jklein
8f1329abcb
Major app jump 2.20.15 -> 3.0.5. Chart major bump (7.1.1 -> 8.0.0): the paperless.files.barcodes.scanner value is removed (pyzbar and PAPERLESS_CONSUMER_BARCODE_SCANNER were removed upstream), the paperless.ocr.mode default changes from the removed "skip" to "auto", and the startup probe budget is raised to 600s for the one-time Whoosh -> Tantivy index rebuild. New optional values: paperless.ocr.archiveFileGeneration, paperless.files.deleteDuplicates, oidc.provider.tokenAuthMethod.
130 lines
4.3 KiB
YAML
130 lines
4.3 KiB
YAML
# Scale the whole chart down without uninstalling it: scaleDown: true renders
|
|
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
|
|
# takes precedence over any per-workload replicas value. PVCs, Secrets and
|
|
# Services stay in place; scaleDown: false brings the workloads back up.
|
|
scaleDown: false
|
|
|
|
secrets:
|
|
redisRef: null
|
|
databaseRef: null
|
|
paperlessRef: null
|
|
smbConnectionSecretRef: null
|
|
oidcSecretRef: null
|
|
|
|
ingress:
|
|
clusterIssuer: "letsencrypt-issuer"
|
|
domain: null
|
|
|
|
paperless:
|
|
# Replica count for this workload; 0 is allowed and scales it down.
|
|
# The chart-global scaleDown flag takes precedence.
|
|
replicas: 1
|
|
ocr:
|
|
languages: "eng"
|
|
# Paperless-ngx 3.x modes: auto (default, skips OCR when embedded text
|
|
# exists), redo, force, off. The 2.x values "skip"/"skip_noarchive" were
|
|
# removed upstream; "skip" maps to "auto".
|
|
mode: "auto"
|
|
# Archive (PDF/A) generation, decoupled from OCR in 3.0: auto (default,
|
|
# skip archive for born-digital PDFs), always (2.x behavior), never.
|
|
archiveFileGeneration: "auto"
|
|
rotate_pages: "true"
|
|
output_type: "pdfa"
|
|
files:
|
|
filenameFormat: "{{ created_year }}/{{ correspondent }}/{{ title }}"
|
|
storage: 20Gi
|
|
maxUploadFileSize: 10m
|
|
# The barcode scanner backend is no longer configurable: paperless-ngx 3.0
|
|
# removed pyzbar and PAPERLESS_CONSUMER_BARCODE_SCANNER; zxing-cpp is the
|
|
# only backend now.
|
|
barcodes:
|
|
enabled: true
|
|
barcodeString: "PATCHT"
|
|
retainBarcodePage: false
|
|
asn:
|
|
enabled: true
|
|
# Paperless-ngx 3.0 no longer rejects duplicate documents by default; set
|
|
# to true to restore the 2.x behavior of deleting duplicates on consume.
|
|
deleteDuplicates: false
|
|
tikaGotenberg:
|
|
enabled: false
|
|
tikaEndpoint: null
|
|
gotenbergEndpoint: null
|
|
scripts:
|
|
postConsumptionScripts: []
|
|
preConsumptionScripts: []
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
cpu: 0.2
|
|
memory: 1024Mi
|
|
ephemeralStorage: 200Mi
|
|
# Paperless-ngx supports rootless operation: the pod runs as uid/gid 1000
|
|
# (the image's default paperless user), fsGroup makes the PVCs writable and
|
|
# /tmp + /run are emptyDirs so the root filesystem stays read-only.
|
|
# Documented deviation: s6-overlay requires /run to be OWNED by the runtime
|
|
# uid (group-write is not enough), so a minimal root init container chowns
|
|
# the /run emptyDir to runAsUser/runAsGroup before the hardened main
|
|
# container starts.
|
|
securityContext:
|
|
pod:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
fsGroupChangePolicy: Always
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
smbConnection:
|
|
enabled: false
|
|
server: null
|
|
cronJob: "0 0,12 * * *"
|
|
cron:
|
|
# The consume mover only shuffles files between the SMB share (mounted
|
|
# with 0777 modes) and the consume PVC, so it runs as the same non-root
|
|
# uid/gid as paperless itself with a fully hardened context.
|
|
securityContext:
|
|
pod:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
fsGroupChangePolicy: Always
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
cpu: 10m
|
|
memory: 16Mi
|
|
ephemeralStorage: 10Mi
|
|
oidc:
|
|
enabled: false
|
|
autoLoginWithProvider: false
|
|
disableRegularLogin: false
|
|
provider:
|
|
id: null
|
|
name: null
|
|
clientId: null
|
|
discoveryUrl: null
|
|
# Optional: explicit token endpoint auth method (e.g. client_secret_basic).
|
|
# Some providers need this since the allauth update in paperless-ngx 3.0
|
|
# (login fails at the callback with invalid_client otherwise).
|
|
tokenAuthMethod: null
|