voidarc/nixos.server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added paperless-ngx

Browse Source
This commit is contained in:
voidarc
2026-09-28 11:20:29 +01:00
parent 56cc6ab71b
commit ab7b10d63b
4 changed files with 152 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
modules/containers/default.nix
View File

@@ -15,9 +15,10 @@
containerJellyfin
containerMail
containerN8N
containerKomga
containerKomga
containerNginxHomeAssistant
containerSilverbullet
containerPaperless
];
in {
imports = modules;

140
modules/containers/paperless-ngx/container.nix Normal file
View File

@@ -0,0 +1,140 @@
{moduleWithSystem, ...}: {
flake.nixosModules.containerPaperless = moduleWithSystem ({pkgs, ...}: {config, ...}: {
virtualisation.oci-containers.containers."paperless-ngx-broker" = {
image = "docker.io/valkey/valkey:9-alpine";
volumes = [
"/containers/paperless-ngx/redisdata:/data:rw"
];
log-driver = "journald";
extraOptions = [
"--network-alias=broker"
"--network=paperless-ngx_default"
];
};
systemd.services."podman-paperless-ngx-broker" = {
serviceConfig = {
Restart = pkgs.lib.mkOverride 90 "always";
};
after = [
"podman-network-paperless-ngx_default.service"
];
requires = [
"podman-network-paperless-ngx_default.service"
];
partOf = [
"podman-compose-paperless-ngx-root.target"
];
wantedBy = [
"podman-compose-paperless-ngx-root.target"
];
};
virtualisation.oci-containers.containers."paperless-ngx-db" = {
image = "docker.io/library/postgres:18";
environmentFiles = [config.sops.templates."paperless.env".path];
environment = {
"POSTGRES_DB" = "paperless";
"POSTGRES_USER" = "paperless";
};
volumes = [
"/containers/paperless-ngx/pgdata:/var/lib/postgresql:rw"
];
log-driver = "journald";
extraOptions = [
"--network-alias=db"
"--network=paperless-ngx_default"
];
};
systemd.services."podman-paperless-ngx-db" = {
serviceConfig = {
Restart = pkgs.lib.mkOverride 90 "always";
};
after = [
"podman-network-paperless-ngx_default.service"
];
requires = [
"podman-network-paperless-ngx_default.service"
];
partOf = [
"podman-compose-paperless-ngx-root.target"
];
wantedBy = [
"podman-compose-paperless-ngx-root.target"
];
};
virtualisation.oci-containers.containers."paperless-ngx-webserver" = {
image = "ghcr.io/paperless-ngx/paperless-ngx:latest";
environmentFiles = [config.sops.templates."paperless.env".path];
environment = {
"PAPERLESS_DBENGINE" = "postgresql";
"PAPERLESS_DBHOST" = "db";
"PAPERLESS_OCR_LANGUAGE" = "eng";
"PAPERLESS_REDIS" = "redis://broker:6379";
"PAPERLESS_TIME_ZONE" = "Europe/London";
"PAPERLESS_URL" = "https://paperless.voidarc.co.uk";
"USERMAP_GID" = "0";
"USERMAP_UID" = "0";
};
volumes = [
"/containers/paperless-ngx/consume:/usr/src/paperless/consume:rw"
"/containers/paperless-ngx/data:/usr/src/paperless/data:rw"
"/containers/paperless-ngx/export:/usr/src/paperless/export:rw"
"/containers/paperless-ngx/media:/usr/src/paperless/media:rw"
];
ports = [
"8000:8000/tcp"
];
dependsOn = [
"paperless-ngx-broker"
"paperless-ngx-db"
];
log-driver = "journald";
extraOptions = [
"--network-alias=webserver"
"--network=paperless-ngx_default"
];
};
systemd.services."podman-paperless-ngx-webserver" = {
serviceConfig = {
Restart = pkgs.lib.mkOverride 90 "always";
};
after = [
"podman-network-paperless-ngx_default.service"
];
requires = [
"podman-network-paperless-ngx_default.service"
];
partOf = [
"podman-compose-paperless-ngx-root.target"
];
wantedBy = [
"podman-compose-paperless-ngx-root.target"
];
};
# Networks
systemd.services."podman-network-paperless-ngx_default" = {
path = [pkgs.podman];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = "podman network rm -f paperless-ngx_default";
};
script = ''
podman network inspect paperless-ngx_default || podman network create paperless-ngx_default
'';
partOf = ["podman-compose-paperless-ngx-root.target"];
wantedBy = ["podman-compose-paperless-ngx-root.target"];
};
# Root service
# When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources.
systemd.targets."podman-compose-paperless-ngx-root" = {
unitConfig = {
Description = "Root target generated by compose2nix.";
};
wantedBy = ["multi-user.target"];
};
});
}

6
modules/features/sops/default.nix
View File

@@ -24,6 +24,8 @@
mail-relay-user = {};
mail-relay-passwd = {};
silverbullet-user = {};
paperless-ngx-key = {};
paperless-postgres-password = {};
};
templates = {
"gitea.env".content = ''
@@ -43,6 +45,10 @@
"silverbullet.env".content = ''
SB_USER=${config.sops.placeholder.silverbullet-user}
'';
"paperless.env".content = ''
POSTGRES_PASSWORD=${config.sops.placeholder.paperless-postgres-password}
PAPERLESS_SECRET_KEY=${config.sops.placeholder.paperless-ngx-key}
'';
};
};
};

6
secrets/secrets.yaml
View File

@@ -9,6 +9,8 @@ immich-postgres-passwd: ENC[AES256_GCM,data:Kv0l+xMwcBA=,iv:SLzp6Qo1YrwAmrhtg11M
mail-relay-user: ENC[AES256_GCM,data:yaqB1uJ9N+9LwSsS4VsCsQxK/IPA8A0m,iv:k8c9GVeU4bdH8G+4SVKYOw4X5ytiPn33rnqx7CVn4hs=,tag:P9l6G87kI2CH301PPUmXzw==,type:str]
mail-relay-passwd: ENC[AES256_GCM,data:9+2KuS27qukbedmG4fLwyw==,iv:+x5EgbJw/fha98CO58lwTxeF1lfZ5dL8W0zkyOvfF8w=,tag:GnMpinf68b2HdISia0wkrg==,type:str]
silverbullet-user: ENC[AES256_GCM,data:8eoTT+T1+/khV7A96h3KoA==,iv:5wRlIU8hdRnseI5b3WUUZ0KOYtLdyrcON/P+yxg0LCs=,tag:Xxiae5Yrhv2gzIpUPX3PAw==,type:str]
paperless-ngx-key: ENC[AES256_GCM,data:LxOcEwW4KXHHVM7rQ+qyFyZJX/uuIc5Fc0NDFF7k7qycNcGB1jYq90gAKnz3yf2DnN2FFQQfwc/nS3Z6s+z1bZqFtR6mGdOFQSzu4ALV3CUvY6im518=,iv:cuAGN8L1Rd44WIPCCwj+7W1b110tqG+kftyq9aHwc04=,tag:j3UE1hVAUu4Ch3FZAXdTKA==,type:str]
paperless-postgres-password: ENC[AES256_GCM,data:lVPWNWuCUx1Q,iv:m8h1xiNoTg5w4lJ6Lv66EEzj5UxvVkEjv9DYG3KkcKw=,tag:QjggXhCCFZ9jrydUmwl3Ng==,type:str]
sops:
age:
- enc: |
@@ -20,7 +22,7 @@ sops:
XS8/g9qFT4nSgM/8nLhx7I4j5/NQU+CuB/iiG5Zs4iY6+vvAe0jIUg==
-----END AGE ENCRYPTED FILE-----
recipient: age1rg4rsns375z2zj4tv8cyqtjl504fw8tprlmj2w057dz6ztttjstsgjvkvy
lastmodified: "2026-07-31T17:10:29Z"
mac: ENC[AES256_GCM,data:RzmgeFEKYRzqEnHMtSxpg7GKleAr64F7bI7EM/FHq/aYyHgtYkn22oGz8uz9/RVijLIyHcL1rJSOyO7RhUSInqfJeSOKLyxI/X1B862ZuqYOkAFSMOeNMl719cINmgw9uHUQD62Tk6VReii1L0Yf2t/l29wObIRTKg96aZPEkjA=,iv:jAWIpSq7jx71RQ6agMu7ULG2IV6oG5U7ri9rbTyQ8JU=,tag:ybo7an+/9pN0sBA73WzGjg==,type:str]
lastmodified: "2026-09-23T09:47:48Z"
mac: ENC[AES256_GCM,data:M+lBXxSo3WrPGErRGK3xi9jR2Wxkd3OWf+H7xI5BTdT6AOvogwTX2HfhGvTff6HUZDdsZFWNEVWRFkeWJZ3jkK8TVOOf4R0EskcFIn/xANSfBdAVBvh4lc9yVgw0Xh3Z55NVeimMB2FL91wOFP5/vPlIMGZjfrkKeBLZtHKLpPU=,iv:6iWxAdgxZXkJkxdvRlKzN6DF0LZ1j60tKCU0wO5rUdo=,tag:vKe+MTLQBbvxn/PQ7Kw7mQ==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.3