@@ -792,6 +792,15 @@ bind tailscale/bt
             reverse_proxy [${tm.rpc-bind-address}]:${toString tm.rpc-port}
           '';
         };
+        "papers.${ts-domain}" = {
+          extraConfig = ''
+            bind tailscale/papers
+            tailscale_auth
+            reverse_proxy [::1]:${toString config.services.paperless.port} {
+              header_up Remote-User {http.auth.user.tailscale_login}
+            }
+          '';
+        };
       };
   };
   systemd.services.caddy.serviceConfig = {
@@ -805,11 +814,6 @@ externalInterface = netif;
     enableIPv6 = true;
   };
 
-  users.users.paperless = {
-    group = "paperless";
-    uid = config.ids.uids.paperless;
-    home = "/srv/paperless";
-  };
   users.groups.paperless.members = [
     "alan"
     "syncthing"
@@ -840,139 +844,46 @@ "uid=${toString uid}"
         "gid=${toString uid}"
       ];
   };
-  containers.papers =
-    let
-      externalDir = "/srv/paperless";
-      tsHostname = "papers.${ts-domain}";
-      tsPort = 41642;
-      hostConfig = config;
-    in
-    {
-      autoStart = true;
-      enableTun = true;
-      privateNetwork = true;
-      hostAddress6 = "fc00::1";
-      localAddress6 = "fc00::2";
-      hostAddress = "10.6.42.1";
-      localAddress = "10.6.42.2";
-      forwardPorts = [
-        {
-          hostPort = tsPort;
-        }
+  services.paperless = {
+    enable = true;
+    address = "::1";
+    mediaDir = "/srv/paperless/media";
+    settings = {
+      PAPERLESS_DBENGINE = "sqlite";
+      PAPERLESS_TIME_ZONE = "Europe/Berlin";
+
+      PAPERLESS_URL = "https://papers.${ts-domain}";
+      PAPERLESS_TRUSTED_PROXIES = "::1";
+      PAPERLESS_USE_X_FORWARD_HOST = true;
+      PAPERLESS_USE_X_FORWARD_PORT = true;
+      PAPERLESS_PROXY_SSL_HEADER = [
+        "HTTP_X_FORWARDED_PROTO"
+        "https"
       ];
-      bindMounts = {
-        ${config.services.paperless.dataDir} = {
-          hostPath = hostConfig.services.paperless.dataDir;
-          isReadOnly = false;
-        };
-        ${externalDir} = {
-          hostPath = externalDir;
-          isReadOnly = false;
-        };
-      };
-      config =
-        { config, pkgs, ... }:
-        {
-          environment.systemPackages = with pkgs; [
-            lsof
-          ];
-          networking = {
-            useHostResolvConf = false;
-            resolvconf.enable = false;
-            firewall.trustedInterfaces = [ "tailscale0" ];
-            firewall.rejectPackets = true;
-            nameservers = hostConfig.networking.nameservers;
-          };
-          services.resolved = {
-            enable = true;
-            llmnr = "false";
-          };
-          services.tailscale = {
-            enable = true;
-            openFirewall = true;
-            permitCertUid = "caddy";
-            port = tsPort;
-          };
-          services.tailscaleAuth = {
-            enable = true;
-            group = "caddy";
-          };
-          services.caddy = {
-            enable = true;
-            email = "caddy@alanpearce.eu";
-            virtualHosts = {
-              ${tsHostname} = {
-                extraConfig = ''
-                  encode zstd gzip
-                  tls {
-                    get_certificate tailscale
-                  }
-                  handle_path /static/* {
-                    root * ${config.services.paperless.package}/lib/paperless-ngx/static
-                    file_server
-                  }
-                  forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
-                    uri /auth
-                    header_up Expected-Tailnet "${ts-domain}."
-                    header_up Remote-Addr {remote_host}
-                    header_up Remote-Port {remote_port}
-                    header_up Original-URI {uri}
-                    copy_headers {
-                      Tailscale-User>X-Webauth-User
-                      Tailscale-Name>X-Webauth-Name
-                      Tailscale-Login>X-Webauth-Login
-                      Tailscale-Tailnet>X-Webauth-Tailnet
-                      Tailscale-Profile-Picture>X-Webauth-Profile-Picture
-                    }
-                  }
-                  reverse_proxy [::1]:${toString config.services.paperless.port}
-                '';
-              };
-            };
-          };
-          services.paperless = {
-            enable = true;
-            address = "::1";
-            mediaDir = "${externalDir}/media";
-            settings = {
-              PAPERLESS_DBENGINE = "sqlite";
-              PAPERLESS_TIME_ZONE = "Europe/Berlin";
+      PAPERLESS_ENABLE_COMPRESSION = false; # let caddy do it
 
-              PAPERLESS_URL = "https://${tsHostname}";
-              PAPERLESS_TRUSTED_PROXIES = "::1";
-              PAPERLESS_USE_X_FORWARD_HOST = true;
-              PAPERLESS_USE_X_FORWARD_PORT = true;
-              PAPERLESS_PROXY_SSL_HEADER = [
-                "HTTP_X_FORWARDED_PROTO"
-                "https"
-              ];
-              PAPERLESS_ENABLE_COMPRESSION = false; # let caddy do it
+      PAPERLESS_ENABLE_HTTP_REMOTE_USER = true;
+      PAPERLESS_ENABLE_HTTP_REMOTE_USER_API = true;
 
-              PAPERLESS_ENABLE_HTTP_REMOTE_USER = true;
-              PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME = "HTTP_X_WEBAUTH_LOGIN";
+      PAPERLESS_OCR_SKIP_ARCHIVE_FILE = "with_text";
+      PAPERLESS_OCR_LANGUAGE = "deu+eng";
+      PAPERLESS_IGNORE_DATES = "09.08.90";
 
-              PAPERLESS_OCR_SKIP_ARCHIVE_FILE = "with_text";
-              PAPERLESS_OCR_LANGUAGE = "deu+eng";
-              PAPERLESS_IGNORE_DATES = "09.08.90";
+      PAPERLESS_TASK_WORKERS = 2;
+      PAPERLESS_THREADS_PER_WORKER = 1;
+      PAPERLESS_NUMBER_OF_SUGGESTED_DATES = 4;
 
-              PAPERLESS_TASK_WORKERS = 2;
-              PAPERLESS_THREADS_PER_WORKER = 1;
-              PAPERLESS_NUMBER_OF_SUGGESTED_DATES = 4;
+      PAPERLESS_CONSUMER_IGNORE_PATTERN = [
+        ".DS_STORE/*"
+        "desktop.ini"
+        ".stfolder/*"
+        ".stversions/*"
+      ];
 
-              PAPERLESS_CONSUMER_IGNORE_PATTERN = [
-                ".DS_STORE/*"
-                "desktop.ini"
-                ".stfolder/*"
-                ".stversions/*"
-              ];
-
-              PAPERLESS_FILENAME_FORMAT = "{correspondent}/{created} {title} {asn}";
-              PAPERLESS_FILENAME_FORMAT_REMOVE_NONE = true;
-            };
-          };
-          system.stateVersion = "24.11";
-        };
+      PAPERLESS_FILENAME_FORMAT = "{correspondent}/{created} {title} {asn}";
+      PAPERLESS_FILENAME_FORMAT_REMOVE_NONE = true;
     };
+  };
 
   users.groups.rauthy = { };
   users.users.rauthy = {