{ config
, pkgs
, lib
, ...
}:

{
  options.services.paperless-service = {
    enable = lib.mkEnableOption "Paperless-ngx service";
    passwordFile = lib.mkOption {
      type = lib.types.path;
      default = "/etc/nixos/paperless-password";
      description = "Path to the file containing the admin password";
    };
    port = lib.mkOption {
      type = lib.types.port;
      default = 28981;
      description = "Port to listen on";
    };
  };

  config = lib.mkIf config.services.paperless-service.enable {
    services.paperless = {
      enable = true;
      passwordFile = config.services.paperless-service.passwordFile;
      # Listening on 0.0.0.0 but the firewall only opens the port on tailscale0,
      # so Paperless is reachable over Tailscale only (not the LAN).
      address = "0.0.0.0";
      port = config.services.paperless-service.port;
      settings = {
        PAPERLESS_OCR_LANGUAGE = "eng";
        # Set the URL to the Tailscale hostname
        PAPERLESS_URL = "http://x1carbon:${toString config.services.paperless-service.port}";
        # Allow requests from the Tailscale hostname
        PAPERLESS_ALLOWED_HOSTS = "x1carbon,x1carbon.tailscale.net";
      };
    };

    # Tailscale-only access: open the port on the tailscale0 interface only.
    networking.firewall.interfaces.tailscale0.allowedTCPPorts = [
      config.services.paperless-service.port
    ];
  };
}