Bound Paperless OCR concurrency to prevent OOM restarts

.gitea/workflows/deploy.yml

@@ -20,6 +20,10 @@ jobs:
       - run: apk add --no-cache bash python3 py3-yaml kubectl
       - run: |
           umask 077
+          if [ -z "$KUBE_CONFIG_BASE64" ]; then
+            echo 'Set the KUBE_CONFIG_BASE64 repository secret using ./create-ci-kubeconfig.sh' >&2
+            exit 1
+          fi
           echo "$KUBE_CONFIG_BASE64" | base64 -d > kubeconfig
           export KUBECONFIG="$PWD/kubeconfig"
           ./deploy.sh

README.md

@@ -8,7 +8,7 @@ Run `./install.sh` from any directory. It creates the namespace and random, pers
 
 Change settings in `app.yaml`, then run `./test.sh` and `./install.sh`. The Paperless image is pinned there. The CephFS inbox uses polling because network filesystems may not deliver file notifications.
 
-Paperless prefers the 24-core `arschrock` node for OCR. This is a scheduler preference, so it can run on an Odroid when `arschrock` is unavailable. The control-plane taint is tolerated only by Paperless, not Valkey. A node failure may briefly interrupt OCR while Kubernetes reschedules the single Paperless pod.
+Paperless prefers the 24-core `arschrock` node for OCR. This is a scheduler preference, so it can run on an Odroid when `arschrock` is unavailable. OCR is capped at four concurrent pages and the pod has a 4 GiB memory limit; using the host's default 24 OCR workers caused an out-of-memory restart while editing a large PDF. The control-plane taint is tolerated only by Paperless, not Valkey. A node failure may briefly interrupt OCR while Kubernetes reschedules the single Paperless pod.
 
 The 20 Gi PVC uses `rook-cephfs-ec`, whose CephFS data pool is erasure coded with three data and two coding chunks across hosts. CephFS metadata uses three replicas. The claim can be expanded if high-resolution scans outgrow it; erasure coding does not replace backups.
 

app.yaml

@@ -77,6 +77,7 @@ spec:
             - {name: PAPERLESS_REDIS, value: "redis://valkey:6379"}
             - {name: PAPERLESS_TIME_ZONE, value: "Europe/Vienna"}
             - {name: PAPERLESS_OCR_LANGUAGE, value: "deu+eng"}
+            - {name: PAPERLESS_THREADS_PER_WORKER, value: "4"}
             - {name: PAPERLESS_CONSUMER_POLLING_INTERVAL, value: "30"}
             - {name: PAPERLESS_APPS, value: "allauth.socialaccount.providers.openid_connect"}
             - {name: PAPERLESS_SOCIAL_AUTO_SIGNUP, value: "true"}
@@ -104,8 +105,8 @@ spec:
             httpGet: {path: /, port: http}
             periodSeconds: 30
           resources:
-            requests: {cpu: 100m, memory: 512Mi}
-            limits: {memory: 2Gi}
+            requests: {cpu: 100m, memory: 1Gi}
+            limits: {memory: 4Gi}
       volumes:
         - name: data
           persistentVolumeClaim: {claimName: paperless-data}