diff --git a/immich.yaml b/immich.yaml
new file mode 100644
index 0000000..da9733b
--- /dev/null
+++ b/immich.yaml
@@ -0,0 +1,163 @@
+#
+# Swarm-adapted version of the official Immich docker-compose.yml
+# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
+#
+# Pattern B: no env_file — non-secret vars inlined, secrets (DB_PASSWORD,
+# IMMICH_KIOSK_BASICAUTH) remain in host immich.env on the swarm manager.
+#
+
+services:
+  immich-server:
+    hostname: immich
+    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
+    volumes:
+      - ${UPLOAD_LOCATION}:/data
+      - /etc/localtime:/etc/localtime:ro
+      - ${BULK_UPLOAD_LOCATION}:/bulk-upload
+    networks:
+      - traefik_backend
+      - postgresql_db-backend
+    environment:
+      REDIS_HOSTNAME: ${REDIS_HOSTNAME}
+      REDIS_PORT: ${REDIS_PORT}
+      REDIS_DBINDEX: ${REDIS_DBINDEX}
+      DB_PASSWORD: ${DB_PASSWORD}
+      DB_USERNAME: ${DB_USERNAME}
+      DB_DATABASE_NAME: ${DB_DATABASE_NAME}
+      DB_HOSTNAME: ${DB_HOSTNAME}
+      DB_PORT: ${DB_PORT}
+      IMMICH_TRUSTED_PROXIES: ${IMMICH_TRUSTED_PROXIES}
+    depends_on:
+      - redis
+      - database
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.immich.rule=Host(`${IMMICH_TRAEFIK_HOST}`)
+        - traefik.http.routers.immich.tls=true
+        - traefik.http.routers.immich.tls.certresolver=letsencrypt
+        - traefik.http.routers.immich.entrypoints=websecure
+        - traefik.http.services.immich.loadbalancer.server.port=2283
+        - traefik.swarm.network=traefik_backend
+      resources:
+        limits:
+          cpus: '8'
+          memory: 8G
+      placement:
+        constraints:
+          - node.labels.block != databases
+
+  immich-machine-learning:
+    hostname: immich-ml
+    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}-openvino
+    volumes:
+      - model-cache:/cache
+      - /dev/dri:/dev/dri
+    networks:
+      - traefik_backend
+      - postgresql_db-backend
+    environment:
+      REDIS_HOSTNAME: ${REDIS_HOSTNAME}
+      REDIS_PORT: ${REDIS_PORT}
+      REDIS_DBINDEX: ${REDIS_DBINDEX}
+      DB_PASSWORD: ${DB_PASSWORD}
+      DB_USERNAME: ${DB_USERNAME}
+      DB_DATABASE_NAME: ${DB_DATABASE_NAME}
+      DB_HOSTNAME: ${DB_HOSTNAME}
+      DB_PORT: ${DB_PORT}
+    deploy:
+      mode: global
+      labels:
+        - traefik.enable=false
+      resources:
+        limits:
+          cpus: '8'
+          memory: 8G
+      placement:
+        constraints:
+          - node.hostname != docker-1
+
+  redis:
+    hostname: immich-redis
+    image: docker.io/redis:6.2-alpine@sha256:2d1463258f2764328496376f5d965f20c6a67f66ea2b06dc42af351f75248792
+    networks:
+      - traefik_backend
+      - postgresql_db-backend
+    volumes:
+      - ${REDIS_DATA_LOCATION}:/data
+    healthcheck:
+      test: redis-cli ping || exit 1
+    deploy:
+      labels:
+        - traefik.enable=false
+      resources:
+        limits:
+          cpus: '2'
+          memory: 256M
+      placement:
+        constraints:
+          - node.hostname != docker-1
+
+  database:
+    stop_grace_period: 60s
+    hostname: immich_postgresql
+    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
+    environment:
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_USER: ${DB_USERNAME}
+      POSTGRES_DB: ${DB_DATABASE_NAME}
+      POSTGRES_INITDB_ARGS: '--data-checksums'
+    volumes:
+      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
+    networks:
+      - traefik_backend
+      - postgresql_db-backend
+    healthcheck:
+      test: pg_isready --dbname='immich' --username='immich' || exit 1; Chksum="$$(psql --dbname='immich' --username='immich' --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')"; echo "checksum failure count is $$Chksum"; [ "$$Chksum" = '0' ] || exit 1
+      interval: 5m
+      start_interval: 30s
+      start_period: 5m
+    deploy:
+      resources:
+        limits:
+          cpus: '4'
+          memory: 2G
+      placement:
+        constraints:
+          - node.labels.block != databases
+
+  immich-kiosk:
+    hostname: immich-kiosk
+    image: ghcr.io/damongolding/immich-kiosk:latest
+    tty: true
+    environment:
+      LANG: "en_US"
+      TZ: "America/Los_Angeles"
+    networks:
+      - traefik_backend
+    volumes:
+      - /volume1/docker/immich-kiosk/config.yaml:/config.yaml
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.immich-kiosk.rule=Host(`${IMMICH_KIOSK_HOST}`)
+        - traefik.http.routers.immich-kiosk.tls=true
+        - traefik.http.routers.immich-kiosk.tls.certresolver=letsencrypt
+        - traefik.http.routers.immich-kiosk.entrypoints=websecure
+        - traefik.http.services.immich-kiosk.loadbalancer.server.port=3000
+        - traefik.swarm.network=traefik_backend
+        - traefik.http.routers.immich-kiosk.middlewares=immich-kiosk-auth
+        - traefik.http.middlewares.immich-kiosk-auth.basicauth.users=${IMMICH_KIOSK_BASICAUTH}
+      resources:
+        limits:
+          cpus: '1'
+          memory: 256M
+
+volumes:
+  model-cache:
+
+networks:
+  postgresql_db-backend:
+    external: true
+  traefik_backend:
+    external: true