# Paperless namespace ownership

Paperless, ScanservJS, and Stirling PDF use three independently published
charts and three Argo Applications. Paperless's chart owns only the Paperless
Deployment, Service, and Ingress; the scanner chart owns the ScanservJS
Deployment, ConfigMap action, Service, and Ingress; the Stirling chart owns the
PDF editor Deployment, Service, and Ingress. This repository supplies hostnames,
Secret names, the scanner's eSCL endpoint and shared claim, resource sizing,
and Paperless's soft preference for the `arschrock` node.

The `paperless-storage` Application owns the pre-existing `paperless-data` and
`paperless-runtime` PVC declarations with pruning disabled. Neither chart
recreates them. The scanner action copies scans to the `consume` subdirectory
of `paperless-data`; it does not use email or a recipient address.

PostgreSQL currently remains the existing manual Helm release `postgresql`
at chart 1.6.8 with the PostgreSQL 17.11 image. Its Argo declaration is staged
but intentionally not activated: a server-side dry-run of the current chart
against the live StatefulSet reported an immutable-spec/field-ownership
conflict. Do not delete or recreate its StatefulSet or PVC to force adoption.
The `postgres-data-postgresql-0` PVC and `paperless-postgres` Secret must be
preserved. Valkey remains the existing ephemeral Deployment for now; its
upstream chart changes the Deployment selector, so its staged Application is
also intentionally not activated. Resolve these as separate, verified cutovers.

`paperless-secret-key`, `paperless-postgres`, and `paperless-oidc` remain
cluster-managed Secrets referenced by name. They are not copied into this
public repository. The old deployment repository's Authentik/OIDC setup
scripts remain a recovery reference until their ownership is settled.