{ config, lib, pkgs, ... }: let inherit (lib) mkEnableOption mkIf mkOption ; cfg = config.my.services.paperless; my = config.my; domain = config.networking.domain; paperlessDomain = "paperless.${domain}"; in { options.my.services.paperless = let inherit (lib) types; in { enable = mkEnableOption "Paperless"; port = mkOption { type = types.port; default = 8080; example = 8080; description = "Internal port for Paperless service"; }; passwordFile = mkOption { type = types.path; description = '' Path to a file containing the admin's password ''; }; secretKeyFile = mkOption { type = types.path; description = '' Path to a file containing the service's secret key ''; }; }; config = mkIf cfg.enable { services.paperless = { enable = true; port = cfg.port; passwordFile = cfg.passwordFile; extraConfig = { # Postgres settings PAPERLESS_DBHOST = "/run/postgresql"; PAPERLESS_DBUSER = "paperless"; PAPERLESS_DBNAME = "paperless"; PAPERLESS_ALLOWED_HOSTS = paperlessDomain; PAPERLESS_CORS_ALLOWED_HOSTS = "https://${paperlessDomain}"; PAPERLESS_OCR_LANGUAGE = "fra+eng"; PAPERLESS_OCR_MODE = "skip_noarchive"; PAPERLESS_TIME_ZONE = config.time.timeZone; PAPERLESS_ADMIN_USER = "alarsyo"; }; }; systemd.services = { paperless-scheduler.serviceConfig = { EnvironmentFile = cfg.secretKeyFile; }; paperless-consumer.serviceConfig = { EnvironmentFile = cfg.secretKeyFile; }; paperless-web.serviceConfig = { EnvironmentFile = cfg.secretKeyFile; }; }; services.postgresql = { enable = true; ensureDatabases = ["paperless"]; ensureUsers = [ { name = "paperless"; ensurePermissions."DATABASE paperless" = "ALL PRIVILEGES"; } ]; }; systemd.services.paperless-server = { # Make sure the DB is available after = ["postgresql.service"]; }; services.nginx.virtualHosts = { "${paperlessDomain}" = { forceSSL = true; useACMEHost = domain; listen = [ # FIXME: hardcoded tailscale IP { addr = "100.80.61.67"; port = 443; ssl = true; } { addr = "100.80.61.67"; port = 80; ssl = false; } ]; locations."/" = { proxyPass = "http://127.0.0.1:${toString cfg.port}"; proxyWebsockets = true; }; }; }; my.services.restic-backup = mkIf cfg.enable { paths = [ config.services.paperless.dataDir config.services.paperless.mediaDir ]; }; }; }