2 files changed, 105 insertions, 0 deletions
diff --git a/bundles/paperless/files/kube.yaml b/bundles/paperless/files/kube.yaml
new file mode 100644
index 0000000..63f618f
--- /dev/null
+++ b/bundles/paperless/files/kube.yaml
@@ -0,0 +1,95 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: paperless
+data:
+  PAPERLESS_PORT: 8000
+  PAPERLESS_URL: https://paper.gzr.im
+  PAPERLESS_REDIS: redis://localhost:6379
+  PAPERLESS_DATA_DIR: /paperless/data
+  PAPERLESS_MEDIA_ROOT: /paperless/media
+  PAPERLESS_CONSUMPTION_DIR: /paperless/inbox
+  # use authelia
+  PAPERLESS_APPS: allauth.socialaccount.providers.openid_connect
+  PAPERLESS_LOGOUT_REDIRECT_URL: https://login.gzr.im/logout
+  PAPERLESS_DISABLE_REGULAR_LOGIN: false
+  PAPERLESS_REDIRECT_LOGIN_TO_SSO: false
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: paperless
+  labels:
+    traefik.enable: true
+    traefik.http.routers.paperless.tls: true
+    traefik.http.routers.paperless.tls.certresolver: le
+    traefik.http.routers.paperless.entrypoints: http,https
+    traefik.http.routers.paperless.rule: Host(`paper.gzr.im`)
+    traefik.http.routers.paperless.service: paperless
+    traefik.http.services.paperless.loadbalancer.server.port: 8000
+    # prometheus.scrape.enable: false
+    # prometheus.scrape.port: 8000
+    # prometheus.label.job: paperless
+spec:
+  restartPolicy: Always
+  dnsPolicy: Default
+  containers:
+    - name: broker
+      image: docker.io/library/redis:7
+      ports:
+        - containerPort: 6379
+          protocol: TCP
+      volumeMounts:
+        - name: broker-data
+          mountPath: /data
+      resources:
+        limits:
+          cpu: 100m
+          memory: 128Mi
+      # TODO: healthchecks
+
+    - name: paperless
+      image: ghcr.io/paperless-ngx/paperless-ngx:2.13
+      ports:
+        - containerPort: 8000
+          protocol: TCP
+      envFrom:
+        - configMapRef:
+            name: paperless
+        - secretRef:
+            name: paperless
+      volumeMounts:
+        - name: paperless-media
+          mountPath: /paperless/media
+        - name: paperless-inbox
+          mountPath: /paperless/inbox
+        - name: paperless-data
+          mountPath: /paperless/data
+      resources:
+        limits:
+          cpu: 100m
+          memory: 128Mi
+      livenessProbe:
+        httpGet:
+          path: /
+          port: 8000
+        initialDelaySeconds: 30
+        timeoutSeconds: 30
+
+  volumes:
+    - name: broker-data
+      hostPath:
+        path: /var/lib/paperless/broker
+        type: DirectoryOrCreate
+    - name: paperless-data
+      hostPath:
+        path: /var/lib/paperless/data
+        type: DirectoryOrCreate
+    - name: paperless-inbox
+      hostPath:
+        path: /media/hayasui/documents/paperless-inbox
+        type: Directory
+    - name: paperless-media
+      hostPath:
+        path: /media/hayasui/documents/paperless
+        type: Directory
diff --git a/bundles/paperless/files/secret.yaml b/bundles/paperless/files/secret.yaml
new file mode 100644
index 0000000..9434763
--- /dev/null
+++ b/bundles/paperless/files/secret.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: paperless
+data:
+    PAPERLESS_ADMIN_USER: ${repo.vault.password_for("paperless_admin_user").b64encode().value}
+    PAPERLESS_ADMIN_MAIL: ${repo.vault.password_for("paperless_admin_mail").b64encode().value}
+    PAPERLESS_ADMIN_PASSWORD: ${repo.vault.password_for("paperless_admin_pw").b64encode().value}
+    PAPERLESS_SECRET_KEY: ${repo.vault.password_for("paperless_secret_key").b64encode().value}
+    PAPERLESS_SOCIALACCOUNT_PROVIDERS: ${repo.libs.util.base64('{"openid_connect":{"SCOPE":["openid","profile","email"],"OAUTH_PKCE_ENABLED":true,"APPS":[{"provider_id":"authelia","name":"Authelia","client_id":"paperless","secret":"%s","settings":{"server_url":"https://login.gzr.im","token_auth_method":"client_secret_basic"}}]}}' % repo.vault.cmd(f"rbw get authelia/client/paperless"))}