poseidon: move paperless to hades

hosts/hades/default.nix

@@ -87,6 +87,13 @@ in {
       adminpassFile = config.age.secrets."nextcloud/admin-pass".path;
     };
 
+    paperless = {
+      enable = true;
+      port = 8085;
+      passwordFile = config.age.secrets."paperless/admin-password".path;
+      secretKeyFile = config.age.secrets."paperless/secret-key".path;
+    };
+
     photoprism = {
       enable = true;
       port = 8084;

hosts/hades/secrets.nix

@@ -25,6 +25,9 @@
           owner = "nextcloud";
         };
 
+        "paperless/admin-password" = {};
+        "paperless/secret-key" = {};
+
         "restic-backup/hades-credentials" = {};
         "restic-backup/hades-password" = {};
 

hosts/poseidon/default.nix

@@ -81,13 +81,6 @@ in {
       port = 8083;
     };
 
-    paperless = {
-      enable = true;
-      port = 8085;
-      passwordFile = config.age.secrets."paperless/admin-password".path;
-      secretKeyFile = config.age.secrets."paperless/secret-key".path;
-    };
-
     tailscale = {
       enable = true;
       exitNode = true;

hosts/poseidon/secrets.nix

@@ -17,9 +17,6 @@
 
         "lohr/shared-secret" = {};
 
-        "paperless/admin-password" = {};
-        "paperless/secret-key" = {};
-
         "restic-backup/poseidon-credentials" = {};
         "restic-backup/poseidon-password" = {};
 

modules/secrets/paperless/secret-key.age

@@ -1,12 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 k2gHjw hTWIhs//PCC1vsJrn+UL42FtqRzIKAzfQaVF8gU9iAo
-B+BnsXp6J/NLViCMTd6vqj+JbTkkahjqabVvPIU5q9g
--> ssh-ed25519 z6Eu8Q YMS3Ht3/97IcTJ31XsmnHhKIo41ewzuGAbnhWJA/qWg
-8oiUduRgbcjz3EaP0VEUewVirgdoc7XVogscdceE4Ew
--> --grease zku kAX26^8 N0
-Z/CvenJrdHzvk/YZq06fR25xnn2plwbUW3WX86yWv1e7IBYSqnKm9snd5VRRK/R3
-1EWv55qpuPBr
---- BRKnk4UzqUkM4po7qwV3omMv2KSEl5RzujwUSIQgQOg
-·"B§Ïe	ñœ´|!»ÛƒÊ¤WH†5wL(v]A±,l¡Nû1·ó©·®Ì<06>ýœ4Škþ
ÄY1âã»³› ÞHáZ¥›P:n›+pýŠ)šYçq/]i5'ÔÝÖç=؆O¯ç˜FÎÜàÙø »
-ÞE
-¹ÃâΞ8Ýçõ<C3A7>ï"<22>çÅ=“¡³ÎoƒÌ†»s(¿ï›éX™ørÐ	Û€ªá
+-> ssh-ed25519 k2gHjw CoGvifgWo1JvHjx3PKJa3jR3lKrvgvKnTTui1w6UR0I
+gcadr6WbTzyrPD3h3oDifFj/pMZKIzUfDXL6e6610Is
+-> ssh-ed25519 pX8y2g MBFa4xDU6CaH6amzlGTmFXIcAXLq2xykRd0WkeUEkQo
+91jV5LUuhvOVKSg2cz3TMKI2SaZvCTzXL/xyUWbYJAg
+-> lkH}'\W;-grease nZ K\MP7 HUsh
+vWwsKxuBXKwpTBkYERd7kPo
+--- xohFX48WGxRFVYQzdbSl7l2Go90FSUPH5ml6OalKJwQ
+ÍsüČůÁňĆ€ă·ŐťˇźhÝÝő¦!č,(ŇQlÁök¶ţV×ä¬ŰóË~éýÔÍU
!ÂűB0	~ĂĎA!2Ůnp€`˛‹’ŐÍěL&Ż±ł{†}„3%{’[)<18>t…®/nĘjb^{Ť<>1Gű[G0ß
ż×‘ň m›o<E280BA>ź<EFBFBD>«	Č:naź¨Q®Ą\âćômfGľ;ů(Sţ¶źÉÎĺ

modules/secrets/secrets.nix

@@ -21,8 +21,8 @@ in {
 
   "nextcloud/admin-pass.age".publicKeys = [alarsyo hades];
 
-  "paperless/admin-password.age".publicKeys = [alarsyo poseidon];
-  "paperless/secret-key.age".publicKeys = [alarsyo poseidon];
+  "paperless/admin-password.age".publicKeys = [alarsyo hades];
+  "paperless/secret-key.age".publicKeys = [alarsyo hades];
 
   "restic-backup/boreal-password.age".publicKeys = [alarsyo boreal];
   "restic-backup/boreal-credentials.age".publicKeys = [alarsyo boreal];

services/paperless.nix

@@ -106,12 +106,12 @@ in {
         listen = [
           # FIXME: hardcoded tailscale IP
           {
-            addr = "100.80.61.67";
+            addr = "100.115.172.44";
             port = 443;
             ssl = true;
           }
           {
-            addr = "100.80.61.67";
+            addr = "100.115.172.44";
             port = 80;
             ssl = false;
           }