helm-charts/paperless-ngx/values.yaml

# Scale the whole chart down without uninstalling it: scaleDown: true renders
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
# takes precedence over any per-workload replicas value. PVCs, Secrets and
# Services stay in place; scaleDown: false brings the workloads back up.
scaleDown: false

secrets:
  redisSecretRef: null
  databaseSecretRef: null
  paperlessSecretRef: null
  smbConnectionSecretRef: null
  oidcSecretRef: null

ingress:
  clusterIssuer: null
  domain: null
  className: nginx
  # Extra annotations for the Ingress; merged with the cert-manager
  # cluster-issuer and upload-size annotations the chart always sets.
  annotations: {}

paperless:
  # Replica count for this workload; 0 is allowed and scales it down.
  # The chart-global scaleDown flag takes precedence.
  replicas: 1
  # Auxiliary busybox image, used by the /run-ownership init container and the
  # SMB consume-mover CronJob. Pinned independently of appVersion (which
  # tracks paperless-ngx); reviewed alongside every app-version update round.
  busybox:
    image:
      repository: busybox
      tag: "1.38.0"
  ocr:
    languages: "eng"
    # Paperless-ngx 3.x modes: auto (default, skips OCR when embedded text
    # exists), redo, force, off. The 2.x values "skip"/"skip_noarchive" were
    # removed upstream; "skip" maps to "auto".
    mode: "auto"
    # Archive (PDF/A) generation, decoupled from OCR in 3.0: auto (default,
    # skip archive for born-digital PDFs), always (2.x behavior), never.
    archiveFileGeneration: "auto"
    rotate_pages: "true"
    output_type: "pdfa"
  files:
    filenameFormat: "{{ created_year }}/{{ correspondent }}/{{ title }}"
    storage: 20Gi
    maxUploadFileSize: 10m
    # The barcode scanner backend is no longer configurable: paperless-ngx 3.0
    # removed pyzbar and PAPERLESS_CONSUMER_BARCODE_SCANNER; zxing-cpp is the
    # only backend now.
    #
    # An empty or null "barcodes:" block in an override means "the defaults
    # below apply" — the chart merges the block onto these defaults instead of
    # letting a childless key erase them (issue #61; the fallback copy lives in
    # the paperless-ngx.barcodes helper and is kept in sync with this block).
    # To switch barcode handling off, set barcodes.enabled: false explicitly;
    # deleting the sub-keys does not disable it.
    barcodes:
      enabled: true
      barcodeString: "PATCHT"
      retainBarcodePage: false
      asn:
        enabled: true
    # Paperless-ngx 3.0 no longer rejects duplicate documents by default; set
    # to true to restore the 2.x behavior of deleting duplicates on consume.
    deleteDuplicates: false
    tikaGotenberg:
      enabled: false
      tikaEndpoint: null
      gotenbergEndpoint: null
  scripts:
    postConsumptionScripts: []
    preConsumptionScripts: []
  livenessProbe:
    httpGet:
      path: /
      port: 8000
    periodSeconds: 30
    failureThreshold: 3
    successThreshold: 1
    timeoutSeconds: 5
  readinessProbe:
    httpGet:
      path: /
      port: 8000
    periodSeconds: 10
    failureThreshold: 3
    successThreshold: 1
    timeoutSeconds: 5
  # The startup probe gates liveness/readiness. Paperless runs database
  # migrations on startup, and since 3.0 the first start after an upgrade
  # also rebuilds the search index from scratch (Whoosh -> Tantivy):
  # budget 10s * 60 = 600s.
  startupProbe:
    httpGet:
      path: /
      port: 8000
    periodSeconds: 10
    failureThreshold: 60
    timeoutSeconds: 5
  # Extra environment variables, appended to the ones the chart always sets.
  # Values are rendered through tpl; value, secretKeyRef and configMapKeyRef
  # forms are supported.
  env: []
  resources:
    # Limits are optional: memory and ephemeral-storage limits default to
    # limitFactor x the request, an explicitly set limit always wins, and a
    # CPU limit is only set when configured explicitly under "limits".
    limitFactor: 3
    requests:
      cpu: 0.2
      memory: 1024Mi
      ephemeralStorage: 200Mi
  # Paperless-ngx supports rootless operation: the pod runs as uid/gid 1000
  # (the image's default paperless user), fsGroup makes the PVCs writable and
  # /tmp + /run are emptyDirs so the root filesystem stays read-only.
  # Documented deviation: s6-overlay requires /run to be OWNED by the runtime
  # uid (group-write is not enough), so a minimal root init container chowns
  # the /run emptyDir to runAsUser/runAsGroup before the hardened main
  # container starts.
  securityContext:
    pod:
      runAsNonRoot: true
      runAsUser: 1000
      runAsGroup: 1000
      fsGroup: 1000
      fsGroupChangePolicy: Always
    container:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      capabilities:
        drop:
          - ALL
smbConnection:
  enabled: false
  server: null
  cronJob: "0 0,12 * * *"
  cron:
    # The consume mover only shuffles files between the SMB share (mounted
    # with 0777 modes) and the consume PVC, so it runs as the same non-root
    # uid/gid as paperless itself with a fully hardened context.
    securityContext:
      pod:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        fsGroupChangePolicy: Always
      container:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        capabilities:
          drop:
            - ALL
    resources:
      # Limits are optional: memory and ephemeral-storage limits default to
      # limitFactor x the request, an explicitly set limit always wins, and a
      # CPU limit is only set when configured explicitly under "limits".
      limitFactor: 3
      requests:
        cpu: 10m
        memory: 16Mi
        ephemeralStorage: 10Mi
oidc:
  enabled: false
  autoLoginWithProvider: false
  disableRegularLogin: false
  provider:
    id: null
    name: null
    clientId: null
    discoveryUrl: null
    # Optional: explicit token endpoint auth method (e.g. client_secret_basic).
    # Some providers need this since the allauth update in paperless-ngx 3.0
    # (login fails at the callback with invalid_client otherwise).
    tokenAuthMethod: null