{ flake, lib, config, pkgs, ... }: let psCfg = config.pub-solar; xdg = config.home-manager.users."${psCfg.user.name}".xdg; dataDir = "${xdg.dataHome}/Paperless"; backupDir = "${xdg.dataHome}/PaperlessBackup"; consumptionDir = "/home/${psCfg.user.name}/.local/share/scandir"; in { services.paperless = { enable = true; user = psCfg.user.name; consumptionDir = consumptionDir; dataDir = dataDir; address = "127.0.0.1"; settings = { PAPERLESS_ADMIN_USER = psCfg.user.name; PAPERLESS_AUTO_LOGIN_USERNAME = psCfg.user.name; PAPERLESS_URL = "https://paperless.faenix.eu"; }; }; hardware.sane = { enable = true; # No aarch64 support for now #brscan5.enable = true; }; home-manager.users."${psCfg.user.name}" = { home.sessionVariables = { SCANNER_OUTPUT_DIR = consumptionDir; }; systemd.user.sessionVariables = { SCANNER_OUTPUT_DIR = consumptionDir; }; }; security.acme.certs = { "paperless.faenix.eu" = { }; }; services.nginx = { enable = true; recommendedOptimisation = true; recommendedGzipSettings = true; recommendedTlsSettings = true; recommendedProxySettings = true; clientMaxBodySize = "256m"; virtualHosts = { "paperless.faenix.eu" = { #listenAddresses = [ # "192.168.13.35" #]; forceSSL = true; useACMEHost = "paperless.faenix.eu"; locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.services.paperless.port}"; }; }; }; #services.caddy = { # enable = true; # globalConfig = '' # local_certs # ''; # virtualHosts = { # "paperless.fritz.box" = { # extraConfig = '' # reverse_proxy :${builtins.toString config.services.paperless.port} # ''; # }; # }; #}; networking.firewall.allowedTCPPorts = [ 80 443 ]; systemd.tmpfiles.rules = [ "d /home/${psCfg.user.name}/.local 0700 ${psCfg.user.name} users - -" "d /home/${psCfg.user.name}/.local/share 0700 ${psCfg.user.name} users - -" "d '${backupDir}' 0700 ${psCfg.user.name} users - -" ]; #age.secrets."rclone-pie.conf" = { # file = "${flake.self}/secrets/rclone-pie.conf.age"; # path = "/root/.config/rclone/rclone.conf"; # mode = "400"; #}; #age.secrets."restic-password" = { # file = "${flake.self}/secrets/restic-password.age"; # mode = "400"; #}; #services.restic.backups = { # paperless = { # paths = [ backupDir ]; # initialize = true; # passwordFile = config.age.secrets."restic-password".path; # # See https://www.hosting.de/blog/verschluesselte-backups-mit-rclone-und-restic-in-nextcloud/ # repository = "rclone:cloud.pub.solar:/backups/Paperless"; # backupPrepareCommand = "${dataDir}/paperless-manage document_exporter ${backupDir} -c -p"; # rcloneConfigFile = config.age.secrets."rclone-pie.conf".path; # }; #}; }