add paperless-ngx docker stack

legacy/projects/docker_swarm/ansible/playbooks/stacks.yml

@@ -15,3 +15,4 @@
     - {role: nextcloud, tags: nextcloud}
     - {role: syncthing, tags: syncthing}
     - {role: kitchenowl, tags: kitchenowl}
+    - {role: paperless-ngx, tags: paperless-ngx}

legacy/projects/docker_swarm/ansible/roles/paperless-ngx/docker-stack.yml.j2

@@ -0,0 +1,113 @@
+# vi: ft=yaml
+# Docker Compose file for running paperless from the Docker Hub.
+# This file contains everything paperless needs to run.
+# Paperless supports amd64, arm and arm64 hardware.
+#
+# All compose files of paperless configure paperless in the following way:
+#
+# - Paperless is (re)started on system boot, if it was running before shutdown.
+# - Docker volumes for storing data are managed by Docker.
+# - Folders for importing and exporting files are created in the same directory
+#   as this file and mounted to the correct folders inside the container.
+# - Paperless listens on port 8000.
+#
+# In addition to that, this Docker Compose file adds the following optional
+# configurations:
+#
+# - Instead of SQLite (default), PostgreSQL is used as the database server.
+#
+# To install and update paperless with this file, do the following:
+#
+# - Copy this file as 'docker-compose.yml' and the files 'docker-compose.env'
+#   and '.env' into a folder.
+# - Run 'docker compose pull'.
+# - Run 'docker compose run --rm webserver createsuperuser' to create a user.
+# - Run 'docker compose up -d'.
+#
+# For more extensive installation and update instructions, refer to the
+# documentation.
+
+version: "3.7"
+
+networks:
+  traefik:
+    external: true
+  paperless-ngx:
+
+volumes:
+  data:
+    driver_opts:
+      type: "nfs"
+      o: "addr=lewis.dmz,nolock,soft,rw"
+      device: ":/mnt/data/nfs/paperless-ngx/data"
+  redisdata:
+    driver_opts:
+      type: "nfs"
+      o: "addr=lewis.dmz,nolock,soft,rw"
+      device: ":/mnt/data/nfs/paperless-ngx/redisdata"
+  nextcloud:
+    driver_opts:
+      type: "nfs"
+      o: "addr=lewis.dmz,nolock,soft,rw"
+      device: ":/mnt/data/nfs/nextcloud/data"
+
+services:
+  broker:
+    image: docker.io/library/redis:7
+    volumes:
+      - type: volume
+        source: redisdata
+        target: /data
+        volume:
+          nocopy: true
+    networks:
+      - paperless-ngx
+
+  webserver:
+    image: ghcr.io/paperless-ngx/paperless-ngx:2.3
+    depends_on:
+      - broker
+    volumes:
+      - type: volume
+        source: data
+        target: /data
+        volume:
+          nocopy: true
+      # TODO: what does this directory even do?
+      # - ./export:/usr/src/paperless/export
+      - type: volume
+        source: nextcloud
+        target: /nextcloud
+        volume:
+          nocopy: true
+    environment:
+      PAPERLESS_REDIS: redis://broker:6379
+      PAPERLESS_DBENGINE: postgresql
+      PAPERLESS_DBHOST: lewis.dmz
+      PAPERLESS_DBNAME: paperless
+      PAPERLESS_DBUSER: paperless
+      PAPERLESS_DBPASS: "{{ paperless_db_password }}"
+      PAPERLESS_CONSUMPTION_DIR: /nextcloud/data/pim/files/paperless-ngx/consumption/
+      PAPERLESS_DATA_DIR: /data/
+      PAPERLESS_MEDIA_ROOT: /data/
+      PAPERLESS_CONSUMER_POLLING: 10
+      PAPERLESS_OCR_LANGUAGES: nld eng
+      PAPERLESS_URL: https://paperless.kun.is
+      PAPERLESS_TIME_ZONE: Europe/Amsterdam
+      PAPERLESS_OCR_LANGUAGE: nld
+      PAPERLESS_SECRET_KEY: "{{ paperless_secret_key }}"
+      USERMAP_UID: "33"
+      USERMAP_GID: "33"
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.paperless-ngx.entrypoints=websecure
+        - traefik.http.routers.paperless-ngx.rule=Host(`paperless.kun.is`)
+        - traefik.http.routers.paperless-ngx.tls=true
+        - traefik.http.routers.paperless-ngx.tls.certresolver=letsencrypt
+        - traefik.http.routers.paperless-ngx.service=paperless-ngx
+        - traefik.http.services.paperless-ngx.loadbalancer.server.port=8000
+        - traefik.docker.network=traefik
+    networks:
+      - traefik
+      - paperless-ngx

legacy/projects/docker_swarm/ansible/roles/paperless-ngx/tasks/main.yml

@@ -0,0 +1,5 @@
+- name: Deploy Docker stack
+  docker_stack:
+    name: paperless-ngx
+    compose:
+      - "{{ lookup('template', '{{ role_path }}/docker-stack.yml.j2') | from_yaml }}"

legacy/projects/docker_swarm/ansible/roles/paperless-ngx/vars/main.yml

@@ -0,0 +1,14 @@
+paperless_secret_key: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          63306337643736303137376130613866353330633632633233376463626366316562623836613065
+          6337353539323238643739323964613464666163333161350a323532333239303161383164616535
+          38343534663664356131653838626139653838393437633461333035323933356262366232643635
+          6165373765653132360a346132653262316232306237336337393861646466613831323837636138
+          61373633653562363636373835656665643537313864313266626638343063643039
+paperless_db_password: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          66366431303231626232303861383735373733373035663864326235623731643561336333626536
+          6135316437376361656636386337373637343237613139640a393232373136323466363465393562
+          61383963353931353931306261366566656264303034373936336539346337316639626538616661
+          6438383134366333360a616538373533373533326264666463396666353532333864343832333239
+          62343237653431633030366230373137343564313334363736363232346238646361

nixos/modules/backups.nix

@@ -37,6 +37,11 @@ let
         username: hedgedoc
         password: ''${HEDGEDOC_DATABASE_PASSWORD}
         format: tar
+      - name: paperless
+        hostname: lewis.dmz
+        username: paperless
+        password: ''${PAPERLESS_DATABASE_PASSWORD}
+        format: tar
     '';
   };
 in

nixos/modules/data-sharing.nix

@@ -13,6 +13,8 @@ let
     "/forgejo"
     "/kitchenowl/data"
     "/syncthing/config"
+    "/paperless-ngx/data"
+    "/paperless-ngx/redisdata"
   ];
   nfsExports = lib.strings.concatLines (
     builtins.map
@@ -73,6 +75,7 @@ in
         authentication = ''
           host	nextcloud	nextcloud	all	      md5
           host	hedgedoc	hedgedoc	all	      md5
+          host	paperless	paperless	all	      md5
         '';
       };
     };

nixos/secrets/database_passwords.env.age

@@ -1,15 +1,16 @@
 age-encryption.org/v1
--> ssh-ed25519 UwNSRQ 4tVNE9qMbAvdgvUV/lllntSWjschSe3gY8nknp1DgQk
+-> ssh-ed25519 UwNSRQ XKuX/onJklTJ1ws0svIwJy1PZN1MHsf5+N3z7XGvCyY
-8nQh/bM1tkSyPd0j5Tn9DeUT6V4p8Fdk3GiGZUwoBwk
+JkyemSdV/ZcbjWLrwYLhKCE4Ln2seLR0WyYXGMepgBw
--> ssh-ed25519 JJ7S4A QHRi+zGVWfa6+l/gpUC1SyCSrDjMRk89MAYUVmdINWQ
+-> ssh-ed25519 JJ7S4A 9wzkTABOPcmTG7LNWvZa7dKG0Ingf+KDckZ1tL2c3QQ
-RstWCyCv2sSQCqgcFT6Djza7gkztlFf3af1EvNQTg6k
+IkxcStI4kwXkWj+j3PWl7FdyoVMVsiH9SZBnyffbcYQ
--> ssh-ed25519 aqswPA BSwMu/VwsKqpHaqWbP7TNVE3kNWeGV1xdj2AhIhJOQE
+-> ssh-ed25519 aqswPA 3i/v1qWLseD+FrPrnAXtSoK98a6Nrb3XrHinp2QPTn0
-1QwREnDoFi5UTd20dAbJEVeA9lp3R6746PTAyF5KRqQ
+RxuPM1oICEoF5oZAyQlCm+fOivI9sfZenZSlOGBIZK8
--> ssh-ed25519 LAPUww zFWdRmb38deepDWtFIlQYFA205jKrM6T4iU6nURnBU4
+-> ssh-ed25519 LAPUww MkvAMN/fZiV66+ub4Q/CDTIxJ3N3cMWBT0SQajespR0
-gxA0pT9DKQMXMSJjQ+fFp7K6rhwHx90pXwFcBuc1ptI
+uh6SGtxR3BvsU/fTTTOnsNXD+bHNYMhTAFoc3QUtMr8
--> ssh-ed25519 vBZj5g uYJyvL//qPFg1QXgvacb+0Z0+4NMTXCg5dddlVDJJDQ
+-> ssh-ed25519 vBZj5g Jiu1sEmlws4eFPriuL2oS99Q9tFCyf4Zkv/khLONvT0
-2DqHQ6FIw8oCXbkZPl5fLmUVmXzBMLe9wFJsPSEDoZQ
+cLLHcvmIb1Nb7eVmKJyYdvfulgbcZ73N0x6GWyKeJPs
--> ssh-ed25519 QP0PgA +CHjn/rPhNrsXSVMFgoyhSdhn8k6BWS58XSDwjipi0U
+-> ssh-ed25519 QP0PgA A1Raf1CiVJ5tnJXRIeS0VpCUNX/iYNzGozQxApY9KGM
-DGVkPVEMzPZDRPygjIxX4VWv9wbknmrMXFMAXnWVI1Q
+998c6IZfPNW8uMttkK8xGp1hgKXBcrwuBOgOpXWPCu8
---- GZXaTJpDKi0WIHeOzamI/MygV50iPVV94UFyqPMd1GA
+--- /Qv6sfhphlYb9WtWdmPt6RZJPHxBO4jCSgauazsHIt8
-%ƒXQcZŠXZâ÷´¥¦ƒÇÿö\â–iÏ#_¤Û{L<>¥fŠ×åOc¡EsæõÂ"ãG:ÂM	D}£{\.äÛÙ†øÐû	Ôý~Û6†,|C•v0ºŠ*Rr74ñ{Š–ußásÝZ=s}YH:æÀZ¤Þ…&(­vR„<52>ËMkqãàÈî_PEKàMÆ"?kÌ\¨­¶Ö—³êZ’¬P
+1kYiL7¸<37>Áª-Ç}—`ýŠƒÇNƒV‹oäCñ'ÞÛ§ýhßô[øvDŠU€pv×½¶Òõ¦~e‰Â0yœ¦ÿ—ÑÄ2`•Ý<E280A2>ºîƱŽïÑ¥ÂÔåú8›/´ª	¸
+÷MEÐŽh·sÈqÌâ¤|ßkتí<Ó°¡+ÊÍ9eË0󟑸;­)Ï?IL-ëÓJY¾gðpk+Ûí’úˆHRûé5ÔÍÉÛ¥ú”§„Ø×på :8·ùo©þ1¥zâs—`•_MSÒí«Q˜;Q_o]·