wht_server_paperless/PKGBUILD

# Maintainer: Vojtech Vesely <vojtech.vesely@protonmail.com>

pkgname=wht_server_paperless
pkgver=1.0.0
pkgrel=1
pkgdesc='archlinux meta package - set of multiple meta packages for paperless server'
arch=('x86_64')
url='https://git.sr.ht/~atomicfs/atomicfs-repo-arch'
license=('MIT')
depends=(
  # Other meta packages
  'wht_server_https'
  'wht_server_mariadb'

  # Services
  'paperless-ngx'   # A supercharged version of paperless: scan, index and archive all your physical documents

  # tesseract-data
  #   mostly for paperless-ngx
  'tesseract-data-afr'
  'tesseract-data-amh'
  'tesseract-data-ara'
  'tesseract-data-asm'
  'tesseract-data-aze'
  'tesseract-data-aze_cyrl'
  'tesseract-data-bel'
  'tesseract-data-ben'
  'tesseract-data-bod'
  'tesseract-data-bos'
  'tesseract-data-bre'
  'tesseract-data-bul'
  'tesseract-data-cat'
  'tesseract-data-ceb'
  'tesseract-data-ces'
  'tesseract-data-chi_sim'
  'tesseract-data-chi_tra'
  'tesseract-data-chr'
  'tesseract-data-cos'
  'tesseract-data-cym'
  'tesseract-data-dan'
  'tesseract-data-dan_frak'
  'tesseract-data-deu'
  'tesseract-data-deu_frak'
  'tesseract-data-div'
  'tesseract-data-dzo'
  'tesseract-data-ell'
  'tesseract-data-eng'
  'tesseract-data-enm'
  'tesseract-data-epo'
  'tesseract-data-equ'
  'tesseract-data-est'
  'tesseract-data-eus'
  'tesseract-data-fao'
  'tesseract-data-fas'
  'tesseract-data-fil'
  'tesseract-data-fin'
  'tesseract-data-fra'
  'tesseract-data-frk'
  'tesseract-data-frm'
  'tesseract-data-fry'
  'tesseract-data-gla'
  'tesseract-data-gle'
  'tesseract-data-glg'
  'tesseract-data-grc'
  'tesseract-data-guj'
  'tesseract-data-hat'
  'tesseract-data-heb'
  'tesseract-data-hin'
  'tesseract-data-hrv'
  'tesseract-data-hun'
  'tesseract-data-hye'
  'tesseract-data-iku'
  'tesseract-data-ind'
  'tesseract-data-isl'
  'tesseract-data-ita'
  'tesseract-data-ita_old'
  'tesseract-data-jav'
  'tesseract-data-jpn'
  'tesseract-data-jpn_vert'
  'tesseract-data-kan'
  'tesseract-data-kat'
  'tesseract-data-kat_old'
  'tesseract-data-kaz'
  'tesseract-data-khm'
  'tesseract-data-kir'
  'tesseract-data-kmr'
  'tesseract-data-kor'
  'tesseract-data-kor_vert'
  'tesseract-data-lao'
  'tesseract-data-lat'
  'tesseract-data-lav'
  'tesseract-data-lit'
  'tesseract-data-ltz'
  'tesseract-data-mal'
  'tesseract-data-mar'
  'tesseract-data-mkd'
  'tesseract-data-mlt'
  'tesseract-data-mon'
  'tesseract-data-mri'
  'tesseract-data-msa'
  'tesseract-data-mya'
  'tesseract-data-nep'
  'tesseract-data-nld'
  'tesseract-data-nor'
  'tesseract-data-oci'
  'tesseract-data-ori'
  'tesseract-data-pan'
  'tesseract-data-pol'
  'tesseract-data-por'
  'tesseract-data-pus'
  'tesseract-data-que'
  'tesseract-data-ron'
  'tesseract-data-rus'
  'tesseract-data-san'
  'tesseract-data-sin'
  'tesseract-data-slk'
  'tesseract-data-slk_frak'
  'tesseract-data-slv'
  'tesseract-data-snd'
  'tesseract-data-spa'
  'tesseract-data-spa_old'
  'tesseract-data-sqi'
  'tesseract-data-srp'
  'tesseract-data-srp_latn'
  'tesseract-data-sun'
  'tesseract-data-swa'
  'tesseract-data-swe'
  'tesseract-data-syr'
  'tesseract-data-tam'
  'tesseract-data-tat'
  'tesseract-data-tel'
  'tesseract-data-tgk'
  'tesseract-data-tgl'
  'tesseract-data-tha'
  'tesseract-data-tir'
  'tesseract-data-ton'
  'tesseract-data-tur'
  'tesseract-data-uig'
  'tesseract-data-ukr'
  'tesseract-data-urd'
  'tesseract-data-uzb'
  'tesseract-data-uzb_cyrl'
  'tesseract-data-vie'
  'tesseract-data-yid'
  'tesseract-data-yor'
)

/etc/paperless.conf##template

This is a yadm template. I used template so that I can store passwords separatly in encrypted files.

# WARNING: Do not edit this file.
# It was generated by processing {{ yadm.source }}

# Have a look at the docs for documentation.
# https://paperless-ngx.readthedocs.io/en/latest/configuration.html

# Debug. Only enable this for development.

#PAPERLESS_DEBUG=false

# Required services

#PAPERLESS_REDIS=redis://localhost:6379
PAPERLESS_DBHOST=localhost
PAPERLESS_DBPORT=3306
#PAPERLESS_DBNAME=paperless
#PAPERLESS_DBUSER=paperless
#PAPERLESS_DBPASS=paperless
{% include "paperless.passwd" %}
#PAPERLESS_DBSSLMODE=prefer
PAPERLESS_DBENGINE=mariadb

# Paths and folders

PAPERLESS_CONSUMPTION_DIR=/var/lib/paperless/consume
PAPERLESS_DATA_DIR=/var/lib/paperless/data
#PAPERLESS_TRASH_DIR=
PAPERLESS_MEDIA_ROOT=/var/lib/paperless/media
PAPERLESS_STATICDIR=/usr/share/paperless/static
PAPERLESS_FILENAME_FORMAT={created_year}/{correspondent}/{created}__{title}
PAPERLESS_FILENAME_FORMAT_REMOVE_NONE=True

# Security and hosting

#PAPERLESS_SECRET_KEY=change-me
{% include "paperless.key" %}
#PAPERLESS_URL=https://example.com
#PAPERLESS_CSRF_TRUSTED_ORIGINS=https://example.com # can be set using PAPERLESS_URL
#PAPERLESS_ALLOWED_HOSTS=example.com,www.example.com # can be set using PAPERLESS_URL
#PAPERLESS_CORS_ALLOWED_HOSTS=https://localhost:8080,https://example.com # can be set using PAPERLESS_URL
#PAPERLESS_FORCE_SCRIPT_NAME=
#PAPERLESS_STATIC_URL=/static/
#PAPERLESS_AUTO_LOGIN_USERNAME=
#PAPERLESS_COOKIE_PREFIX=
#PAPERLESS_ENABLE_HTTP_REMOTE_USER=false

# OCR settings

#PAPERLESS_OCR_LANGUAGE=eng
#PAPERLESS_OCR_MODE=skip
#PAPERLESS_OCR_OUTPUT_TYPE=pdfa
#PAPERLESS_OCR_PAGES=1
#PAPERLESS_OCR_IMAGE_DPI=300
#PAPERLESS_OCR_CLEAN=clean
#PAPERLESS_OCR_DESKEW=true
#PAPERLESS_OCR_ROTATE_PAGES=true
#PAPERLESS_OCR_ROTATE_PAGES_THRESHOLD=12.0
#PAPERLESS_OCR_USER_ARGS={}
#PAPERLESS_CONVERT_MEMORY_LIMIT=0
PAPERLESS_CONVERT_TMPDIR=/var/lib/paperless/tmp

# Software tweaks

#PAPERLESS_TASK_WORKERS=1
#PAPERLESS_THREADS_PER_WORKER=1
#PAPERLESS_TIME_ZONE=UTC
#PAPERLESS_CONSUMER_POLLING=10
#PAPERLESS_CONSUMER_DELETE_DUPLICATES=false
#PAPERLESS_CONSUMER_RECURSIVE=false
#PAPERLESS_CONSUMER_IGNORE_PATTERNS=[".DS_STORE/*", "._*", ".stfolder/*", ".stversions/*", ".localized/*", "desktop.ini"]
#PAPERLESS_CONSUMER_SUBDIRS_AS_TAGS=false
#PAPERLESS_CONSUMER_ENABLE_BARCODES=false
#PAPERLESS_CONSUMER_BARCODE_STRING=PATCHT
#PAPERLESS_PRE_CONSUME_SCRIPT=/path/to/an/arbitrary/script.sh
#PAPERLESS_POST_CONSUME_SCRIPT=/path/to/an/arbitrary/script.sh
#PAPERLESS_FILENAME_DATE_ORDER=YMD
#PAPERLESS_FILENAME_PARSE_TRANSFORMS=[]
#PAPERLESS_NUMBER_OF_SUGGESTED_DATES=5
#PAPERLESS_THUMBNAIL_FONT_NAME=
#PAPERLESS_IGNORE_DATES=
#PAPERLESS_ENABLE_UPDATE_CHECK=

# Tika settings

#PAPERLESS_TIKA_ENABLED=false
#PAPERLESS_TIKA_ENDPOINT=http://localhost:9998
#PAPERLESS_TIKA_GOTENBERG_ENDPOINT=http://localhost:3000

# Binaries

#PAPERLESS_CONVERT_BINARY=/usr/bin/convert
#PAPERLESS_GS_BINARY=/usr/bin/gs

# Uploads

PAPERLESS_SCRATCH_DIR=/var/lib/paperless/uploads

# Webserver

GUNICORN_CMD_ARGS='--bind=127.0.0.1:7998'

/etc/nginx/nginx.conf

user http http;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;

events {
    multi_accept on;
    worker_connections  1024;
}

http {
    # MIME
    include       mime.types;
    default_type  application/octet-stream;

    # logging
    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';
    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log warn;

    charset utf-8;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    server_tokens off;
    log_not_found off;
    types_hash_max_size 4096;
    client_max_body_size 100M;

    keepalive_timeout  65;

    # GZip
    gzip            on;
    gzip_min_length 1000;
    gzip_proxied    expired no-cache no-store private auth;
    gzip_types      text/plain;
    gzip_types      application/xml;
    gzip_types      application/json;
    gzip_types      application/javascript;
    gzip_types      application/octet-stream;
    gzip_types      text/css;

    # load configs
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

/etc/nginx/sites-available/paperless.conf

server {
	# generated 2022-12-02, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, modern configuration, no HSTS, no OCSP
	# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=modern&openssl=1.1.1k&hsts=false&ocsp=false&guideline=5.6

	listen 443 ssl http2;
	listen [::]:443 ssl http2;
	server_name paperless.ark;
	include private.conf;

	# SSL
	ssl_certificate /etc/ssl/private/ark.crt;
	ssl_certificate_key /etc/ssl/private/ark.key;
	ssl_session_timeout 1d;
	ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
	ssl_session_tickets off;

	# modern configuration
	ssl_protocols TLSv1.3;
	ssl_prefer_server_ciphers off;

	location / {
		# Adjust host and port as required.
		proxy_pass http://localhost:7998/;
		proxy_set_header X-Forwarded-Proto https;

		# These configuration options are required for WebSockets to work.
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection "upgrade";

		proxy_redirect off;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Host $server_name;
	}
}