Erich Blume
07f52e9488
## Summary - Add paperless-ngx (v2.20.13) as a new ArgoCD-managed service on indri - Dockerfile built from forge mirror (`mirrors/paperless-ngx`), multi-stage with s6-overlay - PostgreSQL database via `blumeops-pg` CNPG cluster, Redis sidecar for Celery - NFS document storage on sifaka (`/volume1/paperless`) - Authentik OIDC SSO via baked JSON blob from 1Password - Caddy route at `paperless.ops.eblu.me` - 1Password item "Paperless (blumeops)" created with all secrets ## Files - `containers/paperless/Dockerfile` — multi-stage build - `argocd/manifests/paperless/` — full k8s manifest set - `argocd/apps/paperless.yaml` — ArgoCD application - `argocd/manifests/databases/` — CNPG role + ExternalSecret - `ansible/roles/caddy/defaults/main.yml` — Caddy route - `service-versions.yaml` — version tracking entry - `docs/reference/services/paperless.md` — reference card ## Remaining deploy steps 1. Build container: `mise run container-build-and-release paperless` 2. Update kustomization.yaml `newTag` with actual image tag 3. Create Authentik application/provider for paperless 4. Create `paperless` database on blumeops-pg 5. Sync ArgoCD apps, then sync paperless from branch 6. Provision Caddy: `mise run provision-indri -- --tags caddy` 7. Verify at https://paperless.ops.eblu.me 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: #328
156 lines
6.5 KiB
Docker
156 lines
6.5 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# Paperless-ngx — self-hosted document management
|
|
# Built from source via forge mirror of paperless-ngx/paperless-ngx
|
|
# Closely follows upstream Dockerfile structure with git clone instead of COPY
|
|
|
|
ARG CONTAINER_APP_VERSION=v2.20.13
|
|
|
|
###############################################
|
|
# Stage 1: Clone source (reused by later stages)
|
|
###############################################
|
|
FROM docker.io/library/alpine:3.22 AS source
|
|
|
|
ARG CONTAINER_APP_VERSION
|
|
RUN apk add --no-cache git
|
|
RUN git clone --depth 1 --branch ${CONTAINER_APP_VERSION} \
|
|
https://forge.ops.eblu.me/mirrors/paperless-ngx.git /src
|
|
|
|
###############################################
|
|
# Stage 2: Compile frontend
|
|
###############################################
|
|
FROM --platform=$BUILDPLATFORM docker.io/node:20-trixie-slim AS compile-frontend
|
|
|
|
COPY --from=source /src/src-ui /src/src-ui
|
|
WORKDIR /src/src-ui
|
|
|
|
RUN set -eux \
|
|
&& npm update -g pnpm \
|
|
&& npm install -g corepack@latest \
|
|
&& corepack enable \
|
|
&& pnpm install
|
|
|
|
RUN set -eux \
|
|
&& ./node_modules/.bin/ng build --configuration production
|
|
|
|
###############################################
|
|
# Stage 3: s6-overlay base
|
|
###############################################
|
|
FROM ghcr.io/astral-sh/uv:0.9.15-python3.12-trixie-slim AS s6-overlay-base
|
|
|
|
WORKDIR /usr/src/s6
|
|
|
|
ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2 \
|
|
S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 \
|
|
S6_VERBOSITY=1 \
|
|
PATH=/command:$PATH
|
|
|
|
ARG TARGETARCH
|
|
ARG TARGETVARIANT
|
|
ARG S6_OVERLAY_VERSION=3.2.1.0
|
|
|
|
RUN set -eux \
|
|
&& apt-get update \
|
|
&& apt-get install --yes --quiet --no-install-recommends curl xz-utils \
|
|
&& S6_ARCH="" \
|
|
&& if [ "${TARGETARCH}${TARGETVARIANT}" = "amd64" ]; then S6_ARCH="x86_64"; \
|
|
elif [ "${TARGETARCH}${TARGETVARIANT}" = "arm64" ]; then S6_ARCH="aarch64"; fi \
|
|
&& if [ -z "${S6_ARCH}" ]; then echo "Error: Cannot determine arch"; exit 1; fi \
|
|
&& curl --fail --silent --show-error --location --remote-name-all --parallel \
|
|
"https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz" \
|
|
"https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz.sha256" \
|
|
"https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-${S6_ARCH}.tar.xz" \
|
|
"https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-${S6_ARCH}.tar.xz.sha256" \
|
|
&& sha256sum --check ./*.sha256 \
|
|
&& tar --directory / -Jxpf s6-overlay-noarch.tar.xz \
|
|
&& tar --directory / -Jxpf s6-overlay-${S6_ARCH}.tar.xz \
|
|
&& rm ./*.tar.xz ./*.sha256 \
|
|
&& apt-get --yes purge curl xz-utils \
|
|
&& apt-get --yes autoremove --purge \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Copy rootfs (s6 service definitions, init scripts)
|
|
COPY --from=source /src/docker/rootfs /
|
|
|
|
###############################################
|
|
# Stage 4: Main application
|
|
###############################################
|
|
FROM s6-overlay-base AS main-app
|
|
|
|
ARG CONTAINER_APP_VERSION
|
|
ARG DEBIAN_FRONTEND=noninteractive
|
|
ARG TARGETARCH
|
|
ARG JBIG2ENC_VERSION=0.30
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PYTHONWARNINGS="ignore:::django.http.response:517" \
|
|
PNGX_CONTAINERIZED=1 \
|
|
UV_LINK_MODE=copy \
|
|
UV_CACHE_DIR=/cache/uv/
|
|
|
|
# Runtime packages
|
|
RUN set -eux \
|
|
&& apt-get update \
|
|
&& apt-get install --yes --quiet --no-install-recommends \
|
|
curl gosu tzdata fonts-liberation gettext ghostscript gnupg \
|
|
icc-profiles-free imagemagick postgresql-client \
|
|
tesseract-ocr tesseract-ocr-eng tesseract-ocr-deu tesseract-ocr-fra \
|
|
tesseract-ocr-ita tesseract-ocr-spa unpaper pngquant jbig2dec \
|
|
libxml2 libxslt1.1 qpdf file libmagic1 media-types zlib1g \
|
|
libzbar0 poppler-utils \
|
|
&& curl --fail --silent --show-error --location --remote-name-all \
|
|
"https://github.com/paperless-ngx/builder/releases/download/jbig2enc-trixie-v${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb" \
|
|
&& dpkg --install ./jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
|
|
&& cp /etc/ImageMagick-6/paperless-policy.xml /etc/ImageMagick-6/policy.xml \
|
|
&& rm --force *.deb \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /usr/src/paperless/src/
|
|
|
|
# Python dependencies
|
|
COPY --from=source /src/pyproject.toml /src/uv.lock /usr/src/paperless/src/
|
|
|
|
RUN --mount=type=cache,target=${UV_CACHE_DIR},id=python-cache \
|
|
set -eux \
|
|
&& apt-get update \
|
|
&& apt-get install --yes --quiet --no-install-recommends \
|
|
build-essential default-libmysqlclient-dev pkg-config \
|
|
&& uv export --quiet --no-dev --all-extras --format requirements-txt --output-file requirements.txt \
|
|
&& uv pip install --system --no-python-downloads --python-preference system --requirements requirements.txt \
|
|
&& python3 -W ignore::RuntimeWarning -m nltk.downloader -d "/usr/share/nltk_data" snowball_data \
|
|
&& python3 -W ignore::RuntimeWarning -m nltk.downloader -d "/usr/share/nltk_data" stopwords \
|
|
&& python3 -W ignore::RuntimeWarning -m nltk.downloader -d "/usr/share/nltk_data" punkt_tab \
|
|
&& apt-get --yes purge build-essential default-libmysqlclient-dev pkg-config \
|
|
&& apt-get --yes autoremove --purge \
|
|
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
|
|
|
|
# Copy backend source
|
|
COPY --from=source /src/src ./
|
|
|
|
# Copy compiled frontend
|
|
COPY --from=compile-frontend /src/src/documents/static/frontend/ ./documents/static/frontend/
|
|
|
|
# Create user and finalize
|
|
RUN set -eux \
|
|
&& addgroup --gid 1000 paperless \
|
|
&& useradd --uid 1000 --gid paperless --home-dir /usr/src/paperless paperless \
|
|
&& mkdir -p /usr/src/paperless/data /usr/src/paperless/media \
|
|
/usr/src/paperless/consume /usr/src/paperless/export \
|
|
&& chown -R paperless:paperless /usr/src/paperless \
|
|
&& s6-setuidgid paperless python3 manage.py collectstatic --clear --no-input --link \
|
|
&& s6-setuidgid paperless python3 manage.py compilemessages
|
|
|
|
VOLUME ["/usr/src/paperless/data", "/usr/src/paperless/media", \
|
|
"/usr/src/paperless/consume", "/usr/src/paperless/export"]
|
|
|
|
ENTRYPOINT ["/init"]
|
|
EXPOSE 8000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=10s --retries=5 \
|
|
CMD [ "curl", "-fs", "-S", "-L", "--max-time", "2", "http://localhost:8000" ]
|
|
|
|
LABEL org.opencontainers.image.title="Paperless-ngx"
|
|
LABEL org.opencontainers.image.description="Self-hosted document management system"
|
|
LABEL org.opencontainers.image.version="${CONTAINER_APP_VERSION}"
|
|
LABEL org.opencontainers.image.source="https://forge.eblu.me/eblume/blumeops"
|
|
LABEL org.opencontainers.image.vendor="blumeops"
|