Immich 1.95.0 → 1.96.0

1. Upgrade pgvecto.rs to stable version 0.2.0 for enhanced search

Step 1: Change the docker-compose.yml database image from 0.1.11 to 0.2.0

[...]

  database:
    container_name: immich_postgres
-   image: tensorchord/pgvecto-rs:pg14-v0.1.11@sha256:0335a1a22f8c5dd1b697f14f079934f5152eaaa216c09b61e293be285491f8ee 
+   image: tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
    volumes:
      - pgdata:/var/lib/postgresql/data
    restart: always

[...]

Step 2: Perform docker compose pull

Step 3:

a) If Immich is a Postgres superuser (default)

Bring the stack up with docker compose up

When the server starts up, it will log a message like this:

WARN [DatabaseService] Could not run vector reindexing checks. If the extension was updated, please restart the Postgres instance.

[image: warn]

This is normal. Continue to Step 4.

b) If Immich is not a Postgres superuser

If Immich doesn't have superuser permissions, you'll need to bring up the database and run a few commands manually:

BEGIN;

CREATE SCHEMA IF NOT EXISTS vectors;
ALTER DATABASE immich SET search_path TO "$user", public, vectors;
SET search_path TO "$user", public, vectors;

UPDATE pg_catalog.pg_extension SET extversion = '0.1.11' WHERE extname = 'vectors';
UPDATE pg_catalog.pg_extension SET extrelocatable = true WHERE extname = 'vectors';
ALTER EXTENSION vectors SET SCHEMA vectors;
UPDATE pg_catalog.pg_extension SET extrelocatable = false WHERE extname = 'vectors';
ALTER EXTENSION vectors UPDATE TO '0.2.0';

SELECT pgvectors_upgrade();

COMMIT;

Step 4: Terminate and restart the stack

Bring the stack down (or terminate with ctrl + c) with:

docker compose down

Then bring it back up:

docker compose up

You'll run into a message saying:

[DatabaseRepository] Could not reindex index face_index. Attempting to auto-fix.

[image: image]

This is normal. The server will do some magic and start to work.

Step 5: Enjoy the new ✨search enhancements✨

2. OAuth encryption algorithm setting changes

OAuth setups using HS256 (mainly Authentik) will need to either (1) update the signing algorithm in Immich or (2) specify a signing key in the provider settings (so that it uses RS256 instead).

Specify a signing key in Authentik:

Screencast from 02-02-2024 12:05:04 AM.webm

New Immich OAuth Setting

[image: image]

Background

RS256 is generally better than HS256. RS256 is pretty much the most commonly used algorithm. The client library we use for open-id defaults to RS256. It's very easy to setup Authentik without specifying a signing key, which will default to use HS256. The original implementation added a hack/fallback to HS256 in some conditions to try to handle that situation. The current code removes the fallback, and adds a specific Signing Algortithm setting which can be explicitly set. Alternatively, the issue could be fixed by specifying a signing key in Authentik.

References:

• https://auth0.com/blog/rs256-vs-hs256-whats-the-difference/