all repos — nixfiles @ 7776f403da30e8cd95f62f7e7c74b999d7c956ae

System and user configuration, managed by nix and home-manager

system/roles/paperless.nix (view raw)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
{
  config,
  ...
}:
let
  data = import ../../data;
  cfg = config.services.paperless;
in
{
  age.secrets = {
    paperless = {
      file = ../../secrets/paperless.age;
      path = "${cfg.dataDir}/nixos-paperless-secret-key";
      owner = cfg.user;
      mode = "400";
      symlink = false;
    };
  };

  fileSystems."/srv/paperless" = {
    device = "172.16.128.114:/nas/6567/paperless";
    fsType = "nfs";
    options = [ "nofail" ];
  };

  services.paperless = {
    enable = true;
    address = "::1";
    mediaDir = "/srv/paperless/media";
    settings = {
      PAPERLESS_DBENGINE = "sqlite";
      PAPERLESS_TIME_ZONE = config.time.timeZone;

      PAPERLESS_URL = "https://papers.${data.tailnet}";
      PAPERLESS_TRUSTED_PROXIES = "::1";
      PAPERLESS_USE_X_FORWARD_HOST = true;
      PAPERLESS_USE_X_FORWARD_PORT = true;
      PAPERLESS_PROXY_SSL_HEADER = [
        "HTTP_X_FORWARDED_PROTO"
        "https"
      ];
      PAPERLESS_ENABLE_COMPRESSION = false; # let caddy do it

      PAPERLESS_ENABLE_HTTP_REMOTE_USER = true;
      PAPERLESS_ENABLE_HTTP_REMOTE_USER_API = true;

      PAPERLESS_OCR_SKIP_ARCHIVE_FILE = "with_text";
      PAPERLESS_OCR_LANGUAGE = "deu+eng";
      PAPERLESS_IGNORE_DATES = "09.08.90";

      PAPERLESS_TASK_WORKERS = 2;
      PAPERLESS_THREADS_PER_WORKER = 1;
      PAPERLESS_NUMBER_OF_SUGGESTED_DATES = 4;

      PAPERLESS_CONSUMER_IGNORE_PATTERN = [
        ".DS_STORE/*"
        "desktop.ini"
        ".stfolder/*"
        ".stversions/*"
      ];

      PAPERLESS_FILENAME_FORMAT = "{correspondent}/{created} {title} {asn}";
      PAPERLESS_FILENAME_FORMAT_REMOVE_NONE = true;
    };
  };

  services.caddy.virtualHosts = {
    "papers.${data.tailnet}" = {
      extraConfig = ''
        bind tailscale/papers
        tls {
          get_certificate tailscale
        }
        tailscale_auth
        reverse_proxy [::1]:${toString config.services.paperless.port} {
          header_up Remote-User {http.auth.user.tailscale_login}
        }
      '';
    };
  };

  users.groups.paperless.members = [
    "alin"
    "syncthing"
  ];
}