Files

dtoro 6b75f7302d db as source of truth: wiki→seeds, archive old artifacts, knowledge ingestion

- Migrations 010 (content_hash) + 011 (search tsvector column)
- new: internal/knowledge/seed.go — knowledge seed ingest engine
- new: internal/httpapi/knowledge.go — SearchKnowledge + GetEntityKnowledge
- wire knowledge ingest into oikos seed pipeline
- convert all 36 wiki docs + 6 investigations + 12 runbooks → seeds/knowledge.yaml
- archive: knowledge/wiki/→archive/, oikos/cards/→archive/, .hermes/plans/→archive/
- delete: 9 superseded Python kernel files, ledger/, mcp/build_host_files.py
- remove empty knowledge/ directory tree

2026-07-07 20:22:30 +02:00

1.9 KiB

Raw Blame History

103 — `paperless`

Paperless-ngx for document management. Ingests scans / PDFs from /mnt/library/documents and serves OCR'd indexed copies.

At a glance

Hostname: paperless
IP: 192.168.8.130
Privilege: privileged
Resources: 2 cores / 3 GiB RAM / 8 GiB rootfs
Mounts: /mnt/library ↔ /mnt/library (consumes documents/)
Public hostname: paperless.hubris.network → caddy → :8000

Service / port map

Service	Listen	Notes
paperless-webserver	`:8000`	HTTP
paperless-task-queue, paperless-scheduler, paperless-consumer	—	systemd workers

Auth

Behind Authentik forward-auth. API path /api/* bypasses forward-auth (mobile clients can't follow the browser login redirect; bearer token still enforces auth on /api). Header propagation: PAPERLESS_ENABLE_HTTP_REMOTE_USER=true and PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME=HTTP_X_AUTHENTIK_USERNAME in /opt/paperless/paperless.conf. Django auto-creates matching users on first SSO login.

Storage

Documents at /mnt/library/documents (owner www-data:www-data, mode 750 — not on the media group, by design).

Known issues

~~Disk usage was 86.9% at last legacy monitor reading on 2026-04-21~~ — resolved by growing rootfs to 16 GiB on 2026-05-15.

Changelog

2026-04-28 — wiki entry created

Initial documentation.

2026-04-21 — wired into Authentik forward-auth

Cookie-domain-level proxy provider, embedded outpost binding. /api/* bypass added in Caddy site block to keep mobile clients working.

1.9 KiB Raw Blame History

103 — paperless