45 lines
1.4 KiB
Nix
45 lines
1.4 KiB
Nix
{ config
|
|
, pkgs
|
|
, lib
|
|
, ...
|
|
}:
|
|
|
|
{
|
|
options.services.paperless-service = {
|
|
enable = lib.mkEnableOption "Paperless-ngx service";
|
|
passwordFile = lib.mkOption {
|
|
type = lib.types.path;
|
|
default = "/etc/nixos/paperless-password";
|
|
description = "Path to the file containing the admin password";
|
|
};
|
|
port = lib.mkOption {
|
|
type = lib.types.port;
|
|
default = 28981;
|
|
description = "Port to listen on";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf config.services.paperless-service.enable {
|
|
services.paperless = {
|
|
enable = true;
|
|
passwordFile = config.services.paperless-service.passwordFile;
|
|
# Listening on 0.0.0.0 but the firewall only opens the port on tailscale0,
|
|
# so Paperless is reachable over Tailscale only (not the LAN).
|
|
address = "0.0.0.0";
|
|
port = config.services.paperless-service.port;
|
|
settings = {
|
|
PAPERLESS_OCR_LANGUAGE = "eng";
|
|
# Set the URL to the Tailscale hostname
|
|
PAPERLESS_URL = "http://x1carbon:${toString config.services.paperless-service.port}";
|
|
# Allow requests from the Tailscale hostname
|
|
PAPERLESS_ALLOWED_HOSTS = "x1carbon,x1carbon.tailscale.net";
|
|
};
|
|
};
|
|
|
|
# Tailscale-only access: open the port on the tailscale0 interface only.
|
|
networking.firewall.interfaces.tailscale0.allowedTCPPorts = [
|
|
config.services.paperless-service.port
|
|
];
|
|
};
|
|
}
|