diff --git a/kubenix-modules/all.nix b/kubenix-modules/all.nix
index 3d84b15..06938d0 100644
--- a/kubenix-modules/all.nix
+++ b/kubenix-modules/all.nix
@@ -9,7 +9,7 @@ let
     ./nextcloud.nix
     ./pihole.nix
     ./hedgedoc.nix
-    ./paperless-ngx.nix
+    ./paperless.nix
     ./kitchenowl.nix
     ./forgejo
     ./media.nix
diff --git a/kubenix-modules/paperless-ngx.nix b/kubenix-modules/paperless-ngx.nix
deleted file mode 100644
index 01b1d3a..0000000
--- a/kubenix-modules/paperless-ngx.nix
+++ /dev/null
@@ -1,155 +0,0 @@
-{
-  kubernetes.resources = {
-    configMaps.paperless-ngx.data = {
-      PAPERLESS_REDIS = "redis://paperless-ngx-redis.default.svc.cluster.local:6379";
-      PAPERLESS_DBENGINE = "postgresql";
-      PAPERLESS_DBHOST = "lewis.dmz";
-      PAPERLESS_DBNAME = "paperless";
-      PAPERLESS_DBUSER = "paperless";
-      PAPERLESS_DATA_DIR = "/data/";
-      PAPERLESS_MEDIA_ROOT = "/data/";
-      PAPERLESS_OCR_LANGUAGES = "nld eng";
-      PAPERLESS_URL = "https://paperless.kun.is";
-      PAPERLESS_TIME_ZONE = "Europe/Amsterdam";
-      PAPERLESS_OCR_LANGUAGE = "nld";
-      USERMAP_UID = "33";
-      USERMAP_GID = "33";
-    };
-
-    secrets.paperless-ngx.stringData = {
-      databasePassword = "ref+sops://secrets/sops.yaml#/paperless-ngx/databasePassword";
-      secretKey = "ref+sops://secrets/sops.yaml#/paperless-ngx/secretKey";
-    };
-
-    deployments = {
-      paperless-ngx-web = {
-        metadata.labels = {
-          app = "paperless-ngx";
-          component = "web";
-        };
-
-        spec = {
-          selector.matchLabels = {
-            app = "paperless-ngx";
-            component = "web";
-          };
-
-          template = {
-            metadata.labels = {
-              app = "paperless-ngx";
-              component = "web";
-            };
-
-            spec = {
-              volumes.data.persistentVolumeClaim.claimName = "paperless-data";
-
-              containers.paperless-ngx = {
-                image = "ghcr.io/paperless-ngx/paperless-ngx:2.3";
-                envFrom = [{ configMapRef.name = "paperless-ngx"; }];
-                ports.web.containerPort = 8000;
-
-                env = {
-                  PAPERLESS_DBPASS.valueFrom.secretKeyRef = {
-                    name = "paperless-ngx";
-                    key = "databasePassword";
-                  };
-                  PAPERLESS_SECRET_KEY.valueFrom.secretKeyRef = {
-                    name = "paperless-ngx";
-                    key = "secretKey";
-                  };
-                };
-
-                volumeMounts = [{
-                  name = "data";
-                  mountPath = "/data";
-                }];
-              };
-
-              securityContext = {
-                fsGroup = 33;
-                fsGroupChangePolicy = "OnRootMismatch";
-              };
-            };
-          };
-        };
-      };
-
-      paperless-ngx-redis = {
-        metadata.labels = {
-          app = "paperless-ngx";
-          component = "redis";
-        };
-
-        spec = {
-          selector.matchLabels = {
-            app = "paperless-ngx";
-            component = "redis";
-          };
-
-          template = {
-            metadata.labels = {
-              app = "paperless-ngx";
-              component = "redis";
-            };
-
-            spec = {
-              volumes.data.persistentVolumeClaim.claimName = "paperless-redisdata";
-
-              containers.redis = {
-                image = "docker.io/library/redis:7";
-                ports.redis.containerPort = 6379;
-
-                volumeMounts = [{
-                  name = "data";
-                  mountPath = "/data";
-                }];
-              };
-
-              securityContext = {
-                fsGroup = 999;
-                fsGroupChangePolicy = "OnRootMismatch";
-              };
-            };
-          };
-        };
-      };
-    };
-
-    services = {
-      paperless-ngx-web.spec = {
-        selector = {
-          app = "paperless-ngx";
-          component = "web";
-        };
-
-        ports.web = {
-          port = 80;
-          targetPort = "web";
-        };
-      };
-
-      paperless-ngx-redis.spec = {
-        selector = {
-          app = "paperless-ngx";
-          component = "redis";
-        };
-
-        ports.redis = {
-          port = 6379;
-          targetPort = "redis";
-        };
-      };
-    };
-  };
-
-  lab = {
-    ingresses.paperless-ngx = {
-      host = "paperless.kun.is";
-
-      service = {
-        name = "paperless-ngx-web";
-        portName = "web";
-      };
-    };
-  };
-}
diff --git a/kubenix-modules/paperless.nix b/kubenix-modules/paperless.nix
new file mode 100644
index 0000000..edaf0eb
--- /dev/null
+++ b/kubenix-modules/paperless.nix
@@ -0,0 +1,213 @@
+{
+  kubernetes.resources = {
+    configMaps = {
+      paperless.data = {
+        PAPERLESS_REDIS = "redis://paperless-redis.default.svc.cluster.local:6379";
+        PAPERLESS_DBENGINE = "postgresql";
+        PAPERLESS_DBHOST = "paperless-db.default.svc.cluster.local";
+        PAPERLESS_DBNAME = "paperless";
+        PAPERLESS_DBUSER = "paperless";
+        PAPERLESS_DATA_DIR = "/data/";
+        PAPERLESS_MEDIA_ROOT = "/data/";
+        PAPERLESS_OCR_LANGUAGES = "nld eng";
+        PAPERLESS_URL = "https://paperless.kun.is";
+        PAPERLESS_TIME_ZONE = "Europe/Amsterdam";
+        PAPERLESS_OCR_LANGUAGE = "nld";
+        USERMAP_UID = "33";
+        USERMAP_GID = "33";
+      };
+
+      paperless-db-env.data = {
+        POSTGRES_DB = "paperless";
+        POSTGRES_USER = "paperless";
+        POSTGRES_PASSWORD = "ref+sops://secrets/sops.yaml#/paperless/databasePassword";
+        PGDATA = "/pgdata/data";
+      };
+    };
+
+    secrets.paperless.stringData = {
+      databasePassword = "ref+sops://secrets/sops.yaml#/paperless/databasePassword";
+      secretKey = "ref+sops://secrets/sops.yaml#/paperless/secretKey";
+    };
+
+    deployments = {
+      paperless-web = {
+        metadata.labels = {
+          app = "paperless";
+          component = "web";
+        };
+
+        spec = {
+          selector.matchLabels = {
+            app = "paperless";
+            component = "web";
+          };
+
+          template = {
+            metadata.labels = {
+              app = "paperless";
+              component = "web";
+            };
+
+            spec = {
+              volumes.data.persistentVolumeClaim.claimName = "paperless-data";
+
+              containers.paperless = {
+                image = "ghcr.io/paperless-ngx/paperless-ngx:2.3";
+                envFrom = [{ configMapRef.name = "paperless"; }];
+                ports.web.containerPort = 8000;
+
+                env = {
+                  PAPERLESS_DBPASS.valueFrom.secretKeyRef = {
+                    name = "paperless";
+                    key = "databasePassword";
+                  };
+                  PAPERLESS_SECRET_KEY.valueFrom.secretKeyRef = {
+                    name = "paperless";
+                    key = "secretKey";
+                  };
+                };
+
+                volumeMounts = [{
+                  name = "data";
+                  mountPath = "/data";
+                }];
+              };
+
+              securityContext = {
+                fsGroup = 33;
+                fsGroupChangePolicy = "OnRootMismatch";
+              };
+            };
+          };
+        };
+      };
+
+      paperless-redis = {
+        metadata.labels = {
+          app = "paperless";
+          component = "redis";
+        };
+
+        spec = {
+          selector.matchLabels = {
+            app = "paperless";
+            component = "redis";
+          };
+
+          template = {
+            metadata.labels = {
+              app = "paperless";
+              component = "redis";
+            };
+
+            spec = {
+              volumes.data.persistentVolumeClaim.claimName = "paperless-redisdata";
+
+              containers.redis = {
+                image = "docker.io/library/redis:7";
+                ports.redis.containerPort = 6379;
+
+                volumeMounts = [{
+                  name = "data";
+                  mountPath = "/data";
+                }];
+              };
+
+              securityContext = {
+                fsGroup = 999;
+                fsGroupChangePolicy = "OnRootMismatch";
+              };
+            };
+          };
+        };
+      };
+
+      paperless-db = {
+        metadata.labels = {
+          app = "paperless";
+          component = "database";
+        };
+
+        spec = {
+          selector.matchLabels = {
+            app = "paperless";
+            component = "database";
+          };
+
+          template = {
+            metadata.labels = {
+              app = "paperless";
+              component = "database";
+            };
+
+            spec = {
+              containers.postgres = {
+                image = "postgres:15";
+                imagePullPolicy = "IfNotPresent";
+                ports.postgres.containerPort = 5432;
+                envFrom = [{ configMapRef.name = "paperless-db-env"; }];
+
+                volumeMounts = [{
+                  name = "data";
+                  mountPath = "/pgdata";
+                }];
+              };
+
+              volumes.data.persistentVolumeClaim.claimName = "paperless-db";
+            };
+          };
+        };
+      };
+    };
+
+    services = {
+      paperless-web.spec = {
+        selector = {
+          app = "paperless";
+          component = "web";
+        };
+
+        ports.web = {
+          port = 80;
+          targetPort = "web";
+        };
+      };
+
+      paperless-redis.spec = {
+        selector = {
+          app = "paperless";
+          component = "redis";
+        };
+
+        ports.redis = {
+          port = 6379;
+          targetPort = "redis";
+        };
+      };
+
+      paperless-db.spec = {
+        selector = {
+          app = "paperless";
+          component = "database";
+        };
+
+        ports.postgres = {
+          port = 5432;
+          targetPort = "postgres";
+        };
+      };
+    };
+  };
+
+  lab = {
+    ingresses.paperless = {
+      host = "paperless.kun.is";
+
+      service = {
+        name = "paperless-web";
+        portName = "web";
+      };
+    };
+  };
+}
diff --git a/kubenix-modules/volumes.nix b/kubenix-modules/volumes.nix
index 4e29cb4..9ef9fca 100644
--- a/kubenix-modules/volumes.nix
+++ b/kubenix-modules/volumes.nix
@@ -1,4 +1,16 @@
 {
+  # kubernetes.resources.pods.testje.spec = {
+  #   containers.testje = {
+  #     image = "nginx";
+  #     volumeMounts = [{
+  #       name = "stuff";
+  #       mountPath = "/stuff";
+  #     }];
+  #   };
+
+  #   volumes.stuff.persistentVolumeClaim.claimName = "paperless-db";
+  # };
+
   lab = {
     longhornVolumes = {
       hedgedoc-uploads.storage = "50Mi";
@@ -14,6 +26,7 @@
       syncthing.storage = "400Mi";
       paperless-data.storage = "10Gi";
       paperless-redisdata.storage = "20Mi";
+      paperless-db.storage = "150Mi";
       jellyfin.storage = "5Gi";
       transmission.storage = "25Mi";
       jellyseerr.storage = "75Mi";
diff --git a/nixos-modules/backups.nix b/nixos-modules/backups.nix
index 2a16201..761ab2d 100644
--- a/nixos-modules/backups.nix
+++ b/nixos-modules/backups.nix
@@ -43,13 +43,6 @@ let
           password = "\${NEXTCLOUD_DATABASE_PASSWORD}";
           format = "tar";
         }
-        {
-          name = "paperless";
-          hostname = "lewis.dmz";
-          username = "paperless";
-          password = "\${PAPERLESS_DATABASE_PASSWORD}";
-          format = "tar";
-        }
       ];
     };
   };
diff --git a/nixos-modules/data-sharing.nix b/nixos-modules/data-sharing.nix
index e045acd..fac93d4 100644
--- a/nixos-modules/data-sharing.nix
+++ b/nixos-modules/data-sharing.nix
@@ -69,7 +69,6 @@ in
 
         authentication = ''
           host	nextcloud	nextcloud	all	      md5
-          host	paperless	paperless	all	      md5
         '';
       };
     };
diff --git a/secrets/sops.yaml b/secrets/sops.yaml
index 6b52808..53cf8fd 100644
--- a/secrets/sops.yaml
+++ b/secrets/sops.yaml
@@ -8,9 +8,9 @@ hedgedoc:
     databasePassword: ENC[AES256_GCM,data:h3xt+libyQVvG51ttyYF6Lhq3QmYptu7Vx7/lZBytw5I8I1/zLMB6g==,iv:DuWMA82HyuupALguemWJmZ0hUA9oPyXB6tTcy3VFGKk=,tag:4ExOslyo8Kjyn7STpjqYAg==,type:str]
 nextcloud:
     databasePassword: ENC[AES256_GCM,data:9mkwB4uKUlt1E20n7Wxr9PnKc1bxkYVO5Ph/dFfcuGA=,iv:U3IUz+7izoaeQi03xghDM1dZK01ICi3+r6r3mvNh8u0=,tag:aGKQyzZX210SNTRlvoHUig==,type:str]
-paperless-ngx:
-    databasePassword: ENC[AES256_GCM,data:tQcxQbp5WT3AmR6qqdSmfeIGu40=,iv:xSq5kXp8RqOUXR9kK3hr38YjATWoAxmKqPO59B1sdlg=,tag:pft3KrmLgIbSebAY2DBtPQ==,type:str]
-    secretKey: ENC[AES256_GCM,data:Ue409vICe/ULoEM15mh9hOdIFl4=,iv:QU3NmPknqeNxUqJi44mGVtL0yiyNOu9pVW08jHYuVec=,tag:zjUO2s4BoMMJrEttq7Cd/w==,type:str]
+paperless:
+    databasePassword: ENC[AES256_GCM,data:K1cBEqSnccLriGWjj5CTkggZbo0=,iv:NFOZvPuzE8vdP2BzHR7iUrvnMRqvbtcwkKAWk4ckEws=,tag:5SL+nnJSuVaceGMCAAf5nQ==,type:str]
+    secretKey: ENC[AES256_GCM,data:g2tDbmy8SdkYrwrF/pkzmr5cG1A=,iv:Zzg/oUvJfPku66TWf0TgmQRERRegVxtJdFDShxb56ng=,tag:f4LIe74n4m/SlmDOntkLQg==,type:str]
 kitchenowl:
     jwtSecretKey: ENC[AES256_GCM,data:XAfrvGbfVA1AZJyT0Nq0V0Om+1U=,iv:3kuWHfx5/Wk08z4/rou49s1wSxzisZUP0HLefYk9vXs=,tag:kormdXTJ7u5ar4+VY/IfvQ==,type:str]
 forgejo:
@@ -44,8 +44,8 @@ sops:
             cHJRZWpDdWZlSnh3Qm1GZ28vZ0p0ZjAK7+BS6YQ2cUD21XCISBeNLSUNgNFQfSKI
             zL/AAqsVoBTrEs7s9fxmWmVm21/M3ZTYfU6Z6gIr6YEWe1pehRd6ZQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-05-25T14:56:33Z"
-    mac: ENC[AES256_GCM,data:372x93C9PcSp1Snz0zXSwyeOd74wgvoSYClWq4IF7CskFrNgFOl3zDbHtpp2i510LSuzxaPhFuJJm0LXFmHnRJUIgC3D9MyDLxP5Wp0rvfICNmsww9iSNplMN1i3jqHncYtB2rRYN30y5Bo+AJSWto237hcd7fIUgWHGw5Jdk2o=,iv:hzOzgoDQzghTlzKAocnFPPXoBjiZ6VWoJUNbXhdH/OA=,tag:AvyPVMGySMoBQVoNkTdFFQ==,type:str]
+    lastmodified: "2024-05-25T15:16:16Z"
+    mac: ENC[AES256_GCM,data:YMLsRN83mAm+nwi4tgEXHb2TPOel35/q3wLaxhv8lk+yPBiYra+oyGs/dlr6IgTtAGvjN9DM7Uvxng14Ya3l/NHx8ZpmArsnInAqmc4NRfowgB6ITuL4q4eU/XJjfuQNGl3xrrwgAZQJo8UGNc+mEmQMaykAvl03N5WMVaqFyQ0=,iv:SseCh1H76cwjvYD+Mqg/eMt9vJq0BLAhvMftoa8a+mc=,tag:Ochp8CYbtuSJCjdHvhoY3A==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1