paperless: add email creds to config

hosts/pie/firefly.nix

@@ -39,6 +39,8 @@ in {
       forceSSL = true;
       useACMEHost = "firefly.b12f.io";
       extraConfig = "include /etc/nginx/conf-available/authelia-location.conf;";
+      # Make api calls skip the nginx proxy auth
+      locations."/api/v1".proxyPass = "http://127.0.0.1:8080";
       locations."/".proxyPass = "http://127.0.0.1:8080";
       locations."/".extraConfig = ''
         include /etc/nginx/conf-available/proxy.conf;

hosts/pie/paperless.nix

@@ -41,6 +41,12 @@ with lib; let
     echo "PDF written to $pdf"
   '';
 in {
+  age.secrets."paperless.env" = {
+    file = "${flake.self}/secrets/paperless.env.age";
+    mode = "400";
+    owner = "paperless";
+  };
+
   #################################
   # Paperless service and proxy
   #################################
@@ -72,9 +78,12 @@ in {
       PAPERLESS_URL = "https://paperless.b12f.io";
       PAPERLESS_DISABLE_REGULAR_LOGIN = "True";
       PAPERLESS_ENABLE_HTTP_REMOTE_USER = "True";
+      PAPERLESS_EMAIL_TASK_CRON = "*/2 * * * *";
     };
   };
 
+  systemd.services.paperless-web.serviceConfig.EnvironmentFile = [ config.age.secrets."paperless.env".path ];
+
   #################################
   # Scanning
   #################################

secrets/paperless.env.age

@@ -0,0 +1,23 @@
+age-encryption.org/v1
+-> ssh-ed25519 8bHz7g V83fHF4xfcKbAGvzobBAZEgqf+lgCTF/sj4yf4sjx1k
+CkOTE/iiNrVQaGuHMjj04ve53113SQdmEkVKlUruKTM
+-> ssh-rsa kFDS0A
+cbM5X8HBvDDDhDVazfKnMmsoI3mR2ThUMROOAMrpInC7wQPkoOax18fJRRqkGRvq
+itu2A+n0YC8jUcdFb23Qfcuin56ODORpXlDRIEm31Z3TKMtsMYXvDSb4T62jjccA
+WNQdzQoHrOGWYE5j7u+6PvYkBZ1XiKIqknz6cOzFDaV5TAJes93q11x+3n+uYa7S
+IPae6LI6yTlQYEx6Y34oPHtJk3o3ekwXd44KJjJZH2WFV5z+U8Kpjvdoeq2dW/Jm
+9En5rFCOunsbmgRO1i5/WvLVmH88mDxQetBACJWShgzDYPl8GS4xOvC48zFibAFU
++mBoL+EDgVIkG0s4ZMHsjzu1Bf0bqcwvJVxhB4F0f3MkpGimf8XtimQh1PqMlqVs
+8QeyXWZDvmPyJ1DVTF3tp4fFrtbGz0lpyspFvTucvoWmXdBNqnF3I3JoN7/rHyZI
+BZDGU/+TmziBzYnP9CBBMhPOiO+YA+ml7KZ7bzXwACywMp/Py9Z7ofYdpu42pCF4
+FIycVJOINNb+t31GxfHl09Y42bkc26w/wgz7XvXoKLL4ykywitBKkvtr2DsoOLvT
+C4JDwX7tCuhTDTkytBdQgfFn8T9NnvChK7fLHzI/el6jOWh1AG/JWmR7EThS8ILC
+etqmXXod/bBtSlMeQk2RHkv3tstdzLQ9nM4CRv2zFJA
+-> piv-p256 zqq/iw AmDUaH4o2hXY6mtHkho93o3MDdrMh5Bzmzt4P7zKZSgG
+CjXCw9xtE4mWy+WmR1ZYe1P4KDpU2Rx6LLnTa6rgZes
+-> piv-p256 vRzPNw Am8O/V5e1gHlh+47TLfNtcvm3nLR5mm9WHWbB/YV2Fcf
+c1b1WijpMdXWBxyxqBZ9E90SMno8hOULwgSZRIUeFMo
+--- 1ChZ9rkRFHRhor6OQBG0VAkSF4YL8JfwkZZlSdCdNSY
+ô€…Ž|ò9éjÆ<N[‰–w%t<>‡yÝ`öôP×›ê7<C3AA>6Å&¥=²ÖPëdÖHd“÷ñ•'Iýû%„þŒ<C3BE>‹¸ÍþæîáŸ	n–NWLî/ºü_L|Ô(é´&.fóº=•ú¶ì³™¦Q€ªñ\ÄMo„qŸÿOJÁ­Eó{š…çq<C3A7>†ÑH¢Ð4µGÑ—
+úæwÚŽ6hsåСªÛó
ORüwTS×ÁˆZ——k‡Ì[Wæã¼Ñç—hv".ÁŽ!fm<66>ØÅ®?$Ó錊\q{•Y@a\‚¿/ŽC¤/G8.Øôjm¶¤müÀ€gdjqì ¢¼×œ·ÁÇg¸þ395¸ðS<C3B0>â<ÆïFRGìiÇ)m£Þ¢Ì¢96o†…”ó
+ÛÎŽÑ5IÚ¦êäW 8|ëÍèHÐ'’dQÐÀÑ×Ôªžìª\Ý

secrets/secrets.nix

@@ -79,6 +79,8 @@ in {
   "rclone-pie.conf.age".publicKeys = pieKeys ++ baseKeys;
   "restic-password.age".publicKeys = pieKeys ++ baseKeys;
 
+  "paperless.env.age".publicKeys = pieKeys ++ baseKeys;
+
   "wg-private-chocolatebar.age".publicKeys = chocolatebarKeys ++ baseKeys;
   "wg-private-biolimo.age".publicKeys = biolimoKeys ++ baseKeys;
   "wg-private-stroopwafel.age".publicKeys = stroopwafelKeys ++ baseKeys;