@@ -41,21 +41,9 @@ ../roles/sso.nix
     ../settings/services/git-server.nix
   ];
   age.secrets = {
-    paperless =
-      let
-        cfg = config.services.paperless;
-      in
-      {
-        file = ../../secrets/paperless.age;
-        path = "${cfg.dataDir}/nixos-paperless-secret-key";
-        owner = cfg.user;
-        mode = "400";
-        symlink = false;
-      };
     powerdns.file = ../../secrets/powerdns.age;
     redis-website.file = ../../secrets/redis-website.age;
     cifs-jellyfin.file = ../../secrets/cifs-jellyfin.age;
-    cifs-paperless.file = ../../secrets/cifs-paperless.age;
     ntfy.file = ../../secrets/ntfy.age;
     open-webui.file = ../../secrets/open-webui.age;
   };
@@ -400,22 +388,6 @@ ExecStartPost = "-${lib.getExe pkgs.rdiff-backup} --api-version 201 remove increments --older-than 3M ${hostname}@r5.${ts-domain}::gitolite";
     };
   };
 
-  systemd.services.backup-paperless = {
-    startAt = "daily";
-    path = with pkgs; [
-      openssh
-    ];
-    serviceConfig = {
-      Type = "oneshot";
-      WorkingDirectory = config.services.paperless.dataDir;
-      ExecStart = [
-        "systemd-run --machine=papers sudo -u paperless ./paperless-manage document_exporter --delete --use-filename-format --no-archive --no-thumbnail --no-progress-bar ./export  "
-        "${lib.getExe pkgs.rdiff-backup} --api-version 201 backup /srv/paperless/export ${hostname}@r5.${ts-domain}::paperless"
-      ];
-      ExecStartPost = "-${lib.getExe pkgs.rdiff-backup} --api-version 201 remove increments --older-than 3M ${hostname}@r5.${ts-domain}::paperless";
-    };
-  };
-
   security.acme = {
     certs."${oldDomain}" = {
       extraDomainNames = [ "*.${oldDomain}" ];
@@ -493,15 +465,6 @@ extraConfig = ''
             reverse_proxy ${config.services.ntfy-sh.settings.listen-http}
           '';
         };
-        "papers.${ts-domain}" = {
-          extraConfig = ''
-            bind tailscale/papers
-            tailscale_auth
-            reverse_proxy [::1]:${toString config.services.paperless.port} {
-              header_up Remote-User {http.auth.user.tailscale_login}
-            }
-          '';
-        };
         "chat.${ts-domain}" = {
           extraConfig = ''
             bind tailscale/chat
@@ -538,77 +501,6 @@ enable = true;
     internalInterfaces = [ "ve-+" ];
     externalInterface = netif;
     enableIPv6 = true;
-  };
-
-  users.groups.paperless.members = [
-    "alin"
-    "syncthing"
-  ];
-
-  fileSystems."/srv/paperless" = {
-    device = "//u439959-sub3.your-storagebox.de/u439959-sub3";
-    fsType = "smb3";
-    options =
-      let
-        # prevents hanging on network split
-        automount_opts = [
-          "x-systemd.automount"
-          "noauto"
-          "x-systemd.mount-timeout=5s"
-        ];
-        uid = config.ids.uids.paperless;
-      in
-      automount_opts
-      ++ [
-        "credentials=${config.age.secrets.cifs-paperless.path}"
-        "seal"
-        "multichannel"
-        "nobrl" # needed for sqlite
-        "forceuid"
-        "forcegid"
-        "uid=${toString uid}"
-        "gid=${toString uid}"
-      ];
-  };
-  services.paperless = {
-    enable = true;
-    address = "::1";
-    mediaDir = "/srv/paperless/media";
-    settings = {
-      PAPERLESS_DBENGINE = "sqlite";
-      PAPERLESS_TIME_ZONE = config.time.timeZone;
-
-      PAPERLESS_URL = "https://papers.${ts-domain}";
-      PAPERLESS_TRUSTED_PROXIES = "::1";
-      PAPERLESS_USE_X_FORWARD_HOST = true;
-      PAPERLESS_USE_X_FORWARD_PORT = true;
-      PAPERLESS_PROXY_SSL_HEADER = [
-        "HTTP_X_FORWARDED_PROTO"
-        "https"
-      ];
-      PAPERLESS_ENABLE_COMPRESSION = false; # let caddy do it
-
-      PAPERLESS_ENABLE_HTTP_REMOTE_USER = true;
-      PAPERLESS_ENABLE_HTTP_REMOTE_USER_API = true;
-
-      PAPERLESS_OCR_SKIP_ARCHIVE_FILE = "with_text";
-      PAPERLESS_OCR_LANGUAGE = "deu+eng";
-      PAPERLESS_IGNORE_DATES = "09.08.90";
-
-      PAPERLESS_TASK_WORKERS = 2;
-      PAPERLESS_THREADS_PER_WORKER = 1;
-      PAPERLESS_NUMBER_OF_SUGGESTED_DATES = 4;
-
-      PAPERLESS_CONSUMER_IGNORE_PATTERN = [
-        ".DS_STORE/*"
-        "desktop.ini"
-        ".stfolder/*"
-        ".stversions/*"
-      ];
-
-      PAPERLESS_FILENAME_FORMAT = "{correspondent}/{created} {title} {asn}";
-      PAPERLESS_FILENAME_FORMAT_REMOVE_NONE = true;
-    };
   };
 
   services.redis = {

@@ -0,0 +1,122 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.paperless;
+  hostname = config.networking.hostName;
+  ts-domain = "fin-marlin.ts.net";
+in
+{
+  age.secrets = {
+    cifs-paperless.file = ../../secrets/cifs-paperless.age;
+    paperless = {
+      file = ../../secrets/paperless.age;
+      path = "${cfg.dataDir}/nixos-paperless-secret-key";
+      owner = cfg.user;
+      mode = "400";
+      symlink = false;
+    };
+  };
+
+  fileSystems."/srv/paperless" = {
+    device = "//u439959-sub3.your-storagebox.de/u439959-sub3";
+    fsType = "smb3";
+    options =
+      let
+        # prevents hanging on network split
+        automount_opts = [
+          "x-systemd.automount"
+          "noauto"
+          "x-systemd.mount-timeout=5s"
+        ];
+        uid = config.ids.uids.paperless;
+      in
+      automount_opts
+      ++ [
+        "credentials=${config.age.secrets.cifs-paperless.path}"
+        "seal"
+        "multichannel"
+        "nobrl" # needed for sqlite
+        "forceuid"
+        "forcegid"
+        "uid=${toString uid}"
+        "gid=${toString uid}"
+      ];
+  };
+  services.paperless = {
+    enable = true;
+    address = "::1";
+    mediaDir = "/srv/paperless/media";
+    settings = {
+      PAPERLESS_DBENGINE = "sqlite";
+      PAPERLESS_TIME_ZONE = config.time.timeZone;
+
+      PAPERLESS_URL = "https://papers.${ts-domain}";
+      PAPERLESS_TRUSTED_PROXIES = "::1";
+      PAPERLESS_USE_X_FORWARD_HOST = true;
+      PAPERLESS_USE_X_FORWARD_PORT = true;
+      PAPERLESS_PROXY_SSL_HEADER = [
+        "HTTP_X_FORWARDED_PROTO"
+        "https"
+      ];
+      PAPERLESS_ENABLE_COMPRESSION = false; # let caddy do it
+
+      PAPERLESS_ENABLE_HTTP_REMOTE_USER = true;
+      PAPERLESS_ENABLE_HTTP_REMOTE_USER_API = true;
+
+      PAPERLESS_OCR_SKIP_ARCHIVE_FILE = "with_text";
+      PAPERLESS_OCR_LANGUAGE = "deu+eng";
+      PAPERLESS_IGNORE_DATES = "09.08.90";
+
+      PAPERLESS_TASK_WORKERS = 2;
+      PAPERLESS_THREADS_PER_WORKER = 1;
+      PAPERLESS_NUMBER_OF_SUGGESTED_DATES = 4;
+
+      PAPERLESS_CONSUMER_IGNORE_PATTERN = [
+        ".DS_STORE/*"
+        "desktop.ini"
+        ".stfolder/*"
+        ".stversions/*"
+      ];
+
+      PAPERLESS_FILENAME_FORMAT = "{correspondent}/{created} {title} {asn}";
+      PAPERLESS_FILENAME_FORMAT_REMOVE_NONE = true;
+    };
+  };
+
+  services.caddy.virtualHosts = {
+    "papers.${ts-domain}" = {
+      extraConfig = ''
+        bind tailscale/papers
+        tailscale_auth
+        reverse_proxy [::1]:${toString config.services.paperless.port} {
+          header_up Remote-User {http.auth.user.tailscale_login}
+        }
+      '';
+    };
+  };
+
+  users.groups.paperless.members = [
+    "alin"
+    "syncthing"
+  ];
+
+  systemd.services.backup-paperless = {
+    startAt = "daily";
+    path = with pkgs; [
+      openssh
+    ];
+    serviceConfig = {
+      Type = "oneshot";
+      WorkingDirectory = config.services.paperless.dataDir;
+      ExecStart = [
+        "systemd-run --machine=papers sudo -u paperless ./paperless-manage document_exporter --delete --use-filename-format --no-archive --no-thumbnail --no-progress-bar ./export  "
+        "${lib.getExe pkgs.rdiff-backup} --api-version 201 backup /srv/paperless/export ${hostname}@r5.${ts-domain}::paperless"
+      ];
+      ExecStartPost = "-${lib.getExe pkgs.rdiff-backup} --api-version 201 remove increments --older-than 3M ${hostname}@r5.${ts-domain}::paperless";
+    };
+  };
+}