paperless: deploy on kube

.github/dependabot.yml

@@ -52,6 +52,7 @@ updates:
       - "/kubernetes/personal/bookmarks/linkwarden"
       - "/kubernetes/personal/media/photoprism"
       - "/kubernetes/personal/notes/notesnook"
+      - "/kubernetes/personal/paperless"
       - "/kubernetes/production/buildpath"
       - "/kubernetes/production/semery-fr"
       - "/kubernetes/production/umami"

.sops.yaml

@@ -1,6 +1,6 @@
 creation_rules:
   - path_regex: .*values.yaml$
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
     pgp: DC6910268E657FF70BA7EC289974494E76938DDC
   - path_regex: .*.yaml
     encrypted_regex: ^(data|stringData|.*.key|.*.crt)$

kubernetes/kustomization.yaml

@@ -29,6 +29,7 @@ resources:
   - home/home-assistant
   - home/zigbee2mqtt
   # Personal (apps storing my own content, grouped by content type)
+  - personal/paperless
   - personal/media/photoprism
   - personal/notes/notesnook
   - personal/bookmarks/linkwarden

kubernetes/personal/paperless/cloudpirates-repository.yaml

@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cloudpirates
+  namespace: paperless
+spec:
+  type: oci
+  interval: 1h
+  url: oci://registry-1.docker.io/cloudpirates

kubernetes/personal/paperless/kustomization.yaml

@@ -0,0 +1,22 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: paperless
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - cloudpirates-repository.yaml
+  - postgres-release.yaml
+  - redis-release.yaml
+  - release.yaml
+secretGenerator:
+  - name: paperless-values
+    files:
+      - values.yaml=values.yaml
+  - name: paperless-postgres-values
+    files:
+      - values.yaml=postgres-values.yaml
+  - name: paperless-redis-values
+    files:
+      - values.yaml=redis-values.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/personal/paperless/kustomizeconfig.yaml

@@ -0,0 +1,6 @@
+nameReference:
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease

kubernetes/personal/paperless/namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: paperless
+  labels:
+    app.kubernetes.io/name: paperless
+    app.kubernetes.io/component: document-management

kubernetes/personal/paperless/postgres-release.yaml

@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: paperless-postgres
+  namespace: paperless
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: cloudpirates
+        namespace: paperless
+      chart: postgres
+      version: "0.20.0"
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: paperless-postgres-values

kubernetes/personal/paperless/postgres-values.yaml

@@ -0,0 +1,48 @@
+# CloudPirates PostgreSQL values for Paperless
+# Replaces the Docker Compose pplessdb service (postgres:16)
+image:
+    repository: postgres
+    tag: "16"
+    imagePullPolicy: IfNotPresent
+auth:
+    database: paperless
+    username: ENC[AES256_GCM,data:S7uuUdR9Xda5,iv:u70rbg0QT6tIOggzZ8caz3cRCh7DhtxaVj1KGvfgljU=,tag:RvERbQz/9Pr3SJmemm/BlA==,type:str]
+    password: ENC[AES256_GCM,data:n3rP8mKu6wM+WMLCFrQ=,iv:ge9HJkb6Y+WQodFwIC+kLr7MTFJwXwrwEdd4zIffos8=,tag:moiLXtBwnRQyREURuYk/Eg==,type:str]
+persistence:
+    enabled: true
+    size: 10Gi
+    accessModes:
+        - ReadWriteOnce
+resources:
+    requests:
+        cpu: 100m
+        memory: 256Mi
+    limits:
+        cpu: "1"
+        memory: 1Gi
+sops:
+    lastmodified: "2026-08-16T09:07:01Z"
+    mac: ENC[AES256_GCM,data:Tv9mLhZqqz8eBYS+IKUV5fgpRf+iGSkHZF4+fcxk7k6AH3XLF5tsN31wx3MLdA8Wnk+zADobJtAHx8onQufyV+pvON5/8IUFGZKOuKv7tB6gQBeaNfrVans+gBSqnufxCsXkIrcAS25QZM9mFEM4ZnbJUNFzNvkoGotRtnwaIkA=,iv:QQVnbx3UL9e1Z7gyBWE8QahtQcC/hQ233sIAv6Zg/W4=,tag:yX/9iCBvJh/GaWIdSydKmA==,type:str]
+    pgp:
+        - created_at: "2026-08-16T09:07:01Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//YXRqL71ibLBGFfmNZFEoFYJiPFfl/s7dwmd1hvyCHzY4
+            OA3i3ci7g/XLZYJIh+0xt/aLlgubDNwtgSKULn1T6jPKYec/eErPni4IEQOJYvLX
+            ZhJxrr7cxdm3kQ8sPw3lBzKa/fKfljrt0wsEeEligwHlqpbu8JutgGLW2qmVP7D2
+            58meumXOLZQylZysEbp8oCuRBzfyZ4dMrXMLzBXdv3TFm+PWUAnF+fB9L5UazLnf
+            fLjHXCEfpu73hg7mxuMCIanhvhwUbtBBS8bj+iR0CFrT2gBg4sdJcpEowCAlL1fR
+            kCtqPW44KP3Ho+1T8tSl3e0k0BFTxGCAfYJmv1JCMe2ejw3vr9rPZRZ8Ni/eXdoi
+            0C94eA009E2NCYWOLWnfTxMBjSKuyNpQGtRuLU/PrI3juuGCUY7VhX3EMxuqAdlG
+            zax3aJIBvAwuv1xlIbvvG2SPGnoSyLJ/Fd2mJlp49ZFYGGMtLtBXfgA50w+ng79j
+            hRFVbo2XmxfT6DM7TpfssWeGyNOkOS2khrmnOlej9VzUWMU69S1IxEAyQkZihOKf
+            PjzWzAx7N6r6JH0NUbJwM5wZ9TbqEfN7DqEI99N35Mdc9r51BOUr3BMiRBQQoLwI
+            fnfuauHMsPahsj5ndK5U3m62o7N0ezTzZqm8mDWyLH6NX0P3qnLmTQ6XzSIdsxXS
+            XgG0BHJfl+7I5Bki2b+PILhkIVu/DmJNRmGU+5nI3+2F/NruHEFs8OaQQthOOS7j
+            2QDPFVVAcNjWzHNkvYQOrIIBYGf084WsYlznACAcTyasp0LAamZc/S8sLt0RCas=
+            =qWxv
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    version: 3.10.2

kubernetes/personal/paperless/redis-release.yaml

@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: paperless-redis
+  namespace: paperless
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: cloudpirates
+        namespace: paperless
+      chart: redis
+      version: "0.34.16"
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: paperless-redis-values

kubernetes/personal/paperless/redis-values.yaml

@@ -0,0 +1,42 @@
+# CloudPirates Redis values for Paperless
+architecture: standalone
+auth:
+    enabled: false
+persistence:
+    enabled: true
+    size: 1Gi
+    accessModes:
+        - ReadWriteOnce
+resources:
+    requests:
+        cpu: 50m
+        memory: 64Mi
+    limits:
+        cpu: 500m
+        memory: 256Mi
+sops:
+    lastmodified: "2026-08-16T09:07:01Z"
+    mac: ENC[AES256_GCM,data:BQ9z3o4+aCrAdQvWJEXRWWcQLggmyoVi3YfqwdZUkYNNcECTZtlQsgK4/g2+ktuzlvUmuBuV0m5gZJ/HqEflVDXbhQiCtnKSSqJ1V/PNVFFCXans92uxzEl6EY++Qm+X07ookJiYv4leqruCm+uNdYlTWESnLe07TZhiTbN+7Z8=,iv:yzq3+U3fjbU8XQejllBynYmb+kexgOEiSMaYRGxvOTw=,tag:Nwn4kpQQXYpw97VTI9NL9Q==,type:str]
+    pgp:
+        - created_at: "2026-08-16T09:07:01Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/+JywlDn4kNsVcrVM+bNEImlKvu/leYNRbh+eTKVeBqTdo
+            H+vuBr7+a7EK01CWejH4z6vYrf6H7Q3ey+GjW1GYQGPBMFYVFK8eyNkwOlBej+0B
+            xbqZ17MwDi9ODh6rjtvZ7gz3bCPXM+LAXgaxBo1GBM+MJTmIJ+Wzwgq+h1/YBMBY
+            Q1ksGb2jzD9ZqpIo9uLfiTf2y2Go7n9DQyuvK3ddxL94lM7YAZGx+HHxM9xrKNfJ
+            ITUS9CGR8T/bckzDpGLWEJY2biK1p5bKU48kWItZf7kPQKpVp/d1XKY/I2kL+o8W
+            iBi6vq6nRKhdDP0G3Eml0weUattsQ/dELJPSOps0NXioGI8w4hK2SWASGTdChHwN
+            9ni0CWC41jhRIsmMZ5K25C2nAwyieVPN3gP6jWoUgovho2/CKr8lSJ0AWfapT7Sx
+            2jUXcSF8SUdQlDErDLeN1qTxS/6TWOw0E9baaPRJVc0FNpa5LZZ3uUc+kCih75vz
+            CoqrYX8AP5tiO4OELzfMcWhNkizHGPjcEwjus4f8gXu7iIi7pAD+MRoM04Cz1cFz
+            NQz3fFBT3acPLVyLqa0GEn7EdPNYeyMY0uCm7sOhbGGWlZB5oZ0Gfi2FmJR7birA
+            az8LVvwqUsgQtCf6AdzOoqp9oUugo5smHJZgF1MsQzMhZjLG0REkV2OCg0KqiZ/S
+            XgHul345KCekjoxm4egkjKW81F4FesW9ci5GcROWj1UHtgUq5Y6JwE7Qab31uvjt
+            bHmyW0DqH5daOzRzStCIpx89RAc1xQ6EAalD5Kvrxq7IUMGWkG0WGt1btfXudoM=
+            =Y4Aj
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    version: 3.10.2

kubernetes/personal/paperless/release.yaml

@@ -0,0 +1,22 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: paperless
+  namespace: paperless
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: paperless
+        namespace: paperless
+      chart: paperless
+      version: "11.4.0"
+      interval: 1m
+  dependsOn:
+    - name: paperless-postgres
+    - name: paperless-redis
+  valuesFrom:
+    - kind: Secret
+      name: paperless-values

kubernetes/personal/paperless/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: paperless
+  namespace: paperless
+spec:
+  interval: 1h
+  url: https://zekker6.github.io/helm-charts/

kubernetes/personal/paperless/values.yaml

@@ -0,0 +1,80 @@
+env:
+    PAPERLESS_SECRET_KEY: ENC[AES256_GCM,data:wFTf9ng/oLUgFUIYAsOMZWLUyqz95zopQlX5KgY9LFk+hsR2xEyOtQ==,iv:w7NPvFRRUsxK+MtDZavaYkVGBN5E8KQD5gwl4YXSA8E=,tag:usuV4LJrlSEMpOu0Tv8HXQ==,type:str]
+    # -- Redis connection (CloudPirates Redis chart service)
+    PAPERLESS_REDIS: redis://paperless-redis:6379
+    # -- DBENGINE must be explicit
+    PAPERLESS_DBENGINE: postgresql
+    # -- PostgreSQL service (CloudPirates Postgres chart)
+    PAPERLESS_DBHOST: paperless-postgres
+    PAPERLESS_DBPORT: "5432"
+    PAPERLESS_DBNAME: paperless
+    PAPERLESS_DBUSER: paperless
+    PAPERLESS_DBPASS: ENC[AES256_GCM,data:vyY2HtGJ/K0U8EkW8GY=,iv:4nIyQrsvD5chBAvnC7mXXoArRyDYfcYi/Bi1I+kutYU=,tag:JnVMFqNoFh6PyzlfZUY6Zw==,type:str]
+    # -- OCR
+    PAPERLESS_OCR_LANGUAGE: fra
+    PAPERLESS_OCR_LANGUAGES: fra eng
+    # -- OIDC integration via Authentik
+    PAPERLESS_APPS: allauth.socialaccount.providers.openid_connect
+    PAPERLESS_SOCIALACCOUNT_PROVIDERS: ENC[AES256_GCM,data:r71MklOTuRljOiBBHXECmj4pnQiqBst8JMasNDSIMENu20TOXPb/qTcwwsLEGsL569tUVplPRTo0/s+ix1CNZPf2HGoz6B9rJ00/Cxf6Ns6k2b1bXr1+7/zfcX9zXklSMfzC1NjiYpwqODr4K2jMcxY6WG8/QUSjvAlVwDO35butKv23oK2kFM5mRIoqeMiuxotmEpqP0xvVlGOWYonu5/F6O1bmBGQxsxRQDK4K4+9k8Gn00j5ZiMGpPetoboSBDMJID4vf9M2LgRP/r/1pwpnmYq2mjOZruJ2r8xZ9d8JYtxQvE/oBvrBtHPFGT8AIa92LyRDpxg6eEb+3lSEHon56rByQcnKSFGGJQiE80UNgmQx/dYDo119gZuRWrWAJp1t5d0tcOuk+64pC6FLj+a9niHSZ2Si6+Jc4AF3GRfQ3qGWNpY3Di4wM8RcNgjKJMWwbN8cYBZD+nyzMFBQsKN7a7cGJXqa4KknJR1GvoRPcPXXtresCasj9znQ5c/bPAjb8RhhNfcfRDRibBu/JOXJz9ulY1UpSONrxvXtbdbLsqExUTMBLfHw=,iv:CDXZXm1+UP2Ctp1/vJpLwWWPm6c+FD/F9FFRuH1GDwU=,tag:PQTYdaheTTu3gKT1CfjCog==,type:str]
+    PAPERLESS_ACCOUNT_DEFAULT_HTTP_PROTOCOL: http
+    PAPERLESS_TIME_ZONE: Europe/Paris
+    # -- Reject duplicates
+    PAPERLESS_CONSUMER_DELETE_DUPLICATES: "true"
+    PAPERLESS_PORT: "8000"
+ingress:
+    main:
+        enabled: true
+        hosts:
+            - host: paperless.lan
+              paths:
+                - path: /
+persistence:
+    data:
+        enabled: true
+        accessMode: ReadWriteOnce
+        size: 10Gi
+    media:
+        enabled: true
+        accessMode: ReadWriteOnce
+        size: 50Gi
+    consume:
+        enabled: true
+        accessMode: ReadWriteOnce
+        size: 5Gi
+    export:
+        enabled: true
+        accessMode: ReadWriteOnce
+        size: 5Gi
+resources:
+    requests:
+        cpu: 200m
+        memory: 512Mi
+    limits:
+        cpu: "2"
+        memory: 2Gi
+sops:
+    lastmodified: "2026-08-16T09:07:01Z"
+    mac: ENC[AES256_GCM,data:RXzsGHok4t1L8bgCrDGBpbjTXx/ZFPIf+MVmYQTznqTptKAmPqtaruhylEmB0r6lXCUi9HWHvBpjXROhtost4zRzg3d+O240VsVDHcbDEodHISVxD54Dhd18lDyHWVWpyhyMxbHY0RDW0H3Zz0+gAPHA0HDHdVPBK4doCBF+pQE=,iv:nvqLFy+lsXHAd58VGXL7r9qdnlKcyfaznhyRY5E2V8w=,tag:3E3zkbsHy5IdIs5HbtO1+A==,type:str]
+    pgp:
+        - created_at: "2026-08-16T09:07:01Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//VNeqlQFXKPGY/K3AvJLFpI38fD6SROdnEd0O4WHbtSMu
+            Cv15zBpF2bx5+P1bxBHpPCJNetNdltcLv6cV370pkew22VI67o+txfCLImVMhriK
+            zrM/SFGVeZvmXIQRhClegwPTPxjMo58RU229rDghjmlQOfNeitqUWOLkOZb6WkWF
+            uFsIKd9ulmA04V2USrD/IcK6Vcl3P5LZS/gTTqTsw87zXx1yUGn43CBlkJ0NQbjD
+            cWCfcvYJzLS58Jr65kSFZthjeb3k7n891OmoO1x/sW9DBa82ckmk1GBfelATCwpy
+            0Gt/3iR4SU7q2R0bpEPhE8W0pCk6nBv7/gsqSKDe5c1aABoBhBVwBecAE/LKVjrS
+            nIuj40ehPTWuaT1GJYzELy0iPQCNNrbCxBHaYcpY9Jkg1Z0Poun5j+QymTVRS/Qj
+            HOZQXgFzeLrXI6fZE1IeKOuBDxxCSRUiMn/watR2+Lwrpqoz3vvuZmLc5OU41Gw/
+            MHTOuFcLZ3gw3Gdt6umMqNKBrqBxxsbYtHDC8cNNPiKDg0ajXqm3x1Tfq9AiEnmm
+            eRbn2/5dLkMEZMA2QWdOx/1KNytvvzb9FxrwJOE4PBjTCsIyjn7I9X1drduy9xS9
+            z71fwdVkKD8yBdB+IiDf5/J3HPDTH+DYl8hYHQUaZwyV7K/taz1pslFprjJJdojS
+            XgF6lMymEyNvLn+LNGPpbAJizrwN/3IM25G712RpV1H8EjCxbh85nFnfegOZWAmM
+            GsD9dUkm3ose357y1ejh1HKh29HQdOyNP9mfZpybNj8L2/q9isVa3lIQepTJ+r0=
+            =Ok29
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    version: 3.10.2