-crawl-non_statics
(47 events in 3s, all HTTP 200) and banning the client for 24h.

Scoped to 2xx/3xx so scanners probing jellyfin still get counted.
---
 kubernetes/apps/security/crowdsec/app/helmrelease.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/kubernetes/apps/security/crowdsec/app/helmrelease.yaml b/kubernetes/apps/security/crowdsec/app/helmrelease.yaml
index eaf75dec00..d37c627762 100644
--- a/kubernetes/apps/security/crowdsec/app/helmrelease.yaml
+++ b/kubernetes/apps/security/crowdsec/app/helmrelease.yaml
@@ -65,6 +65,14 @@ spec:
               reason: "envoy bouncer response to already banned ips"
               expression:
                 - "evt.Meta.http_status == '418'"
+          jellyfin-crawl-whitelist.yaml: |-
+            name: hydaz/jellyfin-crawl-whitelist
+            description: "Jellyfin clients fan out to dozens of unique /HomeScreen/CachedImage URIs per page load, which reads as http-crawl-non_statics"
+            filter: "evt.Meta.service == 'http' && evt.Meta.log_type == 'http_access-log' && evt.Meta.target_fqdn == 'jellyfin.${SECRET_DOMAIN}'"
+            whitelist:
+              reason: "successful jellyfin api traffic"
+              expression:
+                - "evt.Meta.http_status startsWith '2' or evt.Meta.http_status startsWith '3'"
       config.yaml.local: |-
         api:
           server:

From 9d07ea5d5fbaec320782039cbe451f0fc81f7c38 Mon Sep 17 00:00:00 2001
From: Tanguille <91473554+Tanguille@users.noreply.github.com>
Date: Sat, 8 Aug 2026 15:19:40 +0200
Subject: [PATCH 3/3] fix(immich): drop dead IMMICH_WEB_URL and Typesense
 config

---
 kubernetes/apps/default/immich/server/configmap.yaml | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/kubernetes/apps/default/immich/server/configmap.yaml b/kubernetes/apps/default/immich/server/configmap.yaml
index 0cda6f708e..a04ac2540e 100644
--- a/kubernetes/apps/default/immich/server/configmap.yaml
+++ b/kubernetes/apps/default/immich/server/configmap.yaml
@@ -11,12 +11,7 @@ data:
   NODE_ENV: production
   REDIS_HOSTNAME: dragonfly.database.svc.cluster.local
   REDIS_PORT: "6379"
-  IMMICH_WEB_URL: http://immich-web.default.svc.cluster.local:3000
   IMMICH_SERVER_URL: http://immich-server.default.svc.cluster.local:3001
   IMMICH_MACHINE_LEARNING_URL: http://immich-machine-learning.default.svc.cluster.local:3003
-  TYPESENSE_HOST: immich-typesense.default.svc.cluster.local
-  TYPESENSE_PORT: "8108"
-  TYPESENSE_PROTOCOL: http
-  TYPESENSE_DATA_DIR: /config
   DB_VECTOR_EXTENSION: pgvector
   IMMICH_IGNORE_MOUNT_CHECK_ERRORS: "true"