Skip to content

feat(paperless-ngx): add paperless-ngx - #29

Merged
maverickd650 merged 1 commit into
mainfrom
paperless
Dec 5, 2025
Merged

feat(paperless-ngx): add paperless-ngx#29
maverickd650 merged 1 commit into
mainfrom
paperless

Conversation

@maverickd650

@maverickd650 maverickd650 commented Dec 5, 2025

Copy link
Copy Markdown
Owner

Manual Pull Request

🚀 Summary

📦 Affected Areas

  • HelmRelease
  • Kustomization
  • Secrets (SOPS)
  • Cluster Bootstrap / Repos
  • Ingress
  • Monitoring
  • VolSync / Backups
  • CI
  • Other:

✅ Checklist

  • Secrets encrypted with SOPS and committed as encrypted only
  • No plaintext secrets committed
  • Base domain, hostnames, and URLs are templated correctly
  • Certifcate issuer set correctly
  • Required Helm repositories are defined in ./repositories/helm
  • Integrations set correctly
  • Chart versions are correct vs upstream
  • Ingress annotations and rules are correct
  • Volsync setup correctly
  • Kustomizations reference correct chart and path
  • CI workflows (if applicable) run successfully
  • Namespace is correct and consistent
  • Privileged setup where necessary

🧠 Notes for Myself

@github-actions github-actions Bot added the area/kubernetes Changes made in Kubernetes directory. label Dec 5, 2025
@mav-bot

mav-bot Bot commented Dec 5, 2025

Copy link
Copy Markdown
Contributor 
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: media/paperless-ngx

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: media/paperless-ngx

@@ -0,0 +1,52 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: paperless-ngx
+  namespace: media
+spec:
+  decryption:
+    provider: sops
+  deletionPolicy: WaitForTermination
+  interval: 1h
+  patches:
+  - patch: |-
+      apiVersion: helm.toolkit.fluxcd.io/v2
+      kind: HelmRelease
+      metadata:
+        name: _
+      spec:
+        install:
+          crds: CreateReplace
+          strategy:
+            name: RetryOnFailure
+        rollback:
+          cleanupOnFail: true
+          recreate: true
+        upgrade:
+          cleanupOnFail: true
+          crds: CreateReplace
+          strategy:
+            name: RemediateOnFailure
+          remediation:
+            remediateLastFailure: true
+            retries: 2
+    target:
+      group: helm.toolkit.fluxcd.io
+      kind: HelmRelease
+  path: ./kubernetes/apps/media/paperless-ngx/app
+  postBuild:
+    substituteFrom:
+    - kind: Secret
+      name: cluster-secrets
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: media
+  wait: true
+
--- kubernetes/apps/media/paperless-ngx/app Kustomization: media/paperless-ngx HelmRelease: media/paperless-ngx

+++ kubernetes/apps/media/paperless-ngx/app Kustomization: media/paperless-ngx HelmRelease: media/paperless-ngx

@@ -0,0 +1,102 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: paperless-ngx
+    kustomize.toolkit.fluxcd.io/namespace: media
+  name: paperless-ngx
+  namespace: media
+spec:
+  chartRef:
+    kind: OCIRepository
+    name: paperless-ngx
+  install:
+    crds: CreateReplace
+    createNamespace: true
+    remediation:
+      retries: 3
+    strategy:
+      name: RetryOnFailure
+  interval: 1h
+  maxHistory: 3
+  rollback:
+    cleanupOnFail: true
+    recreate: true
+  timeout: 20m
+  uninstall:
+    keepHistory: false
+  upgrade:
+    cleanupOnFail: true
+    crds: CreateReplace
+    remediation:
+      remediateLastFailure: true
+      retries: 2
+    strategy:
+      name: RemediateOnFailure
+  values:
+    cnpg:
+      main:
+        backups:
+          credentials: s3
+          enabled: true
+        cluster:
+          singleNode: true
+        mode: recovery
+        recovery:
+          credentials: s3
+          method: object_store
+    credentials:
+      s3:
+        accessKey: ..PLACEHOLDER_S3ID..
+        bucket: ..PLACEHOLDER_S3PREFIX..-paperless
+        encrKey: ..PLACEHOLDER_S3KEY..
+        secretKey: ..PLACEHOLDER_S3KEY..
+        type: s3
+        url: https://placeholder.example
+    global:
+      stopAll: true
+    persistence:
+      consume:
+        enabled: true
+        mountPath: /consume
+        path: /mnt/media/filing/consume
+        server: 192.168.50.118
+        type: nfs
+      data:
+        volsync:
+        - credentials: s3
+          dest:
+            enabled: true
+          name: data
+          src:
+            enabled: true
+            trigger:
+              schedule: 30 1 * * *
+          type: restic
+      media:
+        enabled: true
+        mountPath: /media
+        path: /mnt/media/filing/store
+        server: 192.168.50.118
+        type: nfs
+    resources:
+      limits:
+        cpu: 5000m
+        memory: 10Gi
+    workload:
+      main:
+        podSpec:
+          containers:
+            main:
+              env:
+                PAPERLESS_ADMIN_MAIL: ..PLACEHOLDER_PSADMINE..
+                PAPERLESS_ADMIN_PASSWORD: ..PLACEHOLDER_PSADMINP..
+                PAPERLESS_ADMIN_USER: ..PLACEHOLDER_PSADMINU..
+                PAPERLESS_ENABLE_HTTP_REMOTE_USER: true
+                PAPERLESS_LOGOUT_REDIRECT_URL: ..PLACEHOLDER_PSLOURL..
+                PAPERLESS_OCR_LANGUAGE: eng
+                PAPERLESS_OCR_LANGUAGES: eng fra deu spa ita
+                PAPERLESS_URL: ..PLACEHOLDER_PSURL..
+                PAPERLESS_WEBSERVER_WORKERS: 2
+
--- kubernetes/apps/media/paperless-ngx/app Kustomization: media/paperless-ngx OCIRepository: media/paperless-ngx

+++ kubernetes/apps/media/paperless-ngx/app Kustomization: media/paperless-ngx OCIRepository: media/paperless-ngx

@@ -0,0 +1,18 @@

+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: paperless-ngx
+    kustomize.toolkit.fluxcd.io/namespace: media
+  name: paperless-ngx
+  namespace: media
+spec:
+  interval: 15m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 11.35.1
+  url: oci://oci.trueforge.org/truecharts/paperless-ngx
+
--- kubernetes/apps/media/paperless-ngx/app Kustomization: media/paperless-ngx HTTPRoute: media/paperless-ngx

+++ kubernetes/apps/media/paperless-ngx/app Kustomization: media/paperless-ngx HTTPRoute: media/paperless-ngx

@@ -0,0 +1,25 @@

+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    gatus.home-operations.com/endpoint: |
+      client:
+        dns-resolver: tcp://..PLACEHOLDER_UNIFI_HOST..:53
+  labels:
+    kustomize.toolkit.fluxcd.io/name: paperless-ngx
+    kustomize.toolkit.fluxcd.io/namespace: media
+  name: paperless-ngx
+  namespace: media
+spec:
+  hostnames:
+  - filing...PLACEHOLDER_SECRET_DOMAIN..
+  parentRefs:
+  - name: envoy-internal
+    namespace: network
+    sectionName: https
+  rules:
+  - backendRefs:
+    - name: paperless-ngx
+      port: 10140
+

@mav-bot

mav-bot Bot commented Dec 5, 2025

Copy link
Copy Markdown
Contributor 
--- HelmRelease: media/paperless-ngx ConfigMap: media/paperless-ngx-redis-health

+++ HelmRelease: media/paperless-ngx ConfigMap: media/paperless-ngx-redis-health

@@ -0,0 +1,82 @@

+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: paperless-ngx-redis-health
+  namespace: media
+  labels:
+    app.kubernetes.io/instance: paperless-ngx
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: redis
+    helm-revision: '1'
+    release: paperless-ngx
+data:
+  ping_liveness_local.sh: |-
+    #!/bin/bash
+    [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"
+    response=$(
+      timeout -s 3 $1 \
+      redis-cli \
+        -h localhost \
+        -p $REDIS_PORT \
+        ping
+    )
+    if [ "$response" != "PONG" ] && [ "$response" != "LOADING Redis is loading the dataset in memory" ]; then
+      echo "$response"
+      exit 1
+    fi
+  ping_liveness_local_and_master.sh: |-
+    script_dir="$(dirname "$0")"
+    exit_status=0
+    "$script_dir/ping_liveness_local.sh" $1 || exit_status=$?
+    "$script_dir/ping_liveness_master.sh" $1 || exit_status=$?
+    exit $exit_status
+  ping_liveness_master.sh: |-
+    #!/bin/bash
+    [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD"
+    response=$(
+      timeout -s 3 $1 \
+      redis-cli \
+        -h $REDIS_MASTER_HOST \
+        -p $REDIS_MASTER_PORT_NUMBER \
+        ping
+    )
+    if [ "$response" != "PONG" ] && [ "$response" != "LOADING Redis is loading the dataset in memory" ]; then
+      echo "$response"
+      exit 1
+    fi
+  ping_readiness_local.sh: |-
+    #!/bin/bash
+    [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"
+    response=$(
+      timeout -s 3 $1 \
+      redis-cli \
+        -h localhost \
+        -p $REDIS_PORT \
+        ping
+    )
+    if [ "$response" != "PONG" ]; then
+      echo "failed to connect using password: $REDIS_PASSWORD response: $response"
+      exit 1
+    fi
+  ping_readiness_local_and_master.sh: |-
+    script_dir="$(dirname "$0")"
+    exit_status=0
+    "$script_dir/ping_readiness_local.sh" $1 || exit_status=$?
+    "$script_dir/ping_readiness_master.sh" $1 || exit_status=$?
+    exit $exit_status
+  ping_readiness_master.sh: |-
+    #!/bin/bash
+    [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD"
+    response=$(
+      timeout -s 3 $1 \
+      redis-cli \
+        -h $REDIS_MASTER_HOST \
+        -p $REDIS_MASTER_PORT_NUMBER \
+        ping
+    )
+    if [ "$response" != "PONG" ]; then
+      echo "$response"
+      exit 1
+    fi
+
--- HelmRelease: media/paperless-ngx PersistentVolumeClaim: media/paperless-ngx-data

+++ HelmRelease: media/paperless-ngx PersistentVolumeClaim: media/paperless-ngx-data

@@ -0,0 +1,23 @@

+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: paperless-ngx-data
+  namespace: media
+  labels:
+    app.kubernetes.io/instance: paperless-ngx
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: paperless-ngx
+    helm-revision: '1'
+    release: paperless-ngx
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 100Gi
+  dataSourceRef:
+    kind: ReplicationDestination
+    name: paperless-ngx-data-data-dest
+    apiGroup: volsync.backube
+
--- HelmRelease: media/paperless-ngx Service: media/paperless-ngx-redis

+++ HelmRelease: media/paperless-ngx Service: media/paperless-ngx-redis

@@ -0,0 +1,26 @@

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: paperless-ngx-redis
+  namespace: media
+  labels:
+    app.kubernetes.io/instance: paperless-ngx
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: redis
+    helm-revision: '1'
+    release: paperless-ngx
+    service.name: main
+spec:
+  type: ClusterIP
+  publishNotReadyAddresses: false
+  ports:
+  - name: main
+    port: 6379
+    protocol: TCP
+    targetPort: 6379
+  selector:
+    pod.name: main
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/instance: paperless-ngx
+
--- HelmRelease: media/paperless-ngx Service: media/paperless-ngx

+++ HelmRelease: media/paperless-ngx Service: media/paperless-ngx

@@ -0,0 +1,26 @@

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: paperless-ngx
+  namespace: media
+  labels:
+    app.kubernetes.io/instance: paperless-ngx
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: paperless-ngx
+    helm-revision: '1'
+    release: paperless-ngx
+    service.name: main
+spec:
+  type: ClusterIP
+  publishNotReadyAddresses: false
+  ports:
+  - name: main
+    port: 10140
+    protocol: TCP
+    targetPort: 8000
+  selector:
+    pod.name: main
+    app.kubernetes.io/name: paperless-ngx
+    app.kubernetes.io/instance: paperless-ngx
+
--- HelmRelease: media/paperless-ngx Deployment: media/paperless-ngx

+++ HelmRelease: media/paperless-ngx Deployment: media/paperless-ngx

@@ -0,0 +1,447 @@

+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: paperless-ngx
+  namespace: media
+  labels:
+    app.kubernetes.io/instance: paperless-ngx
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: paperless-ngx
+    helm-revision: '1'
+    release: paperless-ngx
+spec:
+  replicas: 0
+  revisionHistoryLimit: 3
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      pod.name: main
+      app.kubernetes.io/name: paperless-ngx
+      app.kubernetes.io/instance: paperless-ngx
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: paperless-ngx
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: paperless-ngx
+        helm-revision: '1'
+        pod.lifecycle: permanent
+        pod.name: main
+        release: paperless-ngx
+        truecharts.org/pvc: data
+      annotations:
+        checksum/cnpg: 09206ce3d3e9134dd5c00dcb44cc7e42f8a27ef3aca82e6e4a55a8498897a2f8
+        checksum/configmaps: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
+        checksum/mariadb: 09c85576cb45b1eecd1467732b11ea8fa3363b0105c465f02a6ad64991521d52
+        checksum/mongodb: 09c85576cb45b1eecd1467732b11ea8fa3363b0105c465f02a6ad64991521d52
+        checksum/persistence: 2077067821cf55dfa4782466af07eb973a41c110e59bbd0b7f59765673524fe7
+        checksum/services: 7a3ebb832b2e38b5912f1803ffe219fe647b5cd1c9acac2fb62aa8ae9733b2e4
+        checksum/solr: 29c14feeaddbf7762052db593898d274941f539cee681ddc613957587686f347
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: false
+      runtimeClassName: null
+      hostNetwork: false
+      hostPID: false
+      hostIPC: false
+      shareProcessNamespace: false
+      enableServiceLinks: false
+      restartPolicy: Always
+      nodeSelector:
+        kubernetes.io/arch: amd64
+      affinity:
+        podAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - topologyKey: kubernetes.io/hostname
+            labelSelector:
+              matchExpressions:
+              - key: truecharts.org/pvc
+                operator: In
+                values:
+                - data
+      topologySpreadConstraints:
+      - maxSkew: 1
+        whenUnsatisfiable: ScheduleAnyway
+        topologyKey: kubernetes.io/hostname
+        labelSelector:
+          matchLabels:
+            pod.name: main
+            app.kubernetes.io/name: paperless-ngx
+            app.kubernetes.io/instance: paperless-ngx
+        nodeAffinityPolicy: Honor
+        nodeTaintsPolicy: Honor
+      dnsPolicy: ClusterFirst
+      dnsConfig:
+        options:
+        - name: ndots
+          value: '1'
+      terminationGracePeriodSeconds: 60
+      securityContext:
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        supplementalGroups:
+        - 568
+        sysctls: []
+      hostUsers: true
+      containers:
+      - name: paperless-ngx
+        image: ghcr.io/paperless-ngx/paperless-ngx:2.20.0@sha256:8ffd737c69a569bbdadc118e7f54b0b1050ffac2868fdf9e390a68cb7c82a79d
+        imagePullPolicy: IfNotPresent
+        tty: false
+        stdin: false
+        ports:
+        - name: main
+          containerPort: 8000
+          protocol: TCP
+          hostPort: null
+        volumeMounts:
+        - name: consume
+          mountPath: /consume
+          readOnly: false
+        - name: data
+          mountPath: /data
+          readOnly: false
+        - name: devshm
+          mountPath: /dev/shm
+          readOnly: false
+        - name: media
+          mountPath: /media
+          readOnly: false
+        - name: shared
+          mountPath: /shared
+          readOnly: false
+        - name: tmp
+          mountPath: /tmp
+          readOnly: false
+        - name: varlogs
+          mountPath: /var/logs
+          readOnly: false
+        livenessProbe:
+          httpGet:
+            port: 8000
+            path: /
+            scheme: HTTP
+            httpHeaders:
+            - name: Host
+              value: localhost
+          initialDelaySeconds: 12
+          failureThreshold: 5
+          successThreshold: 1
+          timeoutSeconds: 5
+          periodSeconds: 15
+        readinessProbe:
+          httpGet:
+            port: 8000
+            path: /
+            scheme: HTTP
+            httpHeaders:
+            - name: Host
+              value: localhost
+          initialDelaySeconds: 10
+          failureThreshold: 4
+          successThreshold: 2
+          timeoutSeconds: 5
+          periodSeconds: 12
+        startupProbe:
+          httpGet:
+            port: 8000
+            path: /
+            scheme: HTTP
+            httpHeaders:
+            - name: Host
+              value: localhost
+          initialDelaySeconds: 10
+          failureThreshold: 60
+          successThreshold: 1
+          timeoutSeconds: 3
+          periodSeconds: 5
+        resources:
+          requests:
+            cpu: 75m
+            memory: 200Mi
+          limits:
+            cpu: 5000m
+            memory: 10Gi
+        securityContext:
+          runAsNonRoot: false
+          runAsUser: 0
+          runAsGroup: 0
+          readOnlyRootFilesystem: false
+          allowPrivilegeEscalation: false
+          privileged: false
+          seccompProfile:
+            type: RuntimeDefault
+          capabilities:
+            add:
+            - CHOWN
+            - SETUID
+            - SETGID
+            - FOWNER
+            - DAC_OVERRIDE
+            drop:
+            - ALL
+        env:
+        - name: TZ
+          value: UTC
+        - name: UMASK
+          value: '0022'
+        - name: UMASK_SET
+          value: '0022'
+        - name: NVIDIA_VISIBLE_DEVICES
+          value: void
+        - name: PUID
+          value: '568'
+        - name: USER_ID
+          value: '568'
+        - name: UID
+          value: '568'
+        - name: PGID
+          value: '568'
+        - name: GROUP_ID
+          value: '568'
+        - name: GID
+          value: '568'
+        - name: PAPERLESS_ADMIN_MAIL
+          value: ..PLACEHOLDER_PSADMINE..
+        - name: PAPERLESS_ADMIN_PASSWORD
+          value: ..PLACEHOLDER_PSADMINP..
+        - name: PAPERLESS_ADMIN_USER
+          value: ..PLACEHOLDER_PSADMINU..
+        - name: PAPERLESS_CONSUMPTION_DIR
+          value: /consume/
+        - name: PAPERLESS_DATA_DIR
+          value: /data/
+        - name: PAPERLESS_DBHOST
+          valueFrom:
+            secretKeyRef:
+              key: host
+              name: paperless-ngx-cnpg-main-urls
+        - name: PAPERLESS_DBNAME
+          value: paperless-ng
+        - name: PAPERLESS_DBPASS
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: paperless-ngx-cnpg-main-user
+        - name: PAPERLESS_DBPORT
+          value: '5432'
+        - name: PAPERLESS_DBUSER
+          value: paperless-ng
+        - name: PAPERLESS_ENABLE_HTTP_REMOTE_USER
+          value: 'true'
+        - name: PAPERLESS_LOGOUT_REDIRECT_URL
+          value: ..PLACEHOLDER_PSLOURL..
+        - name: PAPERLESS_MEDIA_ROOT
+          value: /media/
+        - name: PAPERLESS_OCR_LANGUAGE
+          value: eng
+        - name: PAPERLESS_OCR_LANGUAGES
+          value: eng fra deu spa ita
+        - name: PAPERLESS_PORT
+          value: '8000'
+        - name: PAPERLESS_REDIS
+          valueFrom:
+            secretKeyRef:
+              key: url
+              name: paperless-ngx-rediscreds
+        - name: PAPERLESS_SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              key: PAPERLESS_SECRET_KEY
+              name: paperless-ngx-secrets
+        - name: PAPERLESS_TIKA_ENABLED
+          value: '0'
+        - name: PAPERLESS_TIKA_ENDPOINT
+          value: http://paperless-ngx-tika:9998
+        - name: PAPERLESS_TIKA_GOTENBERG_ENDPOINT
+          value: http://paperless-ngx-gotenberg:3000
+        - name: PAPERLESS_TIME_ZONE
+          value: UTC
+        - name: PAPERLESS_URL
+          value: ..PLACEHOLDER_PSURL..
+        - name: PAPERLESS_WEBSERVER_WORKERS
+          value: '2'
+        - name: USERMAP_GID
+          value: '568'
+        - name: USERMAP_UID
+          value: '568'
+      initContainers:
+      - name: paperless-ngx-system-cnpg-wait
+        image: oci.trueforge.org/containerforge/postgresql-client:1.1.0
+        imagePullPolicy: IfNotPresent
+        tty: false
+        stdin: false
+        command:
+        - /bin/sh
+        - -c
+        - |-
+          /bin/sh <<'EOF'
+          echo "Executing DB waits..."
+          echo "Testing Database availability on [CNPG RW]"
+          until
+            echo "Testing database on url: [paperless-ngx-cnpg-main-rw]"
+            pg_isready -U paperless-ng -d paperless-ng -h paperless-ngx-cnpg-main-rw
+            do sleep 5
+          done
+          echo "Database available on url: [paperless-ngx-cnpg-main-rw]"
+          echo "Done executing DB waits..."
+          EOF
+        volumeMounts:
+        - name: devshm
+          mountPath: /dev/shm
+          readOnly: false
+        - name: shared
+          mountPath: /shared
+          readOnly: false
+        - name: tmp
+          mountPath: /tmp
+          readOnly: false
+        - name: varlogs
+          mountPath: /var/logs
+          readOnly: false
+        resources:
+          requests:
+            cpu: 10m
+            memory: 50Mi
+          limits:
+            cpu: 500m
+            memory: 512Mi
+        securityContext:
+          runAsNonRoot: true
+          runAsUser: 568
+          runAsGroup: 568
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
+          privileged: false
+          seccompProfile:
+            type: RuntimeDefault
+          capabilities:
+            add: []
+            drop:
+            - ALL
+        env:
+        - name: TZ
+          value: UTC
+        - name: UMASK
+          value: '0022'
+        - name: UMASK_SET
+          value: '0022'
+        - name: NVIDIA_VISIBLE_DEVICES
+          value: void
+        - name: S6_READ_ONLY_ROOT
[Diff truncated by flux-local]
--- HelmRelease: media/paperless-ngx StatefulSet: media/paperless-ngx-redis

+++ HelmRelease: media/paperless-ngx StatefulSet: media/paperless-ngx-redis

@@ -0,0 +1,227 @@

+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: paperless-ngx-redis
+  namespace: media
+  labels:
+    app.kubernetes.io/instance: paperless-ngx
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: redis
+    helm-revision: '1'
+    release: paperless-ngx
+spec:
+  replicas: 0
+  revisionHistoryLimit: 3
+  serviceName: paperless-ngx-redis
+  updateStrategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      pod.name: main
+      app.kubernetes.io/name: redis
+      app.kubernetes.io/instance: paperless-ngx
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: paperless-ngx
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: redis
+        helm-revision: '1'
+        pod.lifecycle: permanent
+        pod.name: main
+        release: paperless-ngx
+      annotations:
+        checksum/cnpg: fc940fff4269c53072f7039f0811133e9b83400670af014010bf50d3f13740f4
+        checksum/configmaps: e4ff2990e1b108efb5fc391e633d1bb258a621411ef64149c58626f3a7451ff6
+        checksum/mariadb: 09c85576cb45b1eecd1467732b11ea8fa3363b0105c465f02a6ad64991521d52
+        checksum/mongodb: 09c85576cb45b1eecd1467732b11ea8fa3363b0105c465f02a6ad64991521d52
+        checksum/persistence: 596e0b956bd4bdfb4d70ff2e7dde67dc31cb5475cc00cf96d97522d423c74376
+        checksum/services: 1fbe77c7cddc2e9997579990c10c46e0224ee9bc92911122de33093d0550ad9f
+        checksum/solr: 29c14feeaddbf7762052db593898d274941f539cee681ddc613957587686f347
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: false
+      runtimeClassName: null
+      hostNetwork: false
+      hostPID: false
+      hostIPC: false
+      shareProcessNamespace: false
+      enableServiceLinks: false
+      restartPolicy: Always
+      nodeSelector:
+        kubernetes.io/arch: amd64
+      topologySpreadConstraints:
+      - maxSkew: 1
+        whenUnsatisfiable: ScheduleAnyway
+        topologyKey: kubernetes.io/hostname
+        labelSelector:
+          matchLabels:
+            pod.name: main
+            app.kubernetes.io/name: redis
+            app.kubernetes.io/instance: paperless-ngx
+        nodeAffinityPolicy: Honor
+        nodeTaintsPolicy: Honor
+      dnsPolicy: ClusterFirst
+      dnsConfig:
+        options:
+        - name: ndots
+          value: '1'
+      terminationGracePeriodSeconds: 60
+      securityContext:
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        supplementalGroups:
+        - 568
+        sysctls: []
+      hostUsers: true
+      containers:
+      - name: paperless-ngx-redis
+        image: docker.io/bitnamisecure/redis:latest@sha256:c9fe12d04ead99c483a030768aa80b3bb8a96d254bb6d02d0fb30374c53077e1
+        imagePullPolicy: IfNotPresent
+        tty: false
+        stdin: false
+        ports:
+        - name: main
+          containerPort: 6379
+          protocol: TCP
+          hostPort: null
+        volumeMounts:
+        - name: devshm
+          mountPath: /dev/shm
+          readOnly: false
+        - name: redis-health
+          mountPath: /health
+          readOnly: false
+        - name: shared
+          mountPath: /shared
+          readOnly: false
+        - name: tmp
+          mountPath: /tmp
+          readOnly: false
+        - name: varlogs
+          mountPath: /var/logs
+          readOnly: false
+        - name: varrun
+          mountPath: /var/run
+          readOnly: false
+        livenessProbe:
+          exec:
+            command:
+            - sh
+            - -c
+            - /health/ping_liveness_local.sh 2
+          initialDelaySeconds: 12
+          failureThreshold: 5
+          successThreshold: 1
+          timeoutSeconds: 5
+          periodSeconds: 15
+        readinessProbe:
+          exec:
+            command:
+            - sh
+            - -c
+            - /health/ping_readiness_local.sh 2
+          initialDelaySeconds: 10
+          failureThreshold: 4
+          successThreshold: 2
+          timeoutSeconds: 5
+          periodSeconds: 12
+        startupProbe:
+          exec:
+            command:
+            - sh
+            - -c
+            - /health/ping_readiness_local.sh 2
+          initialDelaySeconds: 10
+          failureThreshold: 60
+          successThreshold: 1
+          timeoutSeconds: 3
+          periodSeconds: 5
+        resources:
+          requests:
+            cpu: 75m
+            memory: 200Mi
+          limits:
+            cpu: 1500m
+            memory: 2400Mi
+        securityContext:
+          runAsNonRoot: false
+          runAsUser: 568
+          runAsGroup: 0
+          readOnlyRootFilesystem: false
+          allowPrivilegeEscalation: false
+          privileged: false
+          seccompProfile:
+            type: RuntimeDefault
+          capabilities:
+            add: []
+            drop:
+            - ALL
+        env:
+        - name: TZ
+          value: UTC
+        - name: UMASK
+          value: '0022'
+        - name: UMASK_SET
+          value: '0022'
+        - name: NVIDIA_VISIBLE_DEVICES
+          value: void
+        - name: PUID
+          value: '568'
+        - name: USER_ID
+          value: '568'
+        - name: UID
+          value: '568'
+        - name: PGID
+          value: '568'
+        - name: GROUP_ID
+          value: '568'
+        - name: GID
+          value: '568'
+        - name: ALLOW_EMPTY_PASSWORD
+          value: 'yes'
+        - name: REDIS_PASSWORD
+          value: PLACEHOLDERPASSWORD
+        - name: REDIS_PORT
+          value: '6379'
+        - name: REDIS_REPLICATION_MODE
+          value: master
+      volumes:
+      - name: redis-health
+        configMap:
+          name: paperless-ngx-redis-health
+          defaultMode: 493
+          optional: false
+          items:
+          - key: ping_readiness_local.sh
+            path: ping_readiness_local.sh
+          - key: ping_liveness_local.sh
+            path: ping_liveness_local.sh
+          - key: ping_readiness_master.sh
+            path: ping_readiness_master.sh
+          - key: ping_liveness_master.sh
+            path: ping_liveness_master.sh
+          - key: ping_liveness_local_and_master.sh
+            path: ping_liveness_local_and_master.sh
+          - key: ping_readiness_local_and_master.sh
+            path: ping_readiness_local_and_master.sh
+      - name: devshm
+        emptyDir:
+          medium: Memory
+          sizeLimit: 2400Mi
+      - name: shared
+        emptyDir: {}
+      - name: tmp
+        emptyDir:
+          medium: Memory
+          sizeLimit: 2400Mi
+      - name: varlogs
+        emptyDir:
+          medium: Memory
+          sizeLimit: 2400Mi
+      - name: varrun
+        emptyDir:
+          medium: Memory
+          sizeLimit: 2400Mi
+
--- HelmRelease: media/paperless-ngx Cluster: media/paperless-ngx-cnpg-main

+++ HelmRelease: media/paperless-ngx Cluster: media/paperless-ngx-cnpg-main

@@ -0,0 +1,88 @@

+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: paperless-ngx-cnpg-main
+  namespace: media
+  labels:
+    cnpg.io/reload: 'on'
+    app.kubernetes.io/instance: paperless-ngx
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: paperless-ngx
+    helm-revision: '1'
+    release: paperless-ngx
+  annotations:
+    cnpg.io/hibernation: 'on'
+    cnpg.io/skipEmptyWalArchiveCheck: enabled
+spec:
+  imageName: ghcr.io/cloudnative-pg/postgresql:16.11
+  postgresUID: 26
+  postgresGID: 26
+  enableSuperuserAccess: true
+  primaryUpdateStrategy: unsupervised
+  primaryUpdateMethod: switchover
+  logLevel: info
+  instances: 2
+  nodeMaintenanceWindow:
+    inProgress: true
+    reusePVC: true
+  resources:
+    requests:
+      cpu: 75m
+      memory: 200Mi
+    limits:
+      cpu: 5000m
+      memory: 10Gi
+  storage:
+    pvcTemplate:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 100Gi
+  walStorage:
+    pvcTemplate:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 100Gi
+  bootstrap:
+    recovery:
+      secret:
+        name: paperless-ngx-cnpg-main-user
+      database: paperless-ng
+      owner: paperless-ng
+      source: paperless-ngx-cnpg-main
+  externalClusters:
+  - name: paperless-ngx-cnpg-main
+    barmanObjectStore:
+      endpointURL: https://placeholder.example
+      destinationPath: s3://..PLACEHOLDER_S3PREFIX..-paperless/paperless-ngx/cnpg
+      serverName: paperless-ngx-cnpg-main
+      s3Credentials:
+        accessKeyId:
+          name: paperless-ngx-cnpg-main-provider-recovery-s3-creds
+          key: ACCESS_KEY_ID
+        secretAccessKey:
+          name: paperless-ngx-cnpg-main-provider-recovery-s3-creds
+          key: ACCESS_SECRET_KEY
+  backup:
+    retentionPolicy: 30d
+    barmanObjectStore:
+      data:
+        jobs: 2
+        compression: bzip2
+      wal:
+        compression: bzip2
+      endpointURL: https://placeholder.example
+      destinationPath: s3://..PLACEHOLDER_S3PREFIX..-paperless/paperless-ngx/cnpg
+      serverName: paperless-ngx-cnpg-main
+      s3Credentials:
+        accessKeyId:
+          name: paperless-ngx-cnpg-main-provider-backup-s3-creds
+          key: ACCESS_KEY_ID
+        secretAccessKey:
+          name: paperless-ngx-cnpg-main-provider-backup-s3-creds
+          key: ACCESS_SECRET_KEY
+
--- HelmRelease: media/paperless-ngx ReplicationDestination: media/paperless-ngx-data-data-dest

+++ HelmRelease: media/paperless-ngx ReplicationDestination: media/paperless-ngx-data-data-dest

@@ -0,0 +1,29 @@

+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationDestination
+metadata:
+  name: paperless-ngx-data-data-dest
+  namespace: media
+  labels:
+    app.kubernetes.io/instance: paperless-ngx
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: paperless-ngx
+    helm-revision: '1'
+    release: paperless-ngx
+spec:
+  trigger:
+    manual: restore-once
+  restic:
+    repository: paperless-ngx-data-volsync-data
+    copyMethod: Snapshot
+    capacity: 100Gi
+    cleanupTempPVC: false
+    cleanupCachePVC: false
+    accessModes:
+    - ReadWriteOnce
+    cacheCapacity: 10Gi
+    moverSecurityContext:
+      runAsUser: 0
+      runAsGroup: 0
+      fsGroup: 568
+
--- HelmRelease: media/paperless-ngx ReplicationSource: media/paperless-ngx-data-data

+++ HelmRelease: media/paperless-ngx ReplicationSource: media/paperless-ngx-data-data

@@ -0,0 +1,35 @@

+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: paperless-ngx-data-data
+  namespace: media
+  labels:
+    app.kubernetes.io/instance: paperless-ngx
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: paperless-ngx
+    helm-revision: '1'
+    release: paperless-ngx
+spec:
+  sourcePVC: paperless-ngx-data
+  trigger:
+    schedule: 30 1 * * *
+  restic:
+    repository: paperless-ngx-data-volsync-data
+    copyMethod: Snapshot
+    pruneIntervalDays: 7
+    unlock: '20251205210640'
+    retain:
+      hourly: 6
+      daily: 5
+      weekly: 4
+      monthly: 3
+      yearly: 1
+    accessModes:
+    - ReadWriteOnce
+    cacheCapacity: 10Gi
+    moverSecurityContext:
+      runAsUser: 0
+      runAsGroup: 0
+      fsGroup: 568
+
--- HelmRelease: media/paperless-ngx ScheduledBackup: media/paperless-ngx-cnpg-main-sched-backup-daily-backup

+++ HelmRelease: media/paperless-ngx ScheduledBackup: media/paperless-ngx-cnpg-main-sched-backup-daily-backup

@@ -0,0 +1,21 @@

+---
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: paperless-ngx-cnpg-main-sched-backup-daily-backup
+  namespace: media
+  labels:
+    cnpg.io/cluster: paperless-ngx-cnpg-main
+    app.kubernetes.io/instance: paperless-ngx
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: paperless-ngx
+    helm-revision: '1'
+    release: paperless-ngx
+spec:
+  schedule: 0 0 0 * * *
+  backupOwnerReference: self
+  suspend: true
+  immediate: true
+  cluster:
+    name: paperless-ngx-cnpg-main
+

@maverickd650
maverickd650 merged commit 72ac269 into main Dec 5, 2025
7 checks passed
@maverickd650
maverickd650 deleted the paperless branch December 5, 2025 21:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/kubernetes Changes made in Kubernetes directory.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@maverickd650