{
  config,
  lib,
  pkgs,
  ...
}:
let
  cfg = config.services.paperless;
  hostname = config.networking.hostName;
  ts-domain = "fin-marlin.ts.net";
in
{
  age.secrets = {
    cifs-paperless.file = ../../secrets/cifs-paperless.age;
    paperless = {
      file = ../../secrets/paperless.age;
      path = "${cfg.dataDir}/nixos-paperless-secret-key";
      owner = cfg.user;
      mode = "400";
      symlink = false;
    };
  };

  fileSystems."/srv/paperless" = {
    device = "//u439959-sub3.your-storagebox.de/u439959-sub3";
    fsType = "smb3";
    options =
      let
        # prevents hanging on network split
        automount_opts = [
          "x-systemd.automount"
          "noauto"
          "x-systemd.mount-timeout=5s"
        ];
        uid = config.ids.uids.paperless;
      in
      automount_opts
      ++ [
        "credentials=${config.age.secrets.cifs-paperless.path}"
        "seal"
        "multichannel"
        "nobrl" # needed for sqlite
        "forceuid"
        "forcegid"
        "uid=${toString uid}"
        "gid=${toString uid}"
      ];
  };
  services.paperless = {
    enable = true;
    address = "::1";
    mediaDir = "/srv/paperless/media";
    settings = {
      PAPERLESS_DBENGINE = "sqlite";
      PAPERLESS_TIME_ZONE = config.time.timeZone;

      PAPERLESS_URL = "https://papers.${ts-domain}";
      PAPERLESS_TRUSTED_PROXIES = "::1";
      PAPERLESS_USE_X_FORWARD_HOST = true;
      PAPERLESS_USE_X_FORWARD_PORT = true;
      PAPERLESS_PROXY_SSL_HEADER = [
        "HTTP_X_FORWARDED_PROTO"
        "https"
      ];
      PAPERLESS_ENABLE_COMPRESSION = false; # let caddy do it

      PAPERLESS_ENABLE_HTTP_REMOTE_USER = true;
      PAPERLESS_ENABLE_HTTP_REMOTE_USER_API = true;

      PAPERLESS_OCR_SKIP_ARCHIVE_FILE = "with_text";
      PAPERLESS_OCR_LANGUAGE = "deu+eng";
      PAPERLESS_IGNORE_DATES = "09.08.90";

      PAPERLESS_TASK_WORKERS = 2;
      PAPERLESS_THREADS_PER_WORKER = 1;
      PAPERLESS_NUMBER_OF_SUGGESTED_DATES = 4;

      PAPERLESS_CONSUMER_IGNORE_PATTERN = [
        ".DS_STORE/*"
        "desktop.ini"
        ".stfolder/*"
        ".stversions/*"
      ];

      PAPERLESS_FILENAME_FORMAT = "{correspondent}/{created} {title} {asn}";
      PAPERLESS_FILENAME_FORMAT_REMOVE_NONE = true;
    };
  };

  services.caddy.virtualHosts = {
    "papers.${ts-domain}" = {
      extraConfig = ''
        bind tailscale/papers
        tailscale_auth
        reverse_proxy [::1]:${toString config.services.paperless.port} {
          header_up Remote-User {http.auth.user.tailscale_login}
        }
      '';
    };
  };

  users.groups.paperless.members = [
    "alin"
    "syncthing"
  ];

  systemd.services.backup-paperless = {
    startAt = "daily";
    path = with pkgs; [
      openssh
    ];
    serviceConfig = {
      Type = "oneshot";
      WorkingDirectory = config.services.paperless.dataDir;
      ExecStart = [
        "systemd-run --machine=papers sudo -u paperless ./paperless-manage document_exporter --delete --use-filename-format --no-archive --no-thumbnail --no-progress-bar ./export  "
        "${lib.getExe pkgs.rdiff-backup} --api-version 201 backup /srv/paperless/export ${hostname}@r5.${ts-domain}::paperless"
      ];
      ExecStartPost = "-${lib.getExe pkgs.rdiff-backup} --api-version 201 remove increments --older-than 3M ${hostname}@r5.${ts-domain}::paperless";
    };
  };
}