immich: add Immich photo-frame for Emo's Portal (highlights-immich-emo)

Second ImmichFrame instance cloned from the London frame (frame.tf), scoped to Emo's Immich account (emil.barzin) with Sofia weather coords and last-2-years photos. Drives Emo's Meta Portal Mini in Sofia via the portal-immich-frame app. Dedicated API key minted on Emo's account and stored in Vault (secret/immich -> frame_api_key_emo).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/immich/frame-emo.tf

@@ -0,0 +1,155 @@
+# Immich photo-frame for Emo (emil.barzin@gmail.com) — a second instance cloned
+# from the London frame in frame.tf, scoped to Emo's Immich account + Sofia
+# weather. Served at highlights-immich-emo.viktorbarzin.me and shown on Emo's
+# Portal Mini (Sofia) via the portal-immich-frame app.
+# API key: Vault secret/immich -> frame_api_key_emo (minted on Emo's account).
+
+resource "kubernetes_config_map" "frame_config_emo" {
+  metadata {
+    name      = "config-emo"
+    namespace = "immich"
+
+    labels = {
+      app = "frame-config-emo"
+    }
+    annotations = {
+      "reloader.stakater.com/match" = "true"
+    }
+  }
+
+  data = {
+    "Settings.yml" = <<-EOF
+    General:
+        Layout: single
+        Interval: 30
+        ImageZoom: true
+        ShowAlbumName: false
+        ShowProgressBar: false
+        ClockFormat: "HH:mm"
+        PhotoDateFormat: "dd/MM/yyyy"
+        WeatherApiKey: ${data.vault_kv_secret_v2.secrets.data["frame_weather_api_key"]}
+        UnitSystem: metric
+        WeatherLatLong: "42.6977,23.3219"
+        Language: en
+    Accounts:
+        - ImmichServerUrl: http://immich.viktorbarzin.me
+          ApiKey: ${data.vault_kv_secret_v2.secrets.data["frame_api_key_emo"]}
+          ImagesFromDays: 730
+    EOF
+  }
+}
+
+
+resource "kubernetes_deployment" "immich-frame-emo" {
+  metadata {
+    name      = "immich-frame-emo"
+    namespace = "immich"
+    annotations = {
+      "reloader.stakater.com/search" = "true"
+    }
+    labels = {
+      tier = local.tiers.gpu
+    }
+  }
+
+  spec {
+    replicas = 1
+    selector {
+      match_labels = {
+        app = "immich-frame-emo"
+      }
+    }
+    strategy {
+      type = "RollingUpdate"
+    }
+    template {
+      metadata {
+        labels = {
+          app = "immich-frame-emo"
+        }
+        annotations = {
+          "dependency.kyverno.io/wait-for" = "immich-server.immich:2283"
+        }
+      }
+      spec {
+        container {
+          image = "ghcr.io/immichframe/immichframe:v1.0.32.0"
+          name  = "immich-frame-emo"
+          resources {
+            requests = {
+              cpu    = "10m"
+              memory = "64Mi"
+            }
+            limits = {
+              memory = "128Mi"
+            }
+          }
+          port {
+            container_port = 8080
+            protocol       = "TCP"
+            name           = "http"
+          }
+          volume_mount {
+            name       = "config"
+            mount_path = "/app/Config"
+            read_only  = true
+          }
+        }
+        volume {
+          name = "config"
+          config_map {
+            name = "config-emo"
+          }
+        }
+      }
+    }
+  }
+  lifecycle {
+    ignore_changes = [
+      spec[0].template[0].spec[0].dns_config, # KYVERNO_LIFECYCLE_V1
+      metadata[0].annotations["keel.sh/policy"],
+      metadata[0].annotations["keel.sh/trigger"],
+      metadata[0].annotations["keel.sh/pollSchedule"], # KYVERNO_LIFECYCLE_V2
+      metadata[0].annotations["keel.sh/match-tag"],
+      metadata[0].annotations["kubernetes.io/change-cause"],
+      metadata[0].annotations["deployment.kubernetes.io/revision"],
+      spec[0].template[0].metadata[0].annotations["keel.sh/update-time"], # KEEL_LIFECYCLE_V1
+      spec[0].template[0].spec[0].container[0].image,                     # KEEL_IGNORE_IMAGE
+    ]
+  }
+}
+
+
+resource "kubernetes_service" "immich-frame-emo" {
+  metadata {
+    name      = "immich-frame-emo"
+    namespace = "immich"
+    labels = {
+      "app" = "immich-frame-emo"
+    }
+  }
+
+  spec {
+    selector = {
+      app = "immich-frame-emo"
+    }
+    port {
+      port        = 80
+      target_port = 8080
+    }
+  }
+}
+
+module "ingress_emo" {
+  source = "../../modules/kubernetes/ingress_factory"
+  # Photo-frame kiosk display on Emo's Portal — headless browser pulling images
+  # via an Immich API key (no user login). Forward-auth would 302 the device to
+  # Authentik with no way to complete login.
+  # auth = "none": photo-frame kiosk; headless browser with API key; no user login.
+  auth            = "none"
+  dns_type        = "proxied"
+  namespace       = "immich"
+  name            = "highlights-immich-emo"
+  tls_secret_name = var.tls_secret_name
+  service_name    = "immich-frame-emo"
+}