Stage Paperless, scanner and PDF editor GitOps sources

2026-10-19 21:21:54 +02:00
parent dc8b3eae01
commit 6e58b240d2
9 changed files with 222 additions and 0 deletions
@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: paperless-data
+  namespace: paperless-ngx
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=false
+spec:
+  accessModes: [ReadWriteMany]
+  storageClassName: rook-cephfs-ec
+  resources:
+    requests:
+      storage: 20Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: paperless-runtime
+  namespace: paperless-ngx
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=false
+spec:
+  accessModes: [ReadWriteOnce]
+  storageClassName: rook-ceph-block-ec
+  resources:
+    requests:
+      storage: 4Gi
@@ -0,0 +1,47 @@
+url: https://paper.brunner.ninja
+timeZone: Europe/Vienna
+ocrLanguage: deu+eng
+taskWorkers: 24
+threadsPerWorker: 1
+consumerPollingInterval: 5
+database:
+  host: postgresql
+  name: paperless
+  user: paperless
+  passwordSecretName: paperless-postgres
+cache:
+  url: redis://valkey:6379
+secretKey:
+  secretName: paperless-secret-key
+oidc:
+  enabled: true
+  providersSecretName: paperless-oidc
+  adminGroup: Paperless Admins
+persistence:
+  data:
+    existingClaim: paperless-data
+  runtime:
+    existingClaim: paperless-runtime
+ingress:
+  enabled: true
+  className: traefik
+  host: paper.brunner.ninja
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+tolerations:
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+affinity:
+  nodeAffinity:
+    preferredDuringSchedulingIgnoredDuringExecution:
+      - weight: 100
+        preference:
+          matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values: [arschrock]
+resources:
+  requests:
+    cpu: 100m
+    memory: 1Gi
@@ -0,0 +1,13 @@
+ingress:
+  enabled: true
+  className: traefik
+  host: pdfeditor.brunner.ninja
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.middlewares: default-authentik@kubernetescrd
+resources:
+  requests:
+    cpu: 100m
+    memory: 512Mi
+  limits:
+    memory: 2Gi
@@ -0,0 +1,17 @@
+persistence:
+  existingClaim: paperless-data
+scanner:
+  airscanDevices: '"HP OfficeJet Pro 8020" = http://192.168.4.189:8080/eSCL, eSCL'
+  outputSubPath: scanner-staging
+  consumeSubPath: consume
+ingress:
+  enabled: true
+  className: traefik
+  host: scanner.brunner.ninja
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.middlewares: default-authentik@kubernetescrd
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: paperless
+  namespace: argocd
+spec:
+  description: Paperless document stack with separately released scanner and PDF editor
+  sourceRepos:
+    - https://brunner.ninja/charts
+    - https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    - https://groundhog2k.github.io/helm-charts/
+    - https://valkey.io/valkey-helm/
+  destinations:
+    - namespace: paperless-ngx
+      server: https://kubernetes.default.svc
+  namespaceResourceWhitelist:
+    - {group: "", kind: ConfigMap}
+    - {group: "", kind: PersistentVolumeClaim}
+    - {group: "", kind: Secret}
+    - {group: "", kind: Service}
+    - {group: "", kind: ServiceAccount}
+    - {group: apps, kind: Deployment}
+    - {group: apps, kind: StatefulSet}
+    - {group: networking.k8s.io, kind: Ingress}
@@ -0,0 +1,19 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: paperless-storage
+  namespace: argocd
+spec:
+  project: paperless
+  source:
+    repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    path: apps/paperless/storage
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: paperless-ngx
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true
@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: paperless
+  namespace: argocd
+spec:
+  project: paperless
+  sources:
+    - repoURL: https://brunner.ninja/charts
+      chart: paperless-ngx
+      targetRevision: 3.3.2
+      helm:
+        releaseName: paperless
+        valueFiles: [$values/apps/paperless/values.yaml]
+    - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: paperless-ngx
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true
@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: pdf-editor
+  namespace: argocd
+spec:
+  project: paperless
+  sources:
+    - repoURL: https://brunner.ninja/charts
+      chart: stirling-pdf
+      targetRevision: 3.2.0-ultra-lite
+      helm:
+        releaseName: pdf-editor
+        valueFiles: [$values/apps/pdf-editor/values.yaml]
+    - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: paperless-ngx
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true
@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: scanner
+  namespace: argocd
+spec:
+  project: paperless
+  sources:
+    - repoURL: https://brunner.ninja/charts
+      chart: scanservjs
+      targetRevision: 3.3.0
+      helm:
+        releaseName: scanner
+        valueFiles: [$values/apps/scanner/values.yaml]
+    - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: paperless-ngx
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true