fix OOMKilled containers: bump immich/actualbudget memory, disable changedetection, cap clickhouse

- immich-server: 512Mi/1Gi → 1700Mi/1700Mi (VPA upperBound 1.39Gi, 34 OOM restarts)
- actualbudget http-api: 384Mi → 768Mi (VPA upperBound 615Mi, 3 OOM restarts)
- changedetection: replicas 1 → 0 (chronic OOM at 64Mi, not worth memory cost)
- rybbit clickhouse: add ConfigMap capping max_server_memory_usage to 800Mi (within 1Gi limit)

stacks/actualbudget/factory/main.tf

@@ -149,10 +149,10 @@ resource "kubernetes_deployment" "actualbudget-http-api" {
           resources {
             requests = {
               cpu    = "50m"
-              memory = "384Mi"
+              memory = "768Mi"
             }
             limits = {
-              memory = "384Mi"
+              memory = "768Mi"
             }
           }
 

stacks/changedetection/main.tf

@@ -76,7 +76,8 @@ resource "kubernetes_deployment" "changedetection" {
     }
   }
   spec {
-    replicas = 1
+    # Disabled: chronic OOM at 64Mi limit, not worth the memory cost to increase
+    replicas = 0
     strategy {
       type = "Recreate"
     }

stacks/immich/main.tf

@@ -284,10 +284,10 @@ resource "kubernetes_deployment" "immich_server" {
           resources {
             requests = {
               cpu    = "100m"
-              memory = "512Mi"
+              memory = "1700Mi"
             }
             limits = {
-              memory = "1Gi"
+              memory = "1700Mi"
             }
           }
         }

stacks/rybbit/main.tf

@@ -70,6 +70,20 @@ module "nfs_clickhouse_data" {
   nfs_path   = "/mnt/main/clickhouse"
 }
 
+resource "kubernetes_config_map" "clickhouse_memory" {
+  metadata {
+    name      = "clickhouse-memory-config"
+    namespace = kubernetes_namespace.rybbit.metadata[0].name
+  }
+  data = {
+    "memory.xml" = <<-EOF
+      <clickhouse>
+          <max_server_memory_usage>838860800</max_server_memory_usage>
+      </clickhouse>
+    EOF
+  }
+}
+
 resource "kubernetes_deployment" "clickhouse" {
   metadata {
     name      = "clickhouse"
@@ -144,6 +158,11 @@ resource "kubernetes_deployment" "clickhouse" {
             name       = "data"
             mount_path = "/var/lib/clickhouse"
           }
+          volume_mount {
+            name       = "memory-config"
+            mount_path = "/etc/clickhouse-server/config.d/memory.xml"
+            sub_path   = "memory.xml"
+          }
           resources {
             requests = {
               cpu    = "500m"
@@ -160,6 +179,12 @@ resource "kubernetes_deployment" "clickhouse" {
             claim_name = module.nfs_clickhouse_data.claim_name
           }
         }
+        volume {
+          name = "memory-config"
+          config_map {
+            name = kubernetes_config_map.clickhouse_memory.metadata[0].name
+          }
+        }
       }
     }
   }