superconfig/configs/services/paperless/ at master · hermes.pds.lassul.us/superconfig · Tangled

hermes.pds.lassul.us / superconfig

forked from lass.pds.lassul.us/superconfig

0

This repository has no description

0

superconfig / configs / services / paperless

1 file

at master

Hermes configs.services.paperless: init on neoprism 2d ago

configs.services.paperless: init on neoprism Paperless-ngx at https://paperless.lassul.us, behind nginx with ACME (client_max_body_size 100M for phone photo uploads). OCR in German and English; the nixpkgs module builds tesseract with the languages from PAPERLESS_OCR_LANGUAGE. Data stays at the module's default /var/lib/paperless (static paperless user, no DynamicUser) with SQLite. Login via Zitadel (id.lassul.us): lass.zitadel project "paperless" with access = "declarative", so only users granted on the project (by verified email) can log in. allauth's openid_connect provider keys social accounts by uid_field, set explicitly to the token's sub. paperless' environmentFile is a single env file and the client secret has to sit inside the PAPERLESS_SOCIALACCOUNT_PROVIDERS JSON, so the paperless-oidc-env oneshot builds it from zitadel-reconcile's env file into /run/paperless-oidc, keeping the secret out of the store. The regular login form is disabled; DRF token and basic auth do not go through allauth's pre_authenticate, so API tokens keep working. The admin password comes from the paperless-admin vars generator via the module's passwordFile (LoadCredential). Backups: /var/lib/paperless plus a consistent .backup of its WAL-mode SQLite database (the live db files are excluded). Mailbox scan@lassul.us with a vars-generated password (mailserver-scan) for paperless' IMAP mail fetching, configured later in paperless' database. DNS: paperless CNAME neoprism like the other neoprism services; Gatus checks the login page.

2 days ago