+6

nixos/common/postgres.nix

reviewed

··· 1 1 + { pkgs, config, ... }: 2 2 + 3 3 + { 4 4 + services.postgresql.enable = true; 5 5 + services.postgresqlBackup.enable = true; 6 6 + }

+2

nixos/ferret/default.nix

reviewed

··· 4 4 imports = [ 5 5 ./configuration.nix 6 6 ./hardware-configuration.nix 7 7 + ../common/postgres.nix 7 8 ./media.nix 8 9 ./caddy.nix 10 10 + ./paperless.nix 9 11 ]; 10 12 11 13 security.polkit.enable = true;

+41

nixos/ferret/paperless.nix

reviewed

··· 1 1 + {config, ...}: 2 2 + let 3 3 + certloc = "/var/lib/acme/ferret.otter.place"; 4 4 + in { 5 5 + 6 6 + age.secrets.paperless-password.file = ../../secrets/eclipse/paperless-password.age; 7 7 + 8 8 + services.postgresql = { 9 9 + ensureDatabases = [config.services.paperless.user]; 10 10 + ensureUsers = [ 11 11 + { 12 12 + name = config.services.paperless.user; 13 13 + ensureDBOwnership = true; 14 14 + } 15 15 + ]; 16 16 + }; 17 17 + 18 18 + services.paperless = { 19 19 + enable = true; 20 20 + 21 21 + passwordFile = config.age.secrets.paperless-password.path; 22 22 + settings = { 23 23 + PAPERLESS_DBHOST = "/run/postgresql"; 24 24 + PAPERLESS_TIME_ZONE = config.time.timeZone; 25 25 + PAPERLESS_OCR_LANGUAGE = "deu+eng+fr"; 26 26 + PAPERLESS_ADMIN_USER = "alex"; 27 27 + PAPERLESS_URL = "https://paperless.ferret.otter.place"; 28 28 + }; 29 29 + }; 30 30 + 31 31 + # SSL config 32 32 + services.caddy = { 33 33 + virtualHosts."paperless.ferret.otter.place".extraConfig = '' 34 34 + reverse_proxy http://localhost:${toString config.services.paperless.port} 35 35 + 36 36 + tls ${certloc}/cert.pem ${certloc}/key.pem { 37 37 + protocols tls1.3 38 38 + } 39 39 + ''; 40 40 + }; 41 41 + }

+7

secrets/paperless-password.age

reviewed

··· 1 1 + age-encryption.org/v1 2 2 + -> ssh-ed25519 eJaLeQ 2D7xouv6vZldW1jCJUAOBtLn1eduBTx/nWwykvekyRc 3 3 + 3qa/nT/PiYgVrKJtX24pjFtdCTs5mSlkTeKrBbIbZ+0 4 4 + -> ssh-ed25519 PCx17Q YMBRYGcyTBtX4mV2ZgnGpMdn7hsws9X9OpsFD5ElCB4 5 5 + 44HCFrbFDsc247ZIUcMdlP2CwEv45bTzS/FfDk8yNx4 6 6 + --- kGfSmbGFNWOaXHlIPL8+5z++FF1g3IXmXM8Q5iuUMXE 7 7 + �E��N��JjR~u<��(Y��I���T���UJlR�M��BdDE�]^DNY%�

+1

secrets/secrets.nix

reviewed

··· 7 7 in 8 8 { 9 9 "caddy.age".publicKeys = [ alex ferret ]; 10 10 + "paperless-password.age".publicKeys = [ alex ferret ]; 10 11 }