Setup paperless host and reverse proxy for acme http challange

config/hosts/paperless/configuration.nix

@@ -0,0 +1,17 @@
+{ ... }:
+{
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/vda";
+  };
+
+  networking = {
+    hostName = "paperless";
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 80 443 ];
+    };
+  };
+
+  system.stateVersion = "23.05";
+}

config/hosts/paperless/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  imports = [
+    ./configuration.nix
+    ./hardware-configuration.nix
+    ./nginx.nix
+    ./paperless.nix
+  ];
+}

config/hosts/paperless/hardware-configuration.nix

@@ -0,0 +1,30 @@
+{ ... }:
+{
+  fileSystems = {
+    "/mnt/data" = {
+      device = "/dev/disk/by-label/data";
+      fsType = "ext4";
+      autoFormat = true;
+      autoResize = true;
+    };
+    "/mnt/paperless-consume" = {
+      device = "//10.201.40.10/paperless-consume";
+      fsType = "cifs";
+      options = [ 
+        "username=paperless" 
+        "credentials=/secrets/paperless-samba-credentials.secret"
+        "iocharset=utf8"
+        "vers=3.1.1"
+        "uid=paperless"
+        "gid=paperless"
+        "_netdev"
+      ];
+    };
+    "/var/lib/paperless" = {
+      depends = [ "/mnt/data" ];
+      device = "/mnt/data/paperless";
+      fsType = "none";
+      options = [ "bind" "X-mount.owner=paperless" "X-mount.group=paperless" ];
+    };
+  };
+}

config/hosts/paperless/nginx.nix

@@ -0,0 +1,31 @@
+{ config, ... }:
+{
+  services.nginx = {
+    enable = true;
+    virtualHosts."paperless.grzb.de" = {
+      forceSSL = true;
+      enableACME = true;
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 80;
+        }
+        {
+          addr = "0.0.0.0";
+          port = 443;
+          ssl = true;
+        }
+      ];
+      locations."/" = {
+        proxyPass = "http://${config.services.paperless.address}:${builtins.toString config.services.paperless.port}";
+        proxyWebsockets = true;
+        extraConfig = ''
+          add_header Referrer-Policy "strict-origin-when-cross-origin";
+        '';
+      };
+      extraConfig = ''
+        client_max_body_size 100M;
+      '';
+    };
+  };
+}

config/hosts/paperless/paperless.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  services.paperless = {
+    enable = true;
+    consumptionDir = "/mnt/paperless-consume";
+    passwordFile = "/secrets/paperless-admin-password.secret";
+  };
+}

config/hosts/paperless/secrets.nix

@@ -0,0 +1,19 @@
+{ ... }:
+{
+  deployment.keys."paperless-admin-password.secret" = {
+    keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "paperless/admin-password" ];
+    destDir = "/secrets";
+    user = "paperless";
+    group = "paperless";
+    permissions = "0640";
+    uploadAt = "pre-activation";
+  };
+  deployment.keys."paperless-samba-credentials.secret" = {
+    keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "paperless/samba-credentials" ];
+    destDir = "/secrets";
+    user = "root";
+    group = "root";
+    permissions = "0640";
+    uploadAt = "pre-activation";
+  };
+}