diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e61e904..b3da7e2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -52,6 +52,7 @@ updates: - "/kubernetes/personal/bookmarks/linkwarden" - "/kubernetes/personal/media/photoprism" - "/kubernetes/personal/notes/notesnook" + - "/kubernetes/personal/paperless" - "/kubernetes/production/buildpath" - "/kubernetes/production/semery-fr" - "/kubernetes/production/umami" diff --git a/.sops.yaml b/.sops.yaml index 3b9b304..d3946d2 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -1,6 +1,6 @@ creation_rules: - path_regex: .*values.yaml$ - encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$ + encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$ pgp: DC6910268E657FF70BA7EC289974494E76938DDC - path_regex: .*.yaml encrypted_regex: ^(data|stringData|.*.key|.*.crt)$ diff --git a/kubernetes/kustomization.yaml b/kubernetes/kustomization.yaml index 3575f37..9666c63 100644 --- a/kubernetes/kustomization.yaml +++ b/kubernetes/kustomization.yaml @@ -29,6 +29,7 @@ resources: - home/home-assistant - home/zigbee2mqtt # Personal (apps storing my own content, grouped by content type) + - personal/paperless - personal/media/photoprism - personal/notes/notesnook - personal/bookmarks/linkwarden diff --git a/kubernetes/personal/paperless/cloudpirates-repository.yaml b/kubernetes/personal/paperless/cloudpirates-repository.yaml new file mode 100644 index 0000000..88b8b7e --- /dev/null +++ b/kubernetes/personal/paperless/cloudpirates-repository.yaml @@ -0,0 +1,9 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: cloudpirates + namespace: paperless +spec: + type: oci + interval: 1h + url: oci://registry-1.docker.io/cloudpirates diff --git a/kubernetes/personal/paperless/kustomization.yaml b/kubernetes/personal/paperless/kustomization.yaml new file mode 100644 index 0000000..2212d0d --- /dev/null +++ b/kubernetes/personal/paperless/kustomization.yaml @@ -0,0 +1,22 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: paperless +resources: + - namespace.yaml + - repository.yaml + - cloudpirates-repository.yaml + - postgres-release.yaml + - redis-release.yaml + - release.yaml +secretGenerator: + - name: paperless-values + files: + - values.yaml=values.yaml + - name: paperless-postgres-values + files: + - values.yaml=postgres-values.yaml + - name: paperless-redis-values + files: + - values.yaml=redis-values.yaml +configurations: + - kustomizeconfig.yaml diff --git a/kubernetes/personal/paperless/kustomizeconfig.yaml b/kubernetes/personal/paperless/kustomizeconfig.yaml new file mode 100644 index 0000000..4ea8252 --- /dev/null +++ b/kubernetes/personal/paperless/kustomizeconfig.yaml @@ -0,0 +1,6 @@ +nameReference: + - kind: Secret + version: v1 + fieldSpecs: + - path: spec/valuesFrom/name + kind: HelmRelease diff --git a/kubernetes/personal/paperless/namespace.yaml b/kubernetes/personal/paperless/namespace.yaml new file mode 100644 index 0000000..653ec45 --- /dev/null +++ b/kubernetes/personal/paperless/namespace.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: paperless + labels: + app.kubernetes.io/name: paperless + app.kubernetes.io/component: document-management diff --git a/kubernetes/personal/paperless/postgres-release.yaml b/kubernetes/personal/paperless/postgres-release.yaml new file mode 100644 index 0000000..fb72833 --- /dev/null +++ b/kubernetes/personal/paperless/postgres-release.yaml @@ -0,0 +1,19 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: paperless-postgres + namespace: paperless +spec: + interval: 1m + chart: + spec: + sourceRef: + kind: HelmRepository + name: cloudpirates + namespace: paperless + chart: postgres + version: "0.20.0" + interval: 1m + valuesFrom: + - kind: Secret + name: paperless-postgres-values diff --git a/kubernetes/personal/paperless/postgres-values.yaml b/kubernetes/personal/paperless/postgres-values.yaml new file mode 100644 index 0000000..6a67256 --- /dev/null +++ b/kubernetes/personal/paperless/postgres-values.yaml @@ -0,0 +1,48 @@ +# CloudPirates PostgreSQL values for Paperless +# Replaces the Docker Compose pplessdb service (postgres:16) +image: + repository: postgres + tag: "16" + imagePullPolicy: IfNotPresent +auth: + database: paperless + username: ENC[AES256_GCM,data:S7uuUdR9Xda5,iv:u70rbg0QT6tIOggzZ8caz3cRCh7DhtxaVj1KGvfgljU=,tag:RvERbQz/9Pr3SJmemm/BlA==,type:str] + password: ENC[AES256_GCM,data:n3rP8mKu6wM+WMLCFrQ=,iv:ge9HJkb6Y+WQodFwIC+kLr7MTFJwXwrwEdd4zIffos8=,tag:moiLXtBwnRQyREURuYk/Eg==,type:str] +persistence: + enabled: true + size: 10Gi + accessModes: + - ReadWriteOnce +resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: "1" + memory: 1Gi +sops: + lastmodified: "2026-08-16T09:07:01Z" + mac: ENC[AES256_GCM,data:Tv9mLhZqqz8eBYS+IKUV5fgpRf+iGSkHZF4+fcxk7k6AH3XLF5tsN31wx3MLdA8Wnk+zADobJtAHx8onQufyV+pvON5/8IUFGZKOuKv7tB6gQBeaNfrVans+gBSqnufxCsXkIrcAS25QZM9mFEM4ZnbJUNFzNvkoGotRtnwaIkA=,iv:QQVnbx3UL9e1Z7gyBWE8QahtQcC/hQ233sIAv6Zg/W4=,tag:yX/9iCBvJh/GaWIdSydKmA==,type:str] + pgp: + - created_at: "2026-08-16T09:07:01Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7uy4qQr71wiAQ//YXRqL71ibLBGFfmNZFEoFYJiPFfl/s7dwmd1hvyCHzY4 + OA3i3ci7g/XLZYJIh+0xt/aLlgubDNwtgSKULn1T6jPKYec/eErPni4IEQOJYvLX + ZhJxrr7cxdm3kQ8sPw3lBzKa/fKfljrt0wsEeEligwHlqpbu8JutgGLW2qmVP7D2 + 58meumXOLZQylZysEbp8oCuRBzfyZ4dMrXMLzBXdv3TFm+PWUAnF+fB9L5UazLnf + fLjHXCEfpu73hg7mxuMCIanhvhwUbtBBS8bj+iR0CFrT2gBg4sdJcpEowCAlL1fR + kCtqPW44KP3Ho+1T8tSl3e0k0BFTxGCAfYJmv1JCMe2ejw3vr9rPZRZ8Ni/eXdoi + 0C94eA009E2NCYWOLWnfTxMBjSKuyNpQGtRuLU/PrI3juuGCUY7VhX3EMxuqAdlG + zax3aJIBvAwuv1xlIbvvG2SPGnoSyLJ/Fd2mJlp49ZFYGGMtLtBXfgA50w+ng79j + hRFVbo2XmxfT6DM7TpfssWeGyNOkOS2khrmnOlej9VzUWMU69S1IxEAyQkZihOKf + PjzWzAx7N6r6JH0NUbJwM5wZ9TbqEfN7DqEI99N35Mdc9r51BOUr3BMiRBQQoLwI + fnfuauHMsPahsj5ndK5U3m62o7N0ezTzZqm8mDWyLH6NX0P3qnLmTQ6XzSIdsxXS + XgG0BHJfl+7I5Bki2b+PILhkIVu/DmJNRmGU+5nI3+2F/NruHEFs8OaQQthOOS7j + 2QDPFVVAcNjWzHNkvYQOrIIBYGf084WsYlznACAcTyasp0LAamZc/S8sLt0RCas= + =qWxv + -----END PGP MESSAGE----- + fp: DC6910268E657FF70BA7EC289974494E76938DDC + encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$ + version: 3.10.2 diff --git a/kubernetes/personal/paperless/redis-release.yaml b/kubernetes/personal/paperless/redis-release.yaml new file mode 100644 index 0000000..9078061 --- /dev/null +++ b/kubernetes/personal/paperless/redis-release.yaml @@ -0,0 +1,19 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: paperless-redis + namespace: paperless +spec: + interval: 1m + chart: + spec: + sourceRef: + kind: HelmRepository + name: cloudpirates + namespace: paperless + chart: redis + version: "0.34.16" + interval: 1m + valuesFrom: + - kind: Secret + name: paperless-redis-values diff --git a/kubernetes/personal/paperless/redis-values.yaml b/kubernetes/personal/paperless/redis-values.yaml new file mode 100644 index 0000000..1222bf6 --- /dev/null +++ b/kubernetes/personal/paperless/redis-values.yaml @@ -0,0 +1,42 @@ +# CloudPirates Redis values for Paperless +architecture: standalone +auth: + enabled: false +persistence: + enabled: true + size: 1Gi + accessModes: + - ReadWriteOnce +resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 500m + memory: 256Mi +sops: + lastmodified: "2026-08-16T09:07:01Z" + mac: ENC[AES256_GCM,data:BQ9z3o4+aCrAdQvWJEXRWWcQLggmyoVi3YfqwdZUkYNNcECTZtlQsgK4/g2+ktuzlvUmuBuV0m5gZJ/HqEflVDXbhQiCtnKSSqJ1V/PNVFFCXans92uxzEl6EY++Qm+X07ookJiYv4leqruCm+uNdYlTWESnLe07TZhiTbN+7Z8=,iv:yzq3+U3fjbU8XQejllBynYmb+kexgOEiSMaYRGxvOTw=,tag:Nwn4kpQQXYpw97VTI9NL9Q==,type:str] + pgp: + - created_at: "2026-08-16T09:07:01Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7uy4qQr71wiAQ/+JywlDn4kNsVcrVM+bNEImlKvu/leYNRbh+eTKVeBqTdo + H+vuBr7+a7EK01CWejH4z6vYrf6H7Q3ey+GjW1GYQGPBMFYVFK8eyNkwOlBej+0B + xbqZ17MwDi9ODh6rjtvZ7gz3bCPXM+LAXgaxBo1GBM+MJTmIJ+Wzwgq+h1/YBMBY + Q1ksGb2jzD9ZqpIo9uLfiTf2y2Go7n9DQyuvK3ddxL94lM7YAZGx+HHxM9xrKNfJ + ITUS9CGR8T/bckzDpGLWEJY2biK1p5bKU48kWItZf7kPQKpVp/d1XKY/I2kL+o8W + iBi6vq6nRKhdDP0G3Eml0weUattsQ/dELJPSOps0NXioGI8w4hK2SWASGTdChHwN + 9ni0CWC41jhRIsmMZ5K25C2nAwyieVPN3gP6jWoUgovho2/CKr8lSJ0AWfapT7Sx + 2jUXcSF8SUdQlDErDLeN1qTxS/6TWOw0E9baaPRJVc0FNpa5LZZ3uUc+kCih75vz + CoqrYX8AP5tiO4OELzfMcWhNkizHGPjcEwjus4f8gXu7iIi7pAD+MRoM04Cz1cFz + NQz3fFBT3acPLVyLqa0GEn7EdPNYeyMY0uCm7sOhbGGWlZB5oZ0Gfi2FmJR7birA + az8LVvwqUsgQtCf6AdzOoqp9oUugo5smHJZgF1MsQzMhZjLG0REkV2OCg0KqiZ/S + XgHul345KCekjoxm4egkjKW81F4FesW9ci5GcROWj1UHtgUq5Y6JwE7Qab31uvjt + bHmyW0DqH5daOzRzStCIpx89RAc1xQ6EAalD5Kvrxq7IUMGWkG0WGt1btfXudoM= + =Y4Aj + -----END PGP MESSAGE----- + fp: DC6910268E657FF70BA7EC289974494E76938DDC + encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$ + version: 3.10.2 diff --git a/kubernetes/personal/paperless/release.yaml b/kubernetes/personal/paperless/release.yaml new file mode 100644 index 0000000..f8ddc13 --- /dev/null +++ b/kubernetes/personal/paperless/release.yaml @@ -0,0 +1,22 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: paperless + namespace: paperless +spec: + interval: 1m + chart: + spec: + sourceRef: + kind: HelmRepository + name: paperless + namespace: paperless + chart: paperless + version: "11.4.0" + interval: 1m + dependsOn: + - name: paperless-postgres + - name: paperless-redis + valuesFrom: + - kind: Secret + name: paperless-values diff --git a/kubernetes/personal/paperless/repository.yaml b/kubernetes/personal/paperless/repository.yaml new file mode 100644 index 0000000..bbf3dc9 --- /dev/null +++ b/kubernetes/personal/paperless/repository.yaml @@ -0,0 +1,8 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: paperless + namespace: paperless +spec: + interval: 1h + url: https://zekker6.github.io/helm-charts/ diff --git a/kubernetes/personal/paperless/values.yaml b/kubernetes/personal/paperless/values.yaml new file mode 100644 index 0000000..80f6c0f --- /dev/null +++ b/kubernetes/personal/paperless/values.yaml @@ -0,0 +1,80 @@ +env: + PAPERLESS_SECRET_KEY: ENC[AES256_GCM,data:wFTf9ng/oLUgFUIYAsOMZWLUyqz95zopQlX5KgY9LFk+hsR2xEyOtQ==,iv:w7NPvFRRUsxK+MtDZavaYkVGBN5E8KQD5gwl4YXSA8E=,tag:usuV4LJrlSEMpOu0Tv8HXQ==,type:str] + # -- Redis connection (CloudPirates Redis chart service) + PAPERLESS_REDIS: redis://paperless-redis:6379 + # -- DBENGINE must be explicit + PAPERLESS_DBENGINE: postgresql + # -- PostgreSQL service (CloudPirates Postgres chart) + PAPERLESS_DBHOST: paperless-postgres + PAPERLESS_DBPORT: "5432" + PAPERLESS_DBNAME: paperless + PAPERLESS_DBUSER: paperless + PAPERLESS_DBPASS: ENC[AES256_GCM,data:vyY2HtGJ/K0U8EkW8GY=,iv:4nIyQrsvD5chBAvnC7mXXoArRyDYfcYi/Bi1I+kutYU=,tag:JnVMFqNoFh6PyzlfZUY6Zw==,type:str] + # -- OCR + PAPERLESS_OCR_LANGUAGE: fra + PAPERLESS_OCR_LANGUAGES: fra eng + # -- OIDC integration via Authentik + PAPERLESS_APPS: allauth.socialaccount.providers.openid_connect + PAPERLESS_SOCIALACCOUNT_PROVIDERS: ENC[AES256_GCM,data:r71MklOTuRljOiBBHXECmj4pnQiqBst8JMasNDSIMENu20TOXPb/qTcwwsLEGsL569tUVplPRTo0/s+ix1CNZPf2HGoz6B9rJ00/Cxf6Ns6k2b1bXr1+7/zfcX9zXklSMfzC1NjiYpwqODr4K2jMcxY6WG8/QUSjvAlVwDO35butKv23oK2kFM5mRIoqeMiuxotmEpqP0xvVlGOWYonu5/F6O1bmBGQxsxRQDK4K4+9k8Gn00j5ZiMGpPetoboSBDMJID4vf9M2LgRP/r/1pwpnmYq2mjOZruJ2r8xZ9d8JYtxQvE/oBvrBtHPFGT8AIa92LyRDpxg6eEb+3lSEHon56rByQcnKSFGGJQiE80UNgmQx/dYDo119gZuRWrWAJp1t5d0tcOuk+64pC6FLj+a9niHSZ2Si6+Jc4AF3GRfQ3qGWNpY3Di4wM8RcNgjKJMWwbN8cYBZD+nyzMFBQsKN7a7cGJXqa4KknJR1GvoRPcPXXtresCasj9znQ5c/bPAjb8RhhNfcfRDRibBu/JOXJz9ulY1UpSONrxvXtbdbLsqExUTMBLfHw=,iv:CDXZXm1+UP2Ctp1/vJpLwWWPm6c+FD/F9FFRuH1GDwU=,tag:PQTYdaheTTu3gKT1CfjCog==,type:str] + PAPERLESS_ACCOUNT_DEFAULT_HTTP_PROTOCOL: http + PAPERLESS_TIME_ZONE: Europe/Paris + # -- Reject duplicates + PAPERLESS_CONSUMER_DELETE_DUPLICATES: "true" + PAPERLESS_PORT: "8000" +ingress: + main: + enabled: true + hosts: + - host: paperless.lan + paths: + - path: / +persistence: + data: + enabled: true + accessMode: ReadWriteOnce + size: 10Gi + media: + enabled: true + accessMode: ReadWriteOnce + size: 50Gi + consume: + enabled: true + accessMode: ReadWriteOnce + size: 5Gi + export: + enabled: true + accessMode: ReadWriteOnce + size: 5Gi +resources: + requests: + cpu: 200m + memory: 512Mi + limits: + cpu: "2" + memory: 2Gi +sops: + lastmodified: "2026-08-16T09:07:01Z" + mac: ENC[AES256_GCM,data:RXzsGHok4t1L8bgCrDGBpbjTXx/ZFPIf+MVmYQTznqTptKAmPqtaruhylEmB0r6lXCUi9HWHvBpjXROhtost4zRzg3d+O240VsVDHcbDEodHISVxD54Dhd18lDyHWVWpyhyMxbHY0RDW0H3Zz0+gAPHA0HDHdVPBK4doCBF+pQE=,iv:nvqLFy+lsXHAd58VGXL7r9qdnlKcyfaznhyRY5E2V8w=,tag:3E3zkbsHy5IdIs5HbtO1+A==,type:str] + pgp: + - created_at: "2026-08-16T09:07:01Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7uy4qQr71wiAQ//VNeqlQFXKPGY/K3AvJLFpI38fD6SROdnEd0O4WHbtSMu + Cv15zBpF2bx5+P1bxBHpPCJNetNdltcLv6cV370pkew22VI67o+txfCLImVMhriK + zrM/SFGVeZvmXIQRhClegwPTPxjMo58RU229rDghjmlQOfNeitqUWOLkOZb6WkWF + uFsIKd9ulmA04V2USrD/IcK6Vcl3P5LZS/gTTqTsw87zXx1yUGn43CBlkJ0NQbjD + cWCfcvYJzLS58Jr65kSFZthjeb3k7n891OmoO1x/sW9DBa82ckmk1GBfelATCwpy + 0Gt/3iR4SU7q2R0bpEPhE8W0pCk6nBv7/gsqSKDe5c1aABoBhBVwBecAE/LKVjrS + nIuj40ehPTWuaT1GJYzELy0iPQCNNrbCxBHaYcpY9Jkg1Z0Poun5j+QymTVRS/Qj + HOZQXgFzeLrXI6fZE1IeKOuBDxxCSRUiMn/watR2+Lwrpqoz3vvuZmLc5OU41Gw/ + MHTOuFcLZ3gw3Gdt6umMqNKBrqBxxsbYtHDC8cNNPiKDg0ajXqm3x1Tfq9AiEnmm + eRbn2/5dLkMEZMA2QWdOx/1KNytvvzb9FxrwJOE4PBjTCsIyjn7I9X1drduy9xS9 + z71fwdVkKD8yBdB+IiDf5/J3HPDTH+DYl8hYHQUaZwyV7K/taz1pslFprjJJdojS + XgF6lMymEyNvLn+LNGPpbAJizrwN/3IM25G712RpV1H8EjCxbh85nFnfegOZWAmM + GsD9dUkm3ose357y1ejh1HKh29HQdOyNP9mfZpybNj8L2/q9isVa3lIQepTJ+r0= + =Ok29 + -----END PGP MESSAGE----- + fp: DC6910268E657FF70BA7EC289974494E76938DDC + encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$ + version: 3.10.2