From 38be6c13f76e893cf47636257071b440dec0c5b2 Mon Sep 17 00:00:00 2001
From: Robert Günzler <r@gnzler.io>
Date: Sun, 7 Sep 2025 17:32:13 +0200
Subject: initial commit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Robert Günzler <r@gnzler.io>
---
 bundles/paperless/README.md         |  1 +
 bundles/paperless/files/kube.yaml   | 95 +++++++++++++++++++++++++++++++++++++
 bundles/paperless/files/secret.yaml | 10 ++++
 bundles/paperless/items.py          | 13 +++++
 bundles/paperless/metadata.py       | 11 +++++
 5 files changed, 130 insertions(+)
 create mode 100644 bundles/paperless/README.md
 create mode 100644 bundles/paperless/files/kube.yaml
 create mode 100644 bundles/paperless/files/secret.yaml
 create mode 100644 bundles/paperless/items.py
 create mode 100644 bundles/paperless/metadata.py

(limited to 'bundles/paperless')

diff --git a/bundles/paperless/README.md b/bundles/paperless/README.md
new file mode 100644
index 0000000..e2b83d6
--- /dev/null
+++ b/bundles/paperless/README.md
@@ -0,0 +1 @@
+https://docs.paperless-ngx.com/configuration/
diff --git a/bundles/paperless/files/kube.yaml b/bundles/paperless/files/kube.yaml
new file mode 100644
index 0000000..63f618f
--- /dev/null
+++ b/bundles/paperless/files/kube.yaml
@@ -0,0 +1,95 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: paperless
+data:
+  PAPERLESS_PORT: 8000
+  PAPERLESS_URL: https://paper.gzr.im
+  PAPERLESS_REDIS: redis://localhost:6379
+  PAPERLESS_DATA_DIR: /paperless/data
+  PAPERLESS_MEDIA_ROOT: /paperless/media
+  PAPERLESS_CONSUMPTION_DIR: /paperless/inbox
+  # use authelia
+  PAPERLESS_APPS: allauth.socialaccount.providers.openid_connect
+  PAPERLESS_LOGOUT_REDIRECT_URL: https://login.gzr.im/logout
+  PAPERLESS_DISABLE_REGULAR_LOGIN: false
+  PAPERLESS_REDIRECT_LOGIN_TO_SSO: false
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: paperless
+  labels:
+    traefik.enable: true
+    traefik.http.routers.paperless.tls: true
+    traefik.http.routers.paperless.tls.certresolver: le
+    traefik.http.routers.paperless.entrypoints: http,https
+    traefik.http.routers.paperless.rule: Host(`paper.gzr.im`)
+    traefik.http.routers.paperless.service: paperless
+    traefik.http.services.paperless.loadbalancer.server.port: 8000
+    # prometheus.scrape.enable: false
+    # prometheus.scrape.port: 8000
+    # prometheus.label.job: paperless
+spec:
+  restartPolicy: Always
+  dnsPolicy: Default
+  containers:
+    - name: broker
+      image: docker.io/library/redis:7
+      ports:
+        - containerPort: 6379
+          protocol: TCP
+      volumeMounts:
+        - name: broker-data
+          mountPath: /data
+      resources:
+        limits:
+          cpu: 100m
+          memory: 128Mi
+      # TODO: healthchecks
+
+    - name: paperless
+      image: ghcr.io/paperless-ngx/paperless-ngx:2.13
+      ports:
+        - containerPort: 8000
+          protocol: TCP
+      envFrom:
+        - configMapRef:
+            name: paperless
+        - secretRef:
+            name: paperless
+      volumeMounts:
+        - name: paperless-media
+          mountPath: /paperless/media
+        - name: paperless-inbox
+          mountPath: /paperless/inbox
+        - name: paperless-data
+          mountPath: /paperless/data
+      resources:
+        limits:
+          cpu: 100m
+          memory: 128Mi
+      livenessProbe:
+        httpGet:
+          path: /
+          port: 8000
+        initialDelaySeconds: 30
+        timeoutSeconds: 30
+
+  volumes:
+    - name: broker-data
+      hostPath:
+        path: /var/lib/paperless/broker
+        type: DirectoryOrCreate
+    - name: paperless-data
+      hostPath:
+        path: /var/lib/paperless/data
+        type: DirectoryOrCreate
+    - name: paperless-inbox
+      hostPath:
+        path: /media/hayasui/documents/paperless-inbox
+        type: Directory
+    - name: paperless-media
+      hostPath:
+        path: /media/hayasui/documents/paperless
+        type: Directory
diff --git a/bundles/paperless/files/secret.yaml b/bundles/paperless/files/secret.yaml
new file mode 100644
index 0000000..9434763
--- /dev/null
+++ b/bundles/paperless/files/secret.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: paperless
+data:
+    PAPERLESS_ADMIN_USER: ${repo.vault.password_for("paperless_admin_user").b64encode().value}
+    PAPERLESS_ADMIN_MAIL: ${repo.vault.password_for("paperless_admin_mail").b64encode().value}
+    PAPERLESS_ADMIN_PASSWORD: ${repo.vault.password_for("paperless_admin_pw").b64encode().value}
+    PAPERLESS_SECRET_KEY: ${repo.vault.password_for("paperless_secret_key").b64encode().value}
+    PAPERLESS_SOCIALACCOUNT_PROVIDERS: ${repo.libs.util.base64('{"openid_connect":{"SCOPE":["openid","profile","email"],"OAUTH_PKCE_ENABLED":true,"APPS":[{"provider_id":"authelia","name":"Authelia","client_id":"paperless","secret":"%s","settings":{"server_url":"https://login.gzr.im","token_auth_method":"client_secret_basic"}}]}}' % repo.vault.cmd(f"rbw get authelia/client/paperless"))}
diff --git a/bundles/paperless/items.py b/bundles/paperless/items.py
new file mode 100644
index 0000000..4869347
--- /dev/null
+++ b/bundles/paperless/items.py
@@ -0,0 +1,13 @@
+files = {
+    "/etc/deployments/paperless/kube.yaml": {
+        "content_type": "text",
+        "source": "kube.yaml",
+        "triggers": {"svc_s6rc:paperless:restart"},
+    },
+    "/etc/deployments/paperless/secret.yaml": {
+        "content_type": "mako",
+        "mode": "0600",
+        "source": "secret.yaml",
+        "triggers": {"svc_s6rc:paperless:restart"},
+    },
+}
diff --git a/bundles/paperless/metadata.py b/bundles/paperless/metadata.py
new file mode 100644
index 0000000..42b98f7
--- /dev/null
+++ b/bundles/paperless/metadata.py
@@ -0,0 +1,11 @@
+defaults = {
+    "backup": {
+        "includes": {
+            "/media/hayasui/documents/", # documents + inbox
+            "/var/lib/paperless/data",   # aux data + sqlite db
+        }
+    },
+    "containers": {
+        "paperless": {},
+    },
+}
-- 
cgit 1.4.1