{
  config,
  ...
}:
let
  cfg = config.services.paperless;
  ts-domain = "fin-marlin.ts.net";
in
{
  age.secrets = {
    paperless = {
      file = ../../secrets/paperless.age;
      path = "${cfg.dataDir}/nixos-paperless-secret-key";
      owner = cfg.user;
      mode = "400";
      symlink = false;
    };
  };

  fileSystems."/srv/paperless" = {
    device = "172.16.128.114:/nas/6567/paperless";
    fsType = "nfs";
    options = [ "nofail" ];
  };

  services.paperless = {
    enable = true;
    address = "::1";
    mediaDir = "/srv/paperless/media";
    settings = {
      PAPERLESS_DBENGINE = "sqlite";
      PAPERLESS_TIME_ZONE = config.time.timeZone;

      PAPERLESS_URL = "https://papers.${ts-domain}";
      PAPERLESS_TRUSTED_PROXIES = "::1";
      PAPERLESS_USE_X_FORWARD_HOST = true;
      PAPERLESS_USE_X_FORWARD_PORT = true;
      PAPERLESS_PROXY_SSL_HEADER = [
        "HTTP_X_FORWARDED_PROTO"
        "https"
      ];
      PAPERLESS_ENABLE_COMPRESSION = false; # let caddy do it

      PAPERLESS_ENABLE_HTTP_REMOTE_USER = true;
      PAPERLESS_ENABLE_HTTP_REMOTE_USER_API = true;

      PAPERLESS_OCR_SKIP_ARCHIVE_FILE = "with_text";
      PAPERLESS_OCR_LANGUAGE = "deu+eng";
      PAPERLESS_IGNORE_DATES = "09.08.90";

      PAPERLESS_TASK_WORKERS = 2;
      PAPERLESS_THREADS_PER_WORKER = 1;
      PAPERLESS_NUMBER_OF_SUGGESTED_DATES = 4;

      PAPERLESS_CONSUMER_IGNORE_PATTERN = [
        ".DS_STORE/*"
        "desktop.ini"
        ".stfolder/*"
        ".stversions/*"
      ];

      PAPERLESS_FILENAME_FORMAT = "{correspondent}/{created} {title} {asn}";
      PAPERLESS_FILENAME_FORMAT_REMOVE_NONE = true;
    };
  };

  services.caddy.virtualHosts = {
    "papers.${ts-domain}" = {
      extraConfig = ''
        bind tailscale/papers
        tailscale_auth
        reverse_proxy [::1]:${toString config.services.paperless.port} {
          header_up Remote-User {http.auth.user.tailscale_login}
        }
      '';
    };
  };

  users.groups.paperless.members = [
    "alin"
    "syncthing"
  ];
}