dotfiles/modules/nixos/services/paperless.nix
2024-01-21 03:19:19 +00:00

72 lines
2.0 KiB
Nix

# Paperless-ngx is a document scanning and management solution.
{ config, lib, ... }: {
config = lib.mkIf config.services.paperless.enable {
services.paperless = {
mediaDir = "/data/generic/paperless";
passwordFile = config.secrets.paperless.dest;
settings = {
PAPERLESS_OCR_USER_ARGS =
builtins.toJSON { invalidate_digital_signatures = true; };
# Enable if changing the path name in Caddy
# PAPERLESS_FORCE_SCRIPT_NAME = "/paperless";
# PAPERLESS_STATIC_URL = "/paperless/static/";
};
};
# Allow Nextcloud and user to see files
users.users.nextcloud.extraGroups =
lib.mkIf config.services.nextcloud.enable [ "paperless" ];
users.users.${config.user}.extraGroups = [ "paperless" ];
caddy.routes = [{
match = [{
host = [ config.hostnames.paperless ];
# path = [ "/paperless*" ]; # Change path name in Caddy
}];
handle = [{
handler = "reverse_proxy";
upstreams = [{
dial =
"localhost:${builtins.toString config.services.paperless.port}";
}];
}];
}];
secrets.paperless = {
source = ../../../private/prometheus.age;
dest = "${config.secretsDirectory}/paperless";
owner = "paperless";
group = "paperless";
permissions = "0440";
};
systemd.services.paperless-secret = {
requiredBy = [ "paperless.service" ];
before = [ "paperless.service" ];
};
# Fix permissions on a regular schedule
systemd.timers.paperless-permissions = {
timerConfig = {
OnCalendar = "*-*-* *:0/5"; # Every 5 minutes
Unit = "paperless-permissions.service";
};
wantedBy = [ "timers.target" ];
};
# Fix paperless shared permissions
systemd.services.paperless-permissions = {
description = "Allow group access to paperless files";
serviceConfig = { Type = "oneshot"; };
script = ''
find ${config.services.paperless.mediaDir} -type f -exec chmod 640 -- {} +
'';
};
};
}