jlab-cluster/helm-charts
3
0 Fork 0
Code Issues 15 Pull Requests 3 Actions Packages Wiki Activity
Files
d8494ff0edccca4e196cd0e30cf76a3e59e67f3c
helm-charts/paperless-ngx/templates/paperless-server.sfs.yaml
T
jklein 8f1329abcb Update paperless-ngx to 3.0.5 
Major app jump 2.20.15 -> 3.0.5. Chart major bump (7.1.1 -> 8.0.0):
the paperless.files.barcodes.scanner value is removed (pyzbar and
PAPERLESS_CONSUMER_BARCODE_SCANNER were removed upstream), the
paperless.ocr.mode default changes from the removed "skip" to "auto",
and the startup probe budget is raised to 600s for the one-time
Whoosh -> Tantivy index rebuild. New optional values:
paperless.ocr.archiveFileGeneration, paperless.files.deleteDuplicates,
oidc.provider.tokenAuthMethod.
2026-08-22 09:28:54 +02:00

246 lines
10 KiB
YAML
Raw Blame History

apiVersion: apps/v1
kind: StatefulSet
metadata:
name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
labels:
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
spec:
replicas: {{ include "paperless-ngx.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.paperless.replicas) }}
serviceName: {{ .Release.Name }}-{{ .Chart.Name }}-service
selector:
matchLabels:
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
template:
metadata:
name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
labels:
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
spec:
automountServiceAccountToken: false
securityContext:
{{- toYaml .Values.paperless.securityContext.pod | nindent 8 }}
initContainers:
# s6-overlay refuses to start unless /run is owned by the runtime uid,
# but emptyDirs are always created root-owned. This minimal init
# container hands /run over to the paperless uid (see
# paperless.securityContext in values.yaml) so the main container can
# run fully hardened (non-root, no privilege escalation).
- name: init-run-ownership
image: busybox:1.28
imagePullPolicy: IfNotPresent
command:
- sh
- -c
- chown {{ .Values.paperless.securityContext.pod.runAsUser }}:{{ .Values.paperless.securityContext.pod.runAsGroup }} /run
securityContext:
runAsNonRoot: false
runAsUser: 0
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
add:
- CHOWN
volumeMounts:
- mountPath: /run
name: run
resources:
requests:
cpu: 10m
memory: 16Mi
ephemeral-storage: 1Mi
limits:
cpu: 100m
memory: 32Mi
ephemeral-storage: 10Mi
containers:
- name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
image: "ghcr.io/paperless-ngx/paperless-ngx:{{ .Chart.AppVersion }}"
imagePullPolicy: IfNotPresent
securityContext:
{{- toYaml .Values.paperless.securityContext.container | nindent 12 }}
ports:
- containerPort: 8000
protocol: TCP
name: paperless-port
env:
- name: PAPERLESS_REDIS
valueFrom:
secretKeyRef:
name: {{ .Release.Name }}-{{ .Chart.Name }}-redis-secret
key: redis-connection-url
- name: PAPERLESS_REDIS_PREFIX
valueFrom:
secretKeyRef:
name: {{ .Release.Name }}-{{ .Chart.Name }}-redis-secret
key: key-prefix
- name: PAPERLESS_DBENGINE
value: "postgresql"
- name: PAPERLESS_DBHOST
valueFrom:
secretKeyRef:
name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret
key: server
- name: PAPERLESS_DBPORT
valueFrom:
secretKeyRef:
name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret
key: port
- name: PAPERLESS_DBNAME
valueFrom:
secretKeyRef:
name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret
key: database
- name: PAPERLESS_DBUSER
valueFrom:
secretKeyRef:
name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret
key: username
- name: PAPERLESS_DBPASS
valueFrom:
secretKeyRef:
name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret
key: password
- name: PAPERLESS_ADMIN_USER
valueFrom:
secretKeyRef:
name: {{ .Release.Name }}-{{ .Chart.Name }}-secret
key: username
- name: PAPERLESS_ADMIN_MAIL
valueFrom:
secretKeyRef:
name: {{ .Release.Name }}-{{ .Chart.Name }}-secret
key: username
- name: PAPERLESS_ADMIN_PASSWORD
valueFrom:
secretKeyRef:
name: {{ .Release.Name }}-{{ .Chart.Name }}-secret
key: password
- name: PAPERLESS_SECRET_KEY
valueFrom:
secretKeyRef:
name: {{ .Release.Name }}-{{ .Chart.Name }}-secret
key: paperless-secret-key
- name: PAPERLESS_OCR_LANGUAGE
value: "{{ .Values.paperless.ocr.languages }}"
- name: PAPERLESS_OCR_MODE
value: "{{ .Values.paperless.ocr.mode }}"
- name: PAPERLESS_ARCHIVE_FILE_GENERATION
value: "{{ .Values.paperless.ocr.archiveFileGeneration }}"
- name: PAPERLESS_OCR_ROTATE_PAGES
value: "{{ .Values.paperless.ocr.rotate_pages }}"
- name: PAPERLESS_OCR_OUTPUT_TYPE
value: "{{ .Values.paperless.ocr.output_type }}"
- name: PAPERLESS_FILENAME_FORMAT
value: "{{ .Values.paperless.files.filenameFormat }}"
- name: PAPERLESS_URL
value: "https://{{ .Values.ingress.domain }}"
- name: PAPERLESS_CONSUMER_ENABLE_ASN_BARCODE
value: "{{ .Values.paperless.files.barcodes.asn.enabled }}"
- name: PAPERLESS_CONSUMER_ENABLE_BARCODES
value: "{{ .Values.paperless.files.barcodes.enabled }}"
- name: PAPERLESS_CONSUMER_BARCODE_STRING
value: "{{ .Values.paperless.files.barcodes.barcodeString }}"
- name: PAPERLESS_CONSUMER_BARCODE_RETAIN_SPLIT_PAGES
value: "{{ .Values.paperless.files.barcodes.retainBarcodePage }}"
- name: PAPERLESS_CONSUMER_DELETE_DUPLICATES
value: "{{ .Values.paperless.files.deleteDuplicates }}"
{{- if .Values.paperless.files.tikaGotenberg.enabled }}
- name: PAPERLESS_TIKA_ENABLED
value: "{{ .Values.paperless.files.tikaGotenberg.enabled }}"
- name: PAPERLESS_TIKA_ENDPOINT
value: "http://{{ required "If Tika is enabled, a Tika-Endpoint must be provided" .Values.paperless.files.tikaGotenberg.tikaEndpoint }}"
- name: PAPERLESS_TIKA_GOTENBERG_ENDPOINT
value: "http://{{ required "If Tika is enabled, a Gotenberg-Endpoint must be provided" .Values.paperless.files.tikaGotenberg.gotenbergEndpoint }}"
{{- end }}
{{- if .Values.oidc.enabled }}
- name: PAPERLESS_APPS
value: "allauth.socialaccount.providers.openid_connect"
- name: PAPERLESS_SOCIALACCOUNT_PROVIDERS
value: |-
{
"openid_connect": {
"OAUTH_PKCE_ENABLED": true,
"APPS": [
{
"provider_id": "{{ required "A OIDC-provider-id must be provided" .Values.oidc.provider.id }}",
"name": "{{ required "A OIDC-provider-name must be provided" .Values.oidc.provider.name }}",
"client_id": "{{ required "A OIDC-client-id must be provided" .Values.oidc.provider.clientId }}",
"settings": {
"fetch_userinfo": true,
"oauth_pkce_enabled": true,
"server_url": "{{ required "A OIDC-discovery-document-url must be provided" .Values.oidc.provider.discoveryUrl }}",
{{- if .Values.oidc.provider.tokenAuthMethod }}
"token_auth_method": "{{ .Values.oidc.provider.tokenAuthMethod }}",
{{- end }}
"uid_field": "sub"
}
}
]
}
}
- name: PAPERLESS_REDIRECT_LOGIN_TO_SSO
value: "{{ .Values.oidc.autoLoginWithProvider }}"
- name: PAPERLESS_DISABLE_REGULAR_LOGIN
value: "{{ .Values.oidc.disableRegularLogin }}"
{{- end }}
volumeMounts:
- mountPath: "/usr/src/paperless/data"
name: "paperless-volume"
subPath: data/
- mountPath: "/usr/src/paperless/media"
name: "paperless-volume"
subPath: media/
- mountPath: "/usr/src/paperless/export"
name: "paperless-volume"
subPath: export/
- mountPath: "/usr/src/paperless/consume"
name: "paperless-consume-volume"
# Writable emptyDirs so the root filesystem can stay read-only:
# s6-overlay needs /run, OCR/consumption uses /tmp for scratch files.
- mountPath: /tmp
name: tmp
- mountPath: /run
name: run
resources:
{{- include "paperless-ngx.resources" .Values.paperless.resources | nindent 12 }}
readinessProbe:
httpGet:
path: /
port: 8000
periodSeconds: 10
failureThreshold: 3
successThreshold: 1
timeoutSeconds: 5
livenessProbe:
httpGet:
path: /
port: 8000
periodSeconds: 30
failureThreshold: 3
successThreshold: 1
timeoutSeconds: 5
# The startup probe gates liveness/readiness. Paperless runs database
# migrations on startup, and since 3.0 the first start after an
# upgrade also rebuilds the search index from scratch (Whoosh ->
# Tantivy): budget 10s * 60 = 600s.
startupProbe:
httpGet:
path: /
port: 8000
periodSeconds: 10
failureThreshold: 60
timeoutSeconds: 5
restartPolicy: Always
volumes:
- name: tmp
emptyDir: {}
- name: run
emptyDir: {}
- name: paperless-volume
persistentVolumeClaim:
claimName: {{ .Release.Name }}-{{ .Chart.Name }}-volume-claim
- name: paperless-consume-volume
persistentVolumeClaim:
claimName: {{ .Release.Name }}-{{ .Chart.Name }}-consume-volume-claim
Reference in new issue View Git Blame Copy Permalink