paperless-ngx on vancouver

nix/nas/configuration.nix

@@ -49,6 +49,15 @@
   };
 
   services = {
+    paperless = {
+      enable = true;
+      dataDir = "/tank/documents";
+      settings = {
+        PAPERLESS_OCR_USER_ARGS = {
+          invalidate_digital_signatures = true;
+        };
+      };
+    };
     fwupd.enable = true;
     promtail = {
       enable = true;
@@ -154,6 +163,7 @@
           paths = [
             "/tank/k3scluster"
             "/tank/forgejo"
+            "/tank/documents"
           ];
           timerConfig = {
             OnCalendar = "daily";
@@ -303,6 +313,22 @@
           proxyPass = "http://127.0.0.1:8973/";
         };
       };
+      virtualHosts."docs.gmem.ca" = {
+        enableACME = true;
+        addSSL = true;
+        acmeRoot = null;
+        locations."/" = {
+          extraConfig = ''
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            client_max_body_size 500M;
+          '';
+          proxyPass = "http://127.0.0.1:${toString config.services.paperless.port}/";
+        };
+      };
     };
     gitea = {
       enable = true;
@@ -512,6 +538,11 @@
     dnsProvider = "cloudflare";
     credentialsFile = config.age.secrets.cloudflare-dns.path;
   };
+  security.acme.certs."docs.gmem.ca" = {
+    domain = "*.gmem.ca";
+    dnsProvider = "cloudflare";
+    credentialsFile = config.age.secrets.cloudflare-dns.path;
+  };
 
   system.stateVersion = "23.05";
 }