migrate paperless

2026-04-20 13:00:54 -04:00 · 2026-04-20 13:00:54 -04:00 · 888a3af835
commit 888a3af835
parent aeb19a521c
7 changed files with 81 additions and 71 deletions
--- a/README.md
+++ b/README.md
@ -88,8 +88,7 @@ SOPS + age encryption. All secrets live in `secrets/secrets.enc.yaml`, encrypted
 | `kube-system` | k3s Traefik, `traefik-config` (HelmChartConfig + redirect middleware) |
 | `longhorn-system` | Longhorn storage |
 | `media` | Plex, Sonarr, Radarr, Bazarr, Prowlarr, qBittorrent, unpackerr |
-| `paperless` | Paperless-ngx, Redis, PostgreSQL |
-| `apps` | Mealie, Homepage, Glance, Headlamp, Seerr, Zerobyte |
+| `apps` | Mealie, Homepage, Glance, Headlamp, Seerr, Zerobyte, Paperless-ngx + Postgres + Redis |

 ## Services

@ -99,7 +98,7 @@ SOPS + age encryption. All secrets live in `secrets/secrets.enc.yaml`, encrypted
 | traefik-internal | — | Internal Traefik instance | LB via MetalLB at `10.0.1.250` |
 | metallb | — | MetalLB L2 pool | Single-IP pool for internal LB |
 | media | media | Plex, Sonarr, Radarr, Bazarr, Prowlarr, qBittorrent, unpackerr | Media stack with `/dogstore` data paths |
-| paperless | paperless | Paperless-ngx, Redis, PostgreSQL | Postgres 15, Redis 7 |
+| paperless | apps | Paperless-ngx, Redis, PostgreSQL | Postgres 15, Redis 7 |
 | mealie | apps | Mealie (v3.14.0) | Gemini API integration for recipes |
 | dashboards | apps | Homepage, Glance | Internal-only via `traefik-internal` |
 | headlamp | apps | Headlamp | K8s dashboard, internal-only via `traefik-internal` |
@ -166,10 +165,8 @@ Or deploy individually:
 kubectl create namespace media
 helm upgrade --install media charts/media -n media

-kubectl create namespace paperless
-helm upgrade --install paperless charts/paperless -n paperless
-
 kubectl create namespace apps
+helm upgrade --install paperless charts/paperless -n apps
 helm upgrade --install mealie charts/mealie -n apps
 helm upgrade --install dashboards charts/dashboards -n apps
 helm upgrade --install headlamp charts/headlamp -n apps
--- a/charts/paperless/templates/paperless-ingressroute.yaml
+++ b/charts/paperless/templates/paperless-ingressroute.yaml
@ -0,0 +1,32 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: paperless
+  annotations:
+    kubernetes.io/ingress.class: traefik-internal
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`paperless.{{ .Values.internalDomain }}`)
+      kind: Rule
+      services:
+        - name: paperless-webserver
+          port: 8000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: paperless-tls
+  annotations:
+    kubernetes.io/ingress.class: traefik-internal
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`paperless.{{ .Values.internalDomain }}`)
+      kind: Rule
+      services:
+        - name: paperless-webserver
+          port: 8000
+  tls: {}
--- a/charts/paperless/templates/postgres.yaml
+++ b/charts/paperless/templates/postgres.yaml
@ -1,16 +1,3 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: paperless-postgres-data
-  labels:
-    app: paperless-postgres
-spec:
-  accessModes: [ReadWriteOnce]
-  storageClassName: {{ .Values.storageClass }}
-  resources:
-    requests:
-      storage: {{ .Values.postgres.storageSize }}
---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@ -29,6 +16,13 @@ spec:
      labels:
        app: paperless-postgres
    spec:
+      initContainers:
+        - name: fix-permissions
+          image: busybox
+          command: ["sh", "-c", "chown -R 999:999 /data"]
+          volumeMounts:
+            - name: data
+              mountPath: /data
      containers:
        - name: postgres
          image: {{ .Values.postgres.image }}
@ -43,14 +37,15 @@ spec:
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.secretName }}
-                  key: POSTGRES_PASSWORD
+                  key: PAPERLESS_DB_PASS
          volumeMounts:
            - name: data
              mountPath: /var/lib/postgresql/data
      volumes:
        - name: data
-          persistentVolumeClaim:
-            claimName: paperless-postgres-data
+          hostPath:
+            path: {{ .Values.dogstore }}/service-data/paperless/pgdata
+            type: DirectoryOrCreate
 ---
 apiVersion: v1
 kind: Service
--- a/charts/paperless/templates/redis.yaml
+++ b/charts/paperless/templates/redis.yaml
@ -1,16 +1,3 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: paperless-redis-data
-  labels:
-    app: paperless-redis
-spec:
-  accessModes: [ReadWriteOnce]
-  storageClassName: {{ .Values.storageClass }}
-  resources:
-    requests:
-      storage: {{ .Values.redis.storageSize }}
---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@ -39,8 +26,9 @@ spec:
              mountPath: /data
      volumes:
        - name: data
-          persistentVolumeClaim:
-            claimName: paperless-redis-data
+          hostPath:
+            path: {{ .Values.dogstore }}/service-data/paperless/redisdata
+            type: DirectoryOrCreate
 ---
 apiVersion: v1
 kind: Service
--- a/charts/paperless/values.yaml
+++ b/charts/paperless/values.yaml
@ -1,4 +1,5 @@
 domain: ratboo.me
+internalDomain: dog
 certResolver: myresolver
 tz: America/Los_Angeles
 puid: "1000"
@ -7,7 +8,6 @@ pgid: "1000"
 dogstore: /dogstore

 secretName: paperless-secrets
-storageClass: longhorn

 webserver:
  image: ghcr.io/paperless-ngx/paperless-ngx:latest
@ -15,10 +15,8 @@ webserver:

 redis:
  image: docker.io/library/redis:7
-  storageSize: 1Gi

 postgres:
  image: docker.io/library/postgres:15
-  storageSize: 5Gi
  database: paperless
  user: paperless
--- a/scripts/bootstrap.sh
+++ b/scripts/bootstrap.sh
@ -112,7 +112,7 @@ cmd_deploy() {
  local -A chart_ns=(
    [traefik-config]=kube-system
    [media]=media
-    [paperless]=paperless
+    [paperless]=apps
    [mealie]=apps
    [dashboards]=apps
    [utils]=apps
--- a/secrets/secrets.enc.yaml
+++ b/secrets/secrets.enc.yaml
@ -6,12 +6,12 @@
 #ENC[AES256_GCM,data:y3lu8sygTZJ+TSJOyrFXShJGBu5gHYLT4A==,iv:xmugUAyc116U4nESzKAYcvz76BBGwHLK7HE61gnS2gE=,tag:1LTSMRi+Aat4hk2N7c+2gw==,type:comment]
 #ENC[AES256_GCM,data:/ny7h4o0XSF1kROKuEUD9xrZJYOJ7mTZGIgTtIWHdclmdd9vYTLNl2+Hb9kHzCCWUgPXRg6pOww=,iv:47xT9Fct8sJrfIf8qRGD1xUTEkgdGf+KC9hWQ3XJG44=,tag:yix6VVO+g10cLbUwLWdTeA==,type:comment]
 #ENC[AES256_GCM,data:du0a4InEiMTw4mg5EqVPpANM3j0FNpDSle2na/7Q0vM1Z4SE52Jvvz3ZIV99b1pY30QlFdnTGO/4grVJd7xiUYC5wCUNY/uGNYGX2HzOWZjByEb5p9VCOPS2Czl/pPGM9+9d08mn2u1Ww4Wt6a/hrFOUWQddjTNz7HwG66xT/YVTnCN++mTnkCbgQKIjV1YhpSQKWA5jNfgSqSVKwbEA60JvESavT51HSZnrAGKWIepaJc7S14jTp+tUdqA=,iv:SZKsksvhtXCcKByjV85stfmt/DGHSsSh+PTGuCfe874=,tag:IQWtYVrLFx8EfPtKb1tK9g==,type:comment]
-apiVersion: ENC[AES256_GCM,data:3lY=,iv:MBpXRZ3rElkVBxAlvxmzORMCq0G87jB3Ik11tWMfz64=,tag:oPPwCxOiK3ePCWRhtHmN2w==,type:str]
-kind: ENC[AES256_GCM,data:8+Toxlr5,iv:DTaS/GEKGLtZsHQBYTGaQZYSp9mr/A5Vbuqi7uq46rU=,tag:1YvMaF1/eLNkZv0F3Du0zA==,type:str]
+apiVersion: ENC[AES256_GCM,data:F6o=,iv:8McPTAtRKlG0wpF1DUXRrhkzNuoD97Vu4OFyI8Opy28=,tag:DgEjMs6yXKFEv6Uu8A8WDg==,type:str]
+kind: ENC[AES256_GCM,data:eVSn4ODQ,iv:iDOb7kRnWbW1CYKILAZwbtlhbAqwi/I+YXFbHsmz2KI=,tag:dcWY/PdP2eMRv1HxmfyHoQ==,type:str]
 metadata:
    name: ENC[AES256_GCM,data:RgUAwk6jY7DHv+CbTtyXx5nzEQQ=,iv:FeAx14K1od0ehMnbcpnD4FW1bpEF/3M+dq8NGoJwTJA=,tag:SziXyyeAgShOgsandPQD7A==,type:str]
    namespace: ENC[AES256_GCM,data:IgxkBPTfQ8rEWzA=,iv:56aP5rBeH9aupBi338/9r4fXZ1ova8ubO7N8elr2/qM=,tag:vfFTXJrQ2J5vln/rBGl/og==,type:str]
-type: ENC[AES256_GCM,data:Efo/5l3N,iv:moQ775VrJkfQFO3YPM3ZT77i0IzcWy/G7b5E4/XOyJY=,tag:zfEMZgXgO+qMQIvPrLeMsA==,type:str]
+type: ENC[AES256_GCM,data:YMUJyMI2,iv:o++4jFOch8C8g5iKCzot/AcHnERRO/Yqn/uHuCAIFEI=,tag:ReJgAAajctyGo7xYr2Yc8w==,type:str]
 stringData:
    CF_DNS_API_TOKEN: ENC[AES256_GCM,data:74wQ12RQ9M7BckVfPjbRUnEbeaFB0aOPIhZHrFo=,iv:SIS0dJBpXkcJLjqEGnM1mtD1CB76MN2rZObyG8bCVe4=,tag:Rac0lPa5J2JSkdKcVc1PtQ==,type:str]
 sops:
@ -25,18 +25,18 @@ sops:
            eGZTZ0VSUElFZVpqWlVISjNYdnA4UFUK/uOyj7CKU0XLHHdPNKByO2c56JWQfhk5
            oauimeYrkNE+06dhXgVcJiQH+HcB33tB9u3YS9LxFYs3R98zKAHG6g==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T21:05:51Z"
-    mac: ENC[AES256_GCM,data:GQx4YuPIIfZxRpWtHCa8pCtidtmdYoIdMsK0dQJO42XT9KR5lbwNaP3v4GoaDoeM+L7iAn2OprpE54KkwIwRfb3NAjTeUvXO+J/Yi4ZJnLtuTOlAZrC8YvjmiZ6DaL8pvpRz7VUCfzNOoyrbjSJ2Qv/PWAUENcDEU7yOHNv7RBA=,iv:FqYd2F4vBqSCeKPsrWY/a8RePgkU2aP9cadB6nMyWaQ=,tag:FC75r3bMOQDZZwO0qJi4xg==,type:str]
+    lastmodified: "2026-04-20T16:15:57Z"
+    mac: ENC[AES256_GCM,data:QjexLkuBkJxXbWBTPUowSXGb8y3Zd22CtibFoYr/efLBYFI34KZS7mqtUx0bTlwLPRFbBUPaqlAfc7xvlRjRqIUpkfBvef0q3DVvJ8IiRVdSVR82lFGFpgJ/oDjQC9PSuEVFX1WvfpuOofwSTfV3ywvkVSlWzSJW66NNsKpl1MI=,iv:rxyUuOwTlT/fYkCX1WuZ1UJYUvCzEfXnrXQrwdDhYtA=,tag:50srDy5k4T+4zUdyI14xtg==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.12.2
 ---
 #ENC[AES256_GCM,data:ibx/1sx8LotfzeKT/rRsedIOoYD+F6aXbrA3QEqjfSrFAXWchGiLX9ddAY0q0DOGi7tFcty1rwWUj1Iiy+vd88zZDRhLSVgs0hIdqqPaHVubOWA7gAmxvZdb1faLU4cOAe7gL9bUdaBlGzQKat6miytnWBXL8qidoFl/Ps1wNNDXRBpe+TsQfVAp5T5jirq35s7GTeXUbQO3bNkKx/ZNHmV7ASctKeRv5TLuAJIwyU6UIGSSnx6Sdr43mZlm6iJjdoT6jQxeH7yB1Gut7g==,iv:wAtBwQNTI56JLHISsA1W00M3X+v6R6vEkNK1SVULsTg=,tag:Jk/4OdnXyV6/5VwFcXpX/A==,type:comment]
-apiVersion: ENC[AES256_GCM,data:jNM=,iv:dt+kXGEjK6yS09KRE5I3uAXNLGN05RbO0GyjNTHYHtk=,tag:7z93Yh4m2SpZLHdxVIr1hw==,type:str]
-kind: ENC[AES256_GCM,data:ORSVG3Tn,iv:gqhsNppUalHTDcKa7q/P3TR5t4VZC1gLc2MgY8V6xEw=,tag:vr764iOVWPJujZd4rxRYKA==,type:str]
+apiVersion: ENC[AES256_GCM,data:F6o=,iv:8McPTAtRKlG0wpF1DUXRrhkzNuoD97Vu4OFyI8Opy28=,tag:DgEjMs6yXKFEv6Uu8A8WDg==,type:str]
+kind: ENC[AES256_GCM,data:eVSn4ODQ,iv:iDOb7kRnWbW1CYKILAZwbtlhbAqwi/I+YXFbHsmz2KI=,tag:dcWY/PdP2eMRv1HxmfyHoQ==,type:str]
 metadata:
    name: ENC[AES256_GCM,data:1ngffZeDVnrLbux2pg==,iv:OXYS/A5PBvmIVw5qDu+Um7J/JhM8shVfP3KDIXNBCU0=,tag:wfmayiCBy22O+WIPBC3PPQ==,type:str]
    namespace: ENC[AES256_GCM,data:xCM+W3I=,iv:0KLfoYx8Q+NVsm84KZX3tClbWdwuTpI6/pD7HQMK3Fk=,tag:hSFwqHfnHWOPvesUhWyo+Q==,type:str]
-type: ENC[AES256_GCM,data:K3TlGbY8,iv:ZKm+PyQ4IAP0K1ymcMvWPOEUgUGzH93UkmH+rheJk7A=,tag:8tMEVI895tOOt8/tjiKRuw==,type:str]
+type: ENC[AES256_GCM,data:YMUJyMI2,iv:o++4jFOch8C8g5iKCzot/AcHnERRO/Yqn/uHuCAIFEI=,tag:ReJgAAajctyGo7xYr2Yc8w==,type:str]
 stringData:
    PLEX_CLAIM: ENC[AES256_GCM,data:A+dwGU//qfy6sBoww5c36xs2WcwdbQY=,iv:S6wOadxaC4ITyZN/7u5Lcu8AeBFdQLRqRlCHH3oSj28=,tag:hlNKdZGzURuFgcSrUrZyJA==,type:str]
    SONARR_API_KEY: ENC[AES256_GCM,data:VvU91ZNxv6tauBEyK9j8THxT8zw0mTLEmTTSRgYDEek=,iv:DZr5JL9T4f7XwQ03jkwVKfWA/xyAZlo4f/BKAzIIsQo=,tag:mCh8ExJvuoltcMlzAk6jpw==,type:str]
@ -52,18 +52,18 @@ sops:
            eGZTZ0VSUElFZVpqWlVISjNYdnA4UFUK/uOyj7CKU0XLHHdPNKByO2c56JWQfhk5
            oauimeYrkNE+06dhXgVcJiQH+HcB33tB9u3YS9LxFYs3R98zKAHG6g==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T21:05:51Z"
-    mac: ENC[AES256_GCM,data:GQx4YuPIIfZxRpWtHCa8pCtidtmdYoIdMsK0dQJO42XT9KR5lbwNaP3v4GoaDoeM+L7iAn2OprpE54KkwIwRfb3NAjTeUvXO+J/Yi4ZJnLtuTOlAZrC8YvjmiZ6DaL8pvpRz7VUCfzNOoyrbjSJ2Qv/PWAUENcDEU7yOHNv7RBA=,iv:FqYd2F4vBqSCeKPsrWY/a8RePgkU2aP9cadB6nMyWaQ=,tag:FC75r3bMOQDZZwO0qJi4xg==,type:str]
+    lastmodified: "2026-04-20T16:15:57Z"
+    mac: ENC[AES256_GCM,data:QjexLkuBkJxXbWBTPUowSXGb8y3Zd22CtibFoYr/efLBYFI34KZS7mqtUx0bTlwLPRFbBUPaqlAfc7xvlRjRqIUpkfBvef0q3DVvJ8IiRVdSVR82lFGFpgJ/oDjQC9PSuEVFX1WvfpuOofwSTfV3ywvkVSlWzSJW66NNsKpl1MI=,iv:rxyUuOwTlT/fYkCX1WuZ1UJYUvCzEfXnrXQrwdDhYtA=,tag:50srDy5k4T+4zUdyI14xtg==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.12.2
 ---
 #ENC[AES256_GCM,data:rmGnwFT8rj+qcuyiuf4VdY5KJP5m4bMt9a1znHpQ+uYyrfzNoAH0eqn6yHMB3xAwFJtFOkzEdd0E1PaL5C30UbqtpwDNyzD0QYipIwDkQBGwRnkXXI8xw1ftE1zHcFWnPmnSH70hCJa+/Xu425pIyJeVlJhUqoOGkG5/gV0DQoVMnJXFXnh5a64Ggv7UzB92o9/iyUFMgi/7j4ePNQCc7Um1VePXc5mkRl8cQBbvwAgyMZo+IxDJ8hpS2HgbRGey5/RAxaDvRbwkyRU=,iv:Cl77wg8+J3D6QrIgbjRS/lzbJLf2qGkK/AtnIOoKG+E=,tag:m4TfMvHm5W612rrJJ+ytkA==,type:comment]
-apiVersion: ENC[AES256_GCM,data:fyA=,iv:lkH+XfaHDNUNE3+oUW5lkA3ev0AEQZGe2y/J5H5G4AI=,tag:QCGr4Ia7Ea+CRWWoWSFaug==,type:str]
-kind: ENC[AES256_GCM,data:GS9uiEv6,iv:9VAdvjoF7thUVtJRpyaDnBOVlZ9so1p5f4iaw1WxJ0w=,tag:gDCWZfn4zCdyRdMup9Vs3Q==,type:str]
+apiVersion: ENC[AES256_GCM,data:F6o=,iv:8McPTAtRKlG0wpF1DUXRrhkzNuoD97Vu4OFyI8Opy28=,tag:DgEjMs6yXKFEv6Uu8A8WDg==,type:str]
+kind: ENC[AES256_GCM,data:eVSn4ODQ,iv:iDOb7kRnWbW1CYKILAZwbtlhbAqwi/I+YXFbHsmz2KI=,tag:dcWY/PdP2eMRv1HxmfyHoQ==,type:str]
 metadata:
    name: ENC[AES256_GCM,data:XLV37KdISRoLUp4yo44=,iv:Hb2AQVYhhu5erfg+41edOfB4cT6O6e2k1ytEixVaZDk=,tag:2qP4C7sxSdkdnsTVRhsXcg==,type:str]
-    namespace: ENC[AES256_GCM,data:S/sYVQ==,iv:SuUw6GPbT7YF66+O2w8al89NcJBr3oi8C12nZIbNWWc=,tag:NBVJrXnAhVJqx325MQnOTQ==,type:str]
-type: ENC[AES256_GCM,data:suP66pVq,iv:RrLuX+MOixEaR3iw4EMBCqkT03TW3xvmzdXsTf8kl2c=,tag:Id8xGXmFcmN+gYyZsohp3g==,type:str]
+    namespace: ENC[AES256_GCM,data:O6kz8Q==,iv:ZMv7m+YLaIChgNTM4Riopt2VUNg5HwUwdLR6bRA1Nf0=,tag:undk4ODEabPJbQKoa1He7A==,type:str]
+type: ENC[AES256_GCM,data:YMUJyMI2,iv:o++4jFOch8C8g5iKCzot/AcHnERRO/Yqn/uHuCAIFEI=,tag:ReJgAAajctyGo7xYr2Yc8w==,type:str]
 stringData:
    OPENAI_API_KEY: ENC[AES256_GCM,data:1QtOURL+C0DcB4AQhvmQP2PqeNQm2VQWTr/alY4FQzbhCnpxSFLS,iv:hy+a7cAcUNYr1XkKK1JoG8imjh5kT7B2tr5FWfHgAds=,tag:72zQFszAQpPEzZ0v24V5yg==,type:str]
 sops:
@ -77,18 +77,18 @@ sops:
            eGZTZ0VSUElFZVpqWlVISjNYdnA4UFUK/uOyj7CKU0XLHHdPNKByO2c56JWQfhk5
            oauimeYrkNE+06dhXgVcJiQH+HcB33tB9u3YS9LxFYs3R98zKAHG6g==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T21:05:51Z"
-    mac: ENC[AES256_GCM,data:GQx4YuPIIfZxRpWtHCa8pCtidtmdYoIdMsK0dQJO42XT9KR5lbwNaP3v4GoaDoeM+L7iAn2OprpE54KkwIwRfb3NAjTeUvXO+J/Yi4ZJnLtuTOlAZrC8YvjmiZ6DaL8pvpRz7VUCfzNOoyrbjSJ2Qv/PWAUENcDEU7yOHNv7RBA=,iv:FqYd2F4vBqSCeKPsrWY/a8RePgkU2aP9cadB6nMyWaQ=,tag:FC75r3bMOQDZZwO0qJi4xg==,type:str]
+    lastmodified: "2026-04-20T16:15:57Z"
+    mac: ENC[AES256_GCM,data:QjexLkuBkJxXbWBTPUowSXGb8y3Zd22CtibFoYr/efLBYFI34KZS7mqtUx0bTlwLPRFbBUPaqlAfc7xvlRjRqIUpkfBvef0q3DVvJ8IiRVdSVR82lFGFpgJ/oDjQC9PSuEVFX1WvfpuOofwSTfV3ywvkVSlWzSJW66NNsKpl1MI=,iv:rxyUuOwTlT/fYkCX1WuZ1UJYUvCzEfXnrXQrwdDhYtA=,tag:50srDy5k4T+4zUdyI14xtg==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.12.2
 ---
 #ENC[AES256_GCM,data:3I2e5Uv2dvWtDWXnVh0AULaS9z2Pcd/iUHjvycTsfxhDpzEJfc0a0dISctuLpELEyBv1PtYemFZ/XeTqGJswTF4vvzM7UL6scPezIm674aOtjVqPj7/C3nQgfnuY1qgVY7duawWZeaozf8hBKef1JJ1qR1T3Mati3YBIaw3fp1qjYyKo47/F19UT/qtL6mlu8CE3/zIVbzZGsKwfqhYf6oLg2I7aNlvJ0/yWz8RSjwmtWj8WzUD1wZh+DnFRiTlbE+kLdgw=,iv:i+4OhA58TOv1pzPInqu9qi9zunYzpNbvHrELXVsXis8=,tag:XJyBP8nci2u5X7THGox3CQ==,type:comment]
-apiVersion: ENC[AES256_GCM,data:RdI=,iv:YlI7VI5Tk6f99ZhiJEI/LaGgmYejt6/8k0wo+n8G19E=,tag:WY473Ft6vXo0NkpGlnGq/w==,type:str]
-kind: ENC[AES256_GCM,data:5fh5Zy1D,iv:1qApXn+j2LFNs1fzrH8j6M84espcQz4cHwquEmsHDSU=,tag:MnWyue/omxF6Emrpsz9eEw==,type:str]
+apiVersion: ENC[AES256_GCM,data:F6o=,iv:8McPTAtRKlG0wpF1DUXRrhkzNuoD97Vu4OFyI8Opy28=,tag:DgEjMs6yXKFEv6Uu8A8WDg==,type:str]
+kind: ENC[AES256_GCM,data:eVSn4ODQ,iv:iDOb7kRnWbW1CYKILAZwbtlhbAqwi/I+YXFbHsmz2KI=,tag:dcWY/PdP2eMRv1HxmfyHoQ==,type:str]
 metadata:
    name: ENC[AES256_GCM,data:ZYLasrZQ1Bu0jcLbRQjmjCo=,iv:O0uBw2j+X0CPaUkYQvnTVRgl9nNZBDF058/hZB/WFwY=,tag:xuwCgyi5VT9enQ3HlYzW1g==,type:str]
-    namespace: ENC[AES256_GCM,data:Xr9+LDzWK7z+,iv:6iXdpkcUho23jU2BZLHKkxONTtQIYkZem9NVlyB/Ltk=,tag:3wV3EMtmqXr0yTUcfbqxCA==,type:str]
-type: ENC[AES256_GCM,data:+5bc8NF8,iv:JpVUvDJZdk++m1K5pyuPTF1p17X62Mlwv6GKK9Hqoz8=,tag:Kdihg3qXXHD0ieypkcvWSg==,type:str]
+    namespace: ENC[AES256_GCM,data:O6kz8Q==,iv:ZMv7m+YLaIChgNTM4Riopt2VUNg5HwUwdLR6bRA1Nf0=,tag:undk4ODEabPJbQKoa1He7A==,type:str]
+type: ENC[AES256_GCM,data:YMUJyMI2,iv:o++4jFOch8C8g5iKCzot/AcHnERRO/Yqn/uHuCAIFEI=,tag:ReJgAAajctyGo7xYr2Yc8w==,type:str]
 stringData:
    PAPERLESS_DB_PASS: ENC[AES256_GCM,data:5/oF170q34nO,iv:y09u1KOZaIoUNtDog0sEbkj5gKD8C3JQyvNDSy0ElkI=,tag:WvIMb0Z0l7XXC6wB59ZTtg==,type:str]
 sops:
@ -102,18 +102,18 @@ sops:
            eGZTZ0VSUElFZVpqWlVISjNYdnA4UFUK/uOyj7CKU0XLHHdPNKByO2c56JWQfhk5
            oauimeYrkNE+06dhXgVcJiQH+HcB33tB9u3YS9LxFYs3R98zKAHG6g==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T21:05:51Z"
-    mac: ENC[AES256_GCM,data:GQx4YuPIIfZxRpWtHCa8pCtidtmdYoIdMsK0dQJO42XT9KR5lbwNaP3v4GoaDoeM+L7iAn2OprpE54KkwIwRfb3NAjTeUvXO+J/Yi4ZJnLtuTOlAZrC8YvjmiZ6DaL8pvpRz7VUCfzNOoyrbjSJ2Qv/PWAUENcDEU7yOHNv7RBA=,iv:FqYd2F4vBqSCeKPsrWY/a8RePgkU2aP9cadB6nMyWaQ=,tag:FC75r3bMOQDZZwO0qJi4xg==,type:str]
+    lastmodified: "2026-04-20T16:15:57Z"
+    mac: ENC[AES256_GCM,data:QjexLkuBkJxXbWBTPUowSXGb8y3Zd22CtibFoYr/efLBYFI34KZS7mqtUx0bTlwLPRFbBUPaqlAfc7xvlRjRqIUpkfBvef0q3DVvJ8IiRVdSVR82lFGFpgJ/oDjQC9PSuEVFX1WvfpuOofwSTfV3ywvkVSlWzSJW66NNsKpl1MI=,iv:rxyUuOwTlT/fYkCX1WuZ1UJYUvCzEfXnrXQrwdDhYtA=,tag:50srDy5k4T+4zUdyI14xtg==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.12.2
 ---
 #ENC[AES256_GCM,data:txDOIoubztyTgbgUC4MMNxNIwDkjtF/m+H5YAZ6hdaHTCBjVZSVKhHjYJzLFPeHE2EL02SEgJaXSkyF0bWwWw/QfR/yCkiGPdZ0fAFDKtJJBtITkM4O5rwRCTEXsQXleWK5NM6M55s5ElWIlBE//uLt2+hPlDQv26EOwwAa9I7kW2bUPDGvYNJVc7mJSfjMQb6aOx1MzrA+PUryeBVdK0xdmBmiQaZyGC0MexEjBwAycVnCM,iv:u4rMeGWy1J779Z7JNFvWTsxDREbTWAS+bXFxQhPTyGA=,tag:mVoS7lSVAHcqPcQ6iqhjvA==,type:comment]
-apiVersion: ENC[AES256_GCM,data:JGU=,iv:vr1Lkm9BBG2u8Ay0PGAIMTYUUKhMHIho3mVP1lY6it0=,tag:12JH+n4nUsYqmiy1+CnwfA==,type:str]
-kind: ENC[AES256_GCM,data:VLdoeXnN,iv:eH+/KpTMtpclAxFnjX5mXxkF73HUMJlskNSS/iW+g+U=,tag:NE/Xdc9qsfFmXAyZ4y+3HQ==,type:str]
+apiVersion: ENC[AES256_GCM,data:F6o=,iv:8McPTAtRKlG0wpF1DUXRrhkzNuoD97Vu4OFyI8Opy28=,tag:DgEjMs6yXKFEv6Uu8A8WDg==,type:str]
+kind: ENC[AES256_GCM,data:eVSn4ODQ,iv:iDOb7kRnWbW1CYKILAZwbtlhbAqwi/I+YXFbHsmz2KI=,tag:dcWY/PdP2eMRv1HxmfyHoQ==,type:str]
 metadata:
    name: ENC[AES256_GCM,data:dKvmrGqwCK+KvfdBxcs=,iv:3B71qX/mVAJGMcKlxTrnfub3rp/o7PJ+mquxo+V6svY=,tag:gnvbDBvZexdbOHkQQNUInw==,type:str]
-    namespace: ENC[AES256_GCM,data:93lKXQ==,iv:TQq2ZC7l1uQBc0FNRg6sQRfLuLIokQHpgAzRTcFmGsE=,tag:Mv+ih+YMDfYIihWNgnztow==,type:str]
-type: ENC[AES256_GCM,data:Ep25FUNF,iv:ZCzL99uhG0SYRXlu9j3GmgWtIxcfe6C9lEkP5EFr6SY=,tag:ANEtn7vXJisqoUlX7rEBAQ==,type:str]
+    namespace: ENC[AES256_GCM,data:O6kz8Q==,iv:ZMv7m+YLaIChgNTM4Riopt2VUNg5HwUwdLR6bRA1Nf0=,tag:undk4ODEabPJbQKoa1He7A==,type:str]
+type: ENC[AES256_GCM,data:YMUJyMI2,iv:o++4jFOch8C8g5iKCzot/AcHnERRO/Yqn/uHuCAIFEI=,tag:ReJgAAajctyGo7xYr2Yc8w==,type:str]
 stringData:
    ADGUARD_PASSWORD: ENC[AES256_GCM,data:Keh2GHhvfSyp9Q==,iv:bJ2CdmjqMZUSVw2T1jerqT1gkiP6k+aL9VyGCVJ10wI=,tag:cfR6jRn6NyrZ3/2WM5SdKg==,type:str]
 sops:
@ -127,8 +127,8 @@ sops:
            eGZTZ0VSUElFZVpqWlVISjNYdnA4UFUK/uOyj7CKU0XLHHdPNKByO2c56JWQfhk5
            oauimeYrkNE+06dhXgVcJiQH+HcB33tB9u3YS9LxFYs3R98zKAHG6g==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T21:05:51Z"
-    mac: ENC[AES256_GCM,data:GQx4YuPIIfZxRpWtHCa8pCtidtmdYoIdMsK0dQJO42XT9KR5lbwNaP3v4GoaDoeM+L7iAn2OprpE54KkwIwRfb3NAjTeUvXO+J/Yi4ZJnLtuTOlAZrC8YvjmiZ6DaL8pvpRz7VUCfzNOoyrbjSJ2Qv/PWAUENcDEU7yOHNv7RBA=,iv:FqYd2F4vBqSCeKPsrWY/a8RePgkU2aP9cadB6nMyWaQ=,tag:FC75r3bMOQDZZwO0qJi4xg==,type:str]
+    lastmodified: "2026-04-20T16:15:57Z"
+    mac: ENC[AES256_GCM,data:QjexLkuBkJxXbWBTPUowSXGb8y3Zd22CtibFoYr/efLBYFI34KZS7mqtUx0bTlwLPRFbBUPaqlAfc7xvlRjRqIUpkfBvef0q3DVvJ8IiRVdSVR82lFGFpgJ/oDjQC9PSuEVFX1WvfpuOofwSTfV3ywvkVSlWzSJW66NNsKpl1MI=,iv:rxyUuOwTlT/fYkCX1WuZ1UJYUvCzEfXnrXQrwdDhYtA=,tag:50srDy5k4T+4zUdyI14xtg==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.12.2
 ---
@ -152,7 +152,7 @@ sops:
            eGZTZ0VSUElFZVpqWlVISjNYdnA4UFUK/uOyj7CKU0XLHHdPNKByO2c56JWQfhk5
            oauimeYrkNE+06dhXgVcJiQH+HcB33tB9u3YS9LxFYs3R98zKAHG6g==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T21:05:51Z"
-    mac: ENC[AES256_GCM,data:GQx4YuPIIfZxRpWtHCa8pCtidtmdYoIdMsK0dQJO42XT9KR5lbwNaP3v4GoaDoeM+L7iAn2OprpE54KkwIwRfb3NAjTeUvXO+J/Yi4ZJnLtuTOlAZrC8YvjmiZ6DaL8pvpRz7VUCfzNOoyrbjSJ2Qv/PWAUENcDEU7yOHNv7RBA=,iv:FqYd2F4vBqSCeKPsrWY/a8RePgkU2aP9cadB6nMyWaQ=,tag:FC75r3bMOQDZZwO0qJi4xg==,type:str]
+    lastmodified: "2026-04-20T16:15:57Z"
+    mac: ENC[AES256_GCM,data:QjexLkuBkJxXbWBTPUowSXGb8y3Zd22CtibFoYr/efLBYFI34KZS7mqtUx0bTlwLPRFbBUPaqlAfc7xvlRjRqIUpkfBvef0q3DVvJ8IiRVdSVR82lFGFpgJ/oDjQC9PSuEVFX1WvfpuOofwSTfV3ywvkVSlWzSJW66NNsKpl1MI=,iv:rxyUuOwTlT/fYkCX1WuZ1UJYUvCzEfXnrXQrwdDhYtA=,tag:50srDy5k4T+4zUdyI14xtg==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.12.2