hswaw/paperless/paperless.libsonnet

# kubectl -n paperless create secret generic paperless-proxy --from-literal=cookie_secret=$(pwgen 32 1) --from-literal=oidc_secret=...
# kubectl -n paperless create secret generic paperless --from-literal=postgres_password=$(pwgen 32 1) --from-literal=redis_password=$(pwgen 32 1) --from-literal=secret_key=$(pwgen 32 1)

# There is no way of handling superusers (Admin panel access) automatically when
# using OAuth2-Proxy, thus we need to run the following command to mark the
# first user as such:
#   kubectl -n paperless exec -it deploy/paperless -c paperless -- python ./manage.py shell -c "from django.contrib.auth.models import User; u = User.objects.get_by_natural_key('informatic'); u.is_superuser = True; u.is_staff = True; u.save()"

# Quick full backup:
#   kubectl -n paperless exec deploy/paperless -c paperless -- tar -c /usr/src/paperless/data /usr/src/paperless/media /usr/src/paperless/consume | pv > ~/paperless-backup/backup-....tar
#   kubectl -n paperless exec deploy/postgres pg_dumpall > ~/paperless-backup/postgres-backup-....sql

local kube = import "../../kube/hscloud.libsonnet";
local postgres = import "../../kube/postgres.libsonnet";
local redis = import "../../kube/redis.libsonnet";

{
    local top = self,
    local cfg = self.cfg,

    cfg:: {
        name: "paperless",
        namespace: "paperless",
        domain: "paperless.hackerspace.pl",

        images: {
            paperless: "registry.k0.hswaw.net/informatic/paperless-ngx:2.5.4",
            proxy: "quay.io/oauth2-proxy/oauth2-proxy:v7.2.1",
        },

        storageClassName: "waw-hdd-redundant-3",
    },

    secretRefs:: {
        redis_password: { secretKeyRef: { name: "paperless", key: "redis_password" } },
        postgres_password: { secretKeyRef: { name: "paperless", key: "postgres_password" } },
        secret_key: { secretKeyRef: { name: "paperless", key: "secret_key" } },
        proxy: {
            cookie_secret: { secretKeyRef: { name: "paperless-proxy", key: "cookie_secret" } },
            oidc_secret: { secretKeyRef: { name: "paperless-proxy", key: "oidc_secret" } },
        },
    },

    local ns = kube.Namespace(cfg.namespace),

    redis: ns.Contain(redis) {
        cfg+: {
            storageClassName: cfg.storageClassName,
            appName: "paperless",
            version: "6.0",
            password: top.secretRefs.redis_password,
        },
    },

    postgres: ns.Contain(postgres) {
        cfg+: {
            appName: "paperless",
            database: "paperless",
            username: "paperless",

            password: top.secretRefs.postgres_password,
            storageClassName: cfg.storageClassName,
            storageSize: "20Gi",

            version: "15.4-bookworm",
            pgupgrade+: {
                enable: true,
                from: "10",
            },
        },
    },

    dataVolume: ns.Contain(kube.PersistentVolumeClaim("paperless-data")) {
        storage:: "100Gi",
        storageClass:: cfg.storageClassName,
    },

    deploy: ns.Contain(kube.Deployment(cfg.name)) {
        spec+: {
            replicas: 1,
            template+: {
                spec+: {
                    volumes_: {
                        data: top.dataVolume.volume,
                    },

                    securityContext: {
                        runAsUser: 1000,
                        runAsGroup: 1000,
                        fsGroup: 1000,
                    },

                    default_container:: "auth",
                    containers_: {
                        auth: kube.Container("authproxy") {
                            image: cfg.images.proxy,
                            ports_: {
                                http: { containerPort: 8001 },
                            },

                            env_: {
                                OAUTH2_PROXY_UPSTREAMS: "http://127.0.0.1:8000",
                                OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:8001",

                                OAUTH2_PROXY_COOKIE_SECRET: top.secretRefs.proxy.cookie_secret,

                                OAUTH2_PROXY_PROVIDER: "oidc",
                                OAUTH2_PROXY_OIDC_ISSUER_URL: "https://sso.hackerspace.pl",
                                OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true",

                                OAUTH2_PROXY_CLIENT_ID: "b4859334-140b-432a-81f6-8f3e135e021a",
                                OAUTH2_PROXY_CLIENT_SECRET: top.secretRefs.proxy.oidc_secret,

                                OAUTH2_PROXY_EMAIL_DOMAINS: "*",
                                OAUTH2_PROXY_ALLOWED_GROUPS: "zarzad,paperless-admin",

                                # Security considerations:
                                #
                                # * OAuth2-Proxy *will* strip X-Forwarded-User
                                #   header from requests passed through to
                                #   endpoint, preventing authentication bypass
                                #
                                # * OAuth2-Proxy *will not* strip Authorization
                                #   header - that can either be a user token,
                                #   or a username/password pair. Former can only
                                #   be generated by staff/superuser in Admin
                                #   panel, and the latter will not work for our
                                #   OAuth2 autogenerated users since these do
                                #   not have any password set
                                OAUTH2_PROXY_SKIP_AUTH_ROUTES: "^/api/.*",
                            },
                        },

                        paperless: kube.Container("paperless") {
                            image: cfg.images.paperless,
                            resources: {
                                requests: { cpu: "500m", memory: "1024M" },
                                limits: { cpu: "4", memory: "6144M" },
                            },
                            env_: {
                                PAPERLESS_PORT: "8000",
                                PAPERLESS_BIND_ADDR: "127.0.0.1",
                                PAPERLESS_URL: "https://%s" % [cfg.domain],

                                PAPERLESS_SECRET_KEY: top.secretRefs.secret_key,

                                A_REDIS_PASSWORD: top.redis.cfg.password,
                                PAPERLESS_REDIS: "redis://:$(A_REDIS_PASSWORD)@redis:6379",

                                PAPERLESS_DBHOST: top.postgres.svc.host,
                                PAPERLESS_DBNAME: top.postgres.cfg.database,
                                PAPERLESS_DBUSER: top.postgres.cfg.username,
                                PAPERLESS_DBPASS: top.postgres.cfg.password,

                                PAPERLESS_ENABLE_HTTP_REMOTE_USER: "true",
                                PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME: "HTTP_X_FORWARDED_USER",

                                PAPERLESS_OCR_LANGUAGE: "pol",
                                PAPERLESS_OCR_MODE: "force",
                                PAPERLESS_OCR_USER_ARGS: '{"continue_on_soft_render_error": true, "invalidate_digital_signatures": true}',
                                PAPERLESS_DATE_ORDER: "YMD",
                                PAPERLESS_EMAIL_TASK_CRON: "*/2 * * * *",
                            },

                            volumeMounts: [
                                { name: "data", mountPath: "/usr/src/paperless/data", subPath: "data" },
                                { name: "data", mountPath: "/usr/src/paperless/media", subPath: "media" },
                                { name: "data", mountPath: "/usr/src/paperless/consume", subPath: "consume" },
                            ],
                        },
                    },
                },
            },
        },
    },

    service: ns.Contain(kube.Service(cfg.name)) {
        target:: top.deploy,
    },

    ingress: ns.Contain(kube.SimpleIngress(cfg.name)) {
        hosts:: [cfg.domain],
        target:: top.service,
    },
}