2026-07-06 22:09:36 +02:00
|
|
|
# Paperless secrets + host-local binds — copy to .env (gitignored) next to
|
|
|
|
|
# docker-compose.yml and fill in real values. Never commit .env.
|
|
|
|
|
|
|
|
|
|
# LAN IP of PIHA. All published ports (web 8210, postgres 5434, redis 6380)
|
|
|
|
|
# bind ONLY to this interface — never 0.0.0.0. The OCR worker on SOLARIA
|
|
|
|
|
# connects over the same LAN. Verify after host rebuilds: ip -4 addr.
|
|
|
|
|
LAN_BIND_IP=192.168.31.5
|
|
|
|
|
|
|
|
|
|
# Django secret key. Generate once (e.g. openssl rand -base64 48), then never
|
|
|
|
|
# change — MUST be identical in services/paperless-worker/.env on SOLARIA.
|
|
|
|
|
PAPERLESS_SECRET_KEY=change-me-long-random-string
|
|
|
|
|
|
|
|
|
|
# Postgres password for the paperless DB. Both values MUST be identical
|
|
|
|
|
# (POSTGRES_PASSWORD initializes the DB, PAPERLESS_DBPASS is how the app
|
|
|
|
|
# connects). The worker on SOLARIA uses the same value.
|
|
|
|
|
POSTGRES_PASSWORD=change-me-very-strong
|
|
|
|
|
PAPERLESS_DBPASS=change-me-very-strong
|
|
|
|
|
|
feat(kb): configi Paperless/Nextcloud wg 9 decyzji — NC na PIHA, domeny kapala, Redis requirepass, backup SOLARIA, NC pin 34
Co zrobione:
- Nextcloud host = PIHA (always-on dla aktywnego uzycia), owner_node +
LAN_BIND_IP/TRUSTED_PROXIES w .env, README zaktualizowane
- Redis brokera Paperlessa: requirepass, PAPERLESS_REDIS_PASSWORD w .env
po obu stronach (PIHA + worker@SOLARIA), healthchecki z auth
- Domeny potwierdzone: paper.kapala.org, cloud.kapala.org (Cloudflare
DNS-only -> Tailscale PIHA, wildcard cert juz pokrywa) — udokumentowane,
nic nie utworzone
- Backup Paperlessa zatwierdzony: document_exporter + rsync/borg -> SOLARIA,
retencja 7/4/6, offsite jako future-note
- Nextcloud pin: 34-apache (zweryfikowany aktualny stable, endoflife.date)
- Whoosh fallback-worker: zaakceptowane bez zmian
- Porty/wylaczenie local login/sizing OCR-workera: przeniesione z "decyzji"
na "TODO przy deployu"
- DECYZJE-do-podjecia.md zaktualizowane: wszystko poza portami/loginem/
sizingiem przeniesione do "Rozstrzygniete"
Tylko edycja configow w repo — nic nie zdeployowane, zadne kontenery nie
byly ruszane, DNS/vhosty nie utworzone.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-09 16:15:35 +02:00
|
|
|
# Redis broker password (requirepass). MUST be identical in
|
|
|
|
|
# services/paperless-worker/.env on SOLARIA — a mismatch means the worker
|
|
|
|
|
# cannot reach the queue.
|
|
|
|
|
PAPERLESS_REDIS_PASSWORD=CHANGEME
|
|
|
|
|
|
2026-07-06 22:09:36 +02:00
|
|
|
# OIDC provider config (django-allauth openid_connect) — single-line JSON.
|
|
|
|
|
# Lives in .env because it embeds the Forgejo OAuth2 client secret.
|
feat(kb): configi Paperless/Nextcloud wg 9 decyzji — NC na PIHA, domeny kapala, Redis requirepass, backup SOLARIA, NC pin 34
Co zrobione:
- Nextcloud host = PIHA (always-on dla aktywnego uzycia), owner_node +
LAN_BIND_IP/TRUSTED_PROXIES w .env, README zaktualizowane
- Redis brokera Paperlessa: requirepass, PAPERLESS_REDIS_PASSWORD w .env
po obu stronach (PIHA + worker@SOLARIA), healthchecki z auth
- Domeny potwierdzone: paper.kapala.org, cloud.kapala.org (Cloudflare
DNS-only -> Tailscale PIHA, wildcard cert juz pokrywa) — udokumentowane,
nic nie utworzone
- Backup Paperlessa zatwierdzony: document_exporter + rsync/borg -> SOLARIA,
retencja 7/4/6, offsite jako future-note
- Nextcloud pin: 34-apache (zweryfikowany aktualny stable, endoflife.date)
- Whoosh fallback-worker: zaakceptowane bez zmian
- Porty/wylaczenie local login/sizing OCR-workera: przeniesione z "decyzji"
na "TODO przy deployu"
- DECYZJE-do-podjecia.md zaktualizowane: wszystko poza portami/loginem/
sizingiem przeniesione do "Rozstrzygniete"
Tylko edycja configow w repo — nic nie zdeployowane, zadne kontenery nie
byly ruszane, DNS/vhosty nie utworzone.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-09 16:15:35 +02:00
|
|
|
# Domain confirmed: paper.kapala.org. Register the app in Forgejo:
|
|
|
|
|
# Settings > Applications >
|
2026-07-06 22:09:36 +02:00
|
|
|
# Redirect URI: https://paper.kapala.org/accounts/oidc/forgejo/login/callback/
|
|
|
|
|
# then paste client_id + secret below.
|
|
|
|
|
PAPERLESS_SOCIALACCOUNT_PROVIDERS={"openid_connect":{"SCOPE":["openid","profile","email"],"OAUTH_PKCE_ENABLED":true,"APPS":[{"provider_id":"forgejo","name":"Forgejo","client_id":"CHANGE-ME-CLIENT-ID","secret":"CHANGE-ME-CLIENT-SECRET","settings":{"server_url":"https://forgejo.kapala.org/.well-known/openid-configuration"}}]}}
|
|
|
|
|
|
|
|
|
|
# Bootstrap admin (local login) — used until OIDC is verified, then consider
|
|
|
|
|
# PAPERLESS_DISABLE_REGULAR_LOGIN=true in docker-compose.yml.
|
|
|
|
|
PAPERLESS_ADMIN_USER=oskar
|
|
|
|
|
PAPERLESS_ADMIN_PASSWORD=change-me-bootstrap-only
|
