{
  kubernetes.resources = {
    configMaps.paperless-ngx.data = {
      PAPERLESS_REDIS = "redis://paperless-ngx-redis.default.svc.cluster.local:6379";
      PAPERLESS_DBENGINE = "postgresql";
      PAPERLESS_DBHOST = "lewis.dmz";
      PAPERLESS_DBNAME = "paperless";
      PAPERLESS_DBUSER = "paperless";
      PAPERLESS_DATA_DIR = "/data/";
      PAPERLESS_MEDIA_ROOT = "/data/";
      PAPERLESS_OCR_LANGUAGES = "nld eng";
      PAPERLESS_URL = "https://paperless.kun.is";
      PAPERLESS_TIME_ZONE = "Europe/Amsterdam";
      PAPERLESS_OCR_LANGUAGE = "nld";
      USERMAP_UID = "33";
      USERMAP_GID = "33";
    };

    secrets.paperless-ngx.stringData = {
      databasePassword = "ref+file:///home/pim/.config/home/vals.yaml#/paperless-ngx/databasePassword";
      secretKey = "ref+file:///home/pim/.config/home/vals.yaml#/paperless-ngx/secretKey";
    };

    deployments = {
      paperless-ngx-web = {
        metadata.labels = {
          app = "paperless-ngx";
          component = "web";
        };

        spec = {
          selector.matchLabels = {
            app = "paperless-ngx";
            component = "web";
          };

          template = {
            metadata.labels = {
              app = "paperless-ngx";
              component = "web";
            };

            spec = {
              containers.paperless-ngx = {
                image = "ghcr.io/paperless-ngx/paperless-ngx:2.3";
                envFrom = [{ configMapRef.name = "paperless-ngx"; }];

                ports = [{
                  containerPort = 8000;
                  protocol = "TCP";
                }];

                env = [
                  {
                    name = "PAPERLESS_DBPASS";

                    valueFrom.secretKeyRef = {
                      name = "paperless-ngx";
                      key = "databasePassword";
                    };
                  }
                  {
                    name = "PAPERLESS_SECRET_KEY";

                    valueFrom.secretKeyRef = {
                      name = "paperless-ngx";
                      key = "secretKey";
                    };
                  }
                ];

                volumeMounts = [{
                  name = "data";
                  mountPath = "/data";
                }];
              };

              volumes = [{
                name = "data";
                persistentVolumeClaim.claimName = "paperless-ngx-data";
              }];
            };
          };
        };
      };

      paperless-ngx-redis = {
        metadata.labels = {
          app = "paperless-ngx";
          component = "redis";
        };

        spec = {
          selector.matchLabels = {
            app = "paperless-ngx";
            component = "redis";
          };

          template = {
            metadata.labels = {
              app = "paperless-ngx";
              component = "redis";
            };

            spec = {
              containers.redis = {
                image = "docker.io/library/redis:7";

                ports = [{
                  containerPort = 6379;
                  protocol = "TCP";
                }];

                volumeMounts = [{
                  name = "data";
                  mountPath = "/data";
                }];
              };

              volumes = [{
                name = "data";
                persistentVolumeClaim.claimName = "paperless-ngx-redisdata";
              }];
            };
          };
        };
      };
    };

    persistentVolumes = {
      paperless-ngx-redisdata.spec = {
        capacity.storage = "1Mi";
        accessModes = [ "ReadWriteMany" ];

        nfs = {
          server = "lewis.hyp";
          path = "/mnt/data/nfs/paperless-ngx/redisdata";
        };
      };

      paperless-ngx-data.spec = {
        capacity.storage = "1Mi";
        accessModes = [ "ReadWriteMany" ];

        nfs = {
          server = "lewis.hyp";
          path = "/mnt/data/nfs/paperless-ngx/data";
        };
      };
    };

    persistentVolumeClaims = {
      paperless-ngx-redisdata.spec = {
        accessModes = [ "ReadWriteMany" ];
        storageClassName = "";
        resources.requests.storage = "1Mi";
        volumeName = "paperless-ngx-redisdata";
      };

      paperless-ngx-data.spec = {
        accessModes = [ "ReadWriteMany" ];
        storageClassName = "";
        resources.requests.storage = "1Mi";
        volumeName = "paperless-ngx-data";
      };
    };

    services = {
      paperless-ngx-web.spec = {
        selector = {
          app = "paperless-ngx";
          component = "web";
        };

        ports = [{
          protocol = "TCP";
          port = 80;
          targetPort = 8000;
        }];
      };

      paperless-ngx-redis.spec = {
        selector = {
          app = "paperless-ngx";
          component = "redis";
        };

        ports = [{
          protocol = "TCP";
          port = 6379;
          targetPort = 6379;
        }];
      };
    };

    ingresses.paperless-ngx = {
      metadata.annotations."cert-manager.io/cluster-issuer" = "letsencrypt";

      spec = {
        ingressClassName = "traefik";

        rules = [{
          host = "paperless.kun.is";

          http.paths = [{
            path = "/";
            pathType = "Prefix";

            backend.service = {
              name = "paperless-ngx-web";
              port.number = 80;
            };
          }];
        }];

        tls = [{
          secretName = "paperless-ngx-tls";
          hosts = [ "paperless.kun.is" ];
        }];
      };
    };
  };
}