Blueprint with confidential client, ExternalSecret for client secret,
and worker env var injection — follows existing service pattern.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Kubernetes auto-injects PAPERLESS_PORT=tcp://... for a service named
'paperless', which conflicts with Granian's --port flag. Explicitly
set PAPERLESS_PORT=8000 to take precedence.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add syntax directive for BuildKit, use COPY --from=source instead of
inline git clone, fix s6-overlay arch mapping, use upstream jbig2enc
v0.30 trixie build, and enable RUN --mount=type=cache for Python deps.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Use curl in a RUN instead of ADD so $(dpkg --print-architecture)
is evaluated by the shell.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add paperless-ngx (v2.20.13) as a new ArgoCD-managed service on indri
with Authentik OIDC SSO, PostgreSQL on blumeops-pg, Redis sidecar, and
NFS document storage on sifaka. Includes Dockerfile built from forge
mirror, full k8s manifests, Caddy route, 1Password secrets, and
reference documentation.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
