From 3027fa6089024df33941aba646082fcbc216e42e Mon Sep 17 00:00:00 2001
From: Erich Blume <blume.erich@gmail.com>
Date: Wed, 8 Apr 2026 17:50:49 -0700
Subject: [PATCH] Disable local self-service registration in paperless

Users must be added via Authentik OIDC; eblume is the only local account.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 argocd/manifests/paperless/deployment.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/argocd/manifests/paperless/deployment.yaml b/argocd/manifests/paperless/deployment.yaml
index 7eb2805..cc2c013 100644
--- a/argocd/manifests/paperless/deployment.yaml
+++ b/argocd/manifests/paperless/deployment.yaml
@@ -78,6 +78,8 @@ spec:
               value: "true"
             - name: PAPERLESS_SOCIAL_AUTO_SIGNUP
               value: "true"
+            - name: PAPERLESS_ACCOUNT_ALLOW_SIGNUPS
+              value: "false"
             - name: PAPERLESS_REDIRECT_LOGIN_TO_SSO
               value: "false"
           volumeMounts: