helm-release.yml

---
# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s-labs/helm-charts/common-4.5.0/charts/library/common/values.schema.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: paperless-ngx
spec:
  interval: 1h
  chart:
    spec:
      chart: app-template
      version: 5.0.1
      interval: 30m
      sourceRef:
        kind: HelmRepository
        name: bjw-s-labs
        namespace: flux-system
  values:
    controllers:
      paperless-ngx:
        type: statefulset
        annotations:
          reloader.stakater.com/auto: "true"
        statefulset:
          podManagementPolicy: Parallel
          volumeClaimTemplates:
            - accessMode: ReadWriteOnce
              name: data
              size: "${VOLSYNC_CAPACITY}"
              storageClass: ceph-block
              dataSourceRef:
                kind: ReplicationDestination
                apiGroup: volsync.backube
                name: "${APP}"
              globalMounts:
                - path: /usr/src/paperless/data
        containers:
          app:
            image:
              repository: ghcr.io/paperless-ngx/paperless-ngx
              tag: 3.0.5
            env:
              PAPERLESS_OCR_PAGES: 2
              PAPERLESS_THREADS_PER_WORKER: 1
              PAPERLESS_TIKA_ENABLED: 1
              PAPERLESS_TIKA_ENDPOINT: http://paperless-ngx-tika.tools.svc.cluster.local:9998
              PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://paperless-ngx-gotenberg.tools.svc.cluster.local:3000
              PAPERLESS_URL: https://paperless-ngx.chkpwd.com
              PAPERLESS_WEBSERVER_WORKERS: 2
              PAPERLESS_PORT: "8000"
              PAPERLESS_TIME_ZONE: America/New_York
              PAPERLESS_TASK_WORKERS: "2"
              PAPERLESS_MEDIA_ROOT: /shared/media
              PAPERLESS_CONSUMPTION_DIR: /shared/import
              PAPERLESS_CONSUMER_POLLING: "60"
              PAPERLESS_CONSUMER_RECURSIVE: "true"
              PAPERLESS_CONSUMER_SUBDIRS_AS_TAGS: "true"
              PAPERLESS_OCR_LANGUAGES: eng
              PAPERLESS_OCR_LANGUAGE: eng
              PAPERLESS_REDIS: redis://paperless-ngx-redis.tools.svc.cluster.local:6379
              PAPERLESS_ADMIN_USER:
                valueFrom:
                  secretKeyRef:
                    name: paperless-ngx
                    key: PAPERLESS_ADMIN_USER
              PAPERLESS_ADMIN_PASSWORD:
                valueFrom:
                  secretKeyRef:
                    name: paperless-ngx
                    key: PAPERLESS_ADMIN_PASSWORD
              PAPERLESS_SECRET_KEY:
                valueFrom:
                  secretKeyRef:
                    name: paperless-ngx
                    key: PAPERLESS_SECRET_KEY
              USERMAP_UID: 1026
              USERMAP_GID: 100
            probes:
              liveness:
                enabled: true
                type: HTTP
              readiness:
                enabled: true
                type: HTTP
              startup:
                enabled: true
                spec:
                  failureThreshold: 30
                  periodSeconds: 5
                type: HTTP
            resources:
              requests:
                cpu: 25m
                memory: 2Gi
              limits:
                memory: 6Gi
      redis:
        containers:
          app:
            image:
              repository: docker.io/valkey/valkey
              tag: 9.1.1
            resources:
              requests:
                cpu: 5m
                memory: 32Mi
              limits:
                memory: 128Mi
      tika:
        containers:
          app:
            image:
              repository: docker.io/apache/tika
              tag: 3.3.1.0
            securityContext:
              allowPrivilegeEscalation: false
              readOnlyRootFilesystem: true
              capabilities: {drop: ["ALL"]}
              runAsUser: 1999
              runAsGroup: 1999
              runAsNonRoot: true
            resources:
              requests:
                cpu: 10m
                memory: 220Mi
              limits:
                memory: 500Mi
      gotenberg:
        containers:
          gotenberg:
            image:
              repository: gotenberg/gotenberg
              tag: 8.35.0
            command:
              - "gotenberg" # Convert .eml files. We do not want to allow external content like tracking pixels or even javascript.
              - "--chromium-disable-javascript=true"
              - "--chromium-allow-list=file:///tmp/.*"
            securityContext:
              allowPrivilegeEscalation: false
              readOnlyRootFilesystem: true
              capabilities: {drop: ["ALL"]}
              runAsUser: 1999
              runAsGroup: 1999
              runAsNonRoot: true
            resources:
              requests:
                cpu: 10m
                memory: 30Mi
              limits:
                memory: 400Mi
    service:
      app:
        controller: paperless-ngx
        ports:
          http:
            port: 8000
      redis:
        controller: redis
        ports:
          http:
            port: 6379
      tika:
        controller: tika
        ports:
          http:
            port: 9998
      gotenberg:
        controller: gotenberg
        ports:
          http:
            port: 3000
    route:
      private:
        kind: HTTPRoute
        hostnames: ["{{ .Release.Name }}.chkpwd.com"]
        rules:
          - matches:
              - path:
                  type: PathPrefix
                  value: /
            backendRefs:
              - name: paperless-ngx-app
                port: 8000
        parentRefs:
          - name: private
            namespace: networking
            sectionName: https
    persistence:
      shared:
        type: nfs
        server: "nas-srv-01.chkpwd.com"
        path: /volume1/vault-01/static_media/documents/paperless-ngx
        advancedMounts:
          paperless-ngx:
            app:
              - path: /shared/import
                subPath: import
              - path: /shared/media
                subPath: media
      tmp:
        type: emptyDir
        medium: Memory
        globalMounts:
          - path: /tmp
            subPath: tmp
          - path: /run
            subPath: run