Nix-Vibe public snapshot (squashed history)

2026-09-19 13:56:12 +01:00
commit aee8fb1e9b
119 changed files with 18895 additions and 0 deletions
@@ -0,0 +1,44 @@
+{ config
+, pkgs
+, lib
+, ...
+}:
+
+{
+  options.services.paperless-service = {
+    enable = lib.mkEnableOption "Paperless-ngx service";
+    passwordFile = lib.mkOption {
+      type = lib.types.path;
+      default = "/etc/nixos/paperless-password";
+      description = "Path to the file containing the admin password";
+    };
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 28981;
+      description = "Port to listen on";
+    };
+  };
+
+  config = lib.mkIf config.services.paperless-service.enable {
+    services.paperless = {
+      enable = true;
+      passwordFile = config.services.paperless-service.passwordFile;
+      # Listening on 0.0.0.0 but the firewall only opens the port on tailscale0,
+      # so Paperless is reachable over Tailscale only (not the LAN).
+      address = "0.0.0.0";
+      port = config.services.paperless-service.port;
+      settings = {
+        PAPERLESS_OCR_LANGUAGE = "eng";
+        # Set the URL to the Tailscale hostname
+        PAPERLESS_URL = "http://x1carbon:${toString config.services.paperless-service.port}";
+        # Allow requests from the Tailscale hostname
+        PAPERLESS_ALLOWED_HOSTS = "x1carbon,x1carbon.tailscale.net";
+      };
+    };
+
+    # Tailscale-only access: open the port on the tailscale0 interface only.
+    networking.firewall.interfaces.tailscale0.allowedTCPPorts = [
+      config.services.paperless-service.port
+    ];
+  };
+}