Oskar Kapala
7e5577c58f
Co zrobione: - Nextcloud host = PIHA (always-on dla aktywnego uzycia), owner_node + LAN_BIND_IP/TRUSTED_PROXIES w .env, README zaktualizowane - Redis brokera Paperlessa: requirepass, PAPERLESS_REDIS_PASSWORD w .env po obu stronach (PIHA + worker@SOLARIA), healthchecki z auth - Domeny potwierdzone: paper.kapala.org, cloud.kapala.org (Cloudflare DNS-only -> Tailscale PIHA, wildcard cert juz pokrywa) — udokumentowane, nic nie utworzone - Backup Paperlessa zatwierdzony: document_exporter + rsync/borg -> SOLARIA, retencja 7/4/6, offsite jako future-note - Nextcloud pin: 34-apache (zweryfikowany aktualny stable, endoflife.date) - Whoosh fallback-worker: zaakceptowane bez zmian - Porty/wylaczenie local login/sizing OCR-workera: przeniesione z "decyzji" na "TODO przy deployu" - DECYZJE-do-podjecia.md zaktualizowane: wszystko poza portami/loginem/ sizingiem przeniesione do "Rozstrzygniete" Tylko edycja configow w repo — nic nie zdeployowane, zadne kontenery nie byly ruszane, DNS/vhosty nie utworzone. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
50 lines
2.4 KiB
YAML
50 lines
2.4 KiB
YAML
service:
|
|
name: paperless
|
|
owner_node: piha
|
|
role: document-management # KB pillar #2 source of truth for scans/invoices (archiwum = REFERENCJA)
|
|
exposure: private # LAN/Tailscale only via npm@PIHA (paper.kapala.org); NO public ingress
|
|
dependencies:
|
|
- forgejo # OIDC identity provider (forgejo.kapala.org)
|
|
# paperless-worker@SOLARIA is a consumer of this service (Redis broker,
|
|
# Postgres, NFS-exported storage) — not a dependency; the stack is fully
|
|
# functional (slow OCR fallback) with SOLARIA powered down.
|
|
ports:
|
|
- container: 8000
|
|
host: 8210 # LAN_BIND_IP only, never 0.0.0.0
|
|
protocol: tcp
|
|
- container: 5432
|
|
host: 5434 # postgres for paperless-worker@SOLARIA (LAN bind)
|
|
protocol: tcp
|
|
- container: 6379
|
|
host: 6380 # redis broker for paperless-worker@SOLARIA (LAN bind)
|
|
protocol: tcp
|
|
healthcheck:
|
|
type: http
|
|
endpoint: http://192.168.31.5:8210/ # LAN bind — localhost does not answer
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 5
|
|
restart_policy: unless-stopped
|
|
persistence:
|
|
# Paperless is the KB REFERENCE archive — this storage is the single source
|
|
# of truth for documents and its backup is MANDATORY (kb-02 hybrid boundary
|
|
# condition). data/media/consume are also the NFS export consumed by
|
|
# paperless-worker@SOLARIA.
|
|
paths:
|
|
- /opt/homelab/data/paperless/data # search index, classifier — rebuildable
|
|
- /opt/homelab/data/paperless/media # ORIGINALS + archived PDFs — irreplaceable
|
|
- /opt/homelab/data/paperless/consume # ingest drop dir
|
|
- /opt/homelab/data/paperless/export # document_exporter output (backup staging)
|
|
- paperless_pgdata # named volume: postgres (metadata, tags, correspondents)
|
|
- paperless_redisdata # named volume: redis AOF (queued OCR tasks)
|
|
runtime:
|
|
config_files:
|
|
- .env # secrets (gitignored, from env.example)
|
|
env_vars:
|
|
- LAN_BIND_IP # required — compose port-bind interpolation (192.168.31.5)
|
|
- PAPERLESS_SECRET_KEY
|
|
- PAPERLESS_DBPASS
|
|
- POSTGRES_PASSWORD # must equal PAPERLESS_DBPASS
|
|
- PAPERLESS_REDIS_PASSWORD # broker requirepass; must equal paperless-worker@SOLARIA
|
|
- PAPERLESS_SOCIALACCOUNT_PROVIDERS # OIDC provider JSON incl. Forgejo client secret
|