Files

dtoro e32b21072d claudio-bot: decommission LXC 123, archive repos, migrate monitoring to Hermes

- Destroy LXC 123 (claudio-bot) — freed 8 GiB rootfs, 512 MiB RAM, 1 core
- Archive dtoro/claudio-bot and dtoro/claudio-monitor on Gitea (read-only)
- Stop claudio-monitor.timer on hubris, remove /opt/claudio-monitor
- Extend homelab-hardware-health skill with LXC resources, service health, apt/docker drift
- Create homelab-health-watchdog cron (15 min, Matrix alerts, actionable options)
- Wire Matrix (matrix:dtoro) as health alert delivery platform
- Update 13 files: inventory, containers/*, infrastructure/*, hosts/*, README, .sops.yaml
- Add deprecation plan at plans/2026-06-04_130000-deprecate-claudio-bot.md

2026-06-04 10:14:56 +02:00

1.9 KiB

Raw Blame History

103 — `paperless`

Paperless-ngx for document management. Ingests scans / PDFs from /mnt/library/documents and serves OCR'd indexed copies.

At a glance

Hostname: paperless
IP: 192.168.8.130
Privilege: privileged
Resources: 2 cores / 3 GiB RAM / 8 GiB rootfs
Mounts: /mnt/library ↔ /mnt/library (consumes documents/)
Public hostname: paperless.hubris.network → caddy → :8000

Service / port map

Service	Listen	Notes
paperless-webserver	`:8000`	HTTP
paperless-task-queue, paperless-scheduler, paperless-consumer	—	systemd workers

Auth

Behind Authentik forward-auth. API path /api/* bypasses forward-auth (mobile clients can't follow the browser login redirect; bearer token still enforces auth on /api). Header propagation: PAPERLESS_ENABLE_HTTP_REMOTE_USER=true and PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME=HTTP_X_AUTHENTIK_USERNAME in /opt/paperless/paperless.conf. Django auto-creates matching users on first SSO login.

Storage

Documents at /mnt/library/documents (owner www-data:www-data, mode 750 — not on the media group, by design).

Known issues

~~Disk usage was 86.9% at last legacy monitor reading on 2026-04-21~~ — resolved by growing rootfs to 16 GiB on 2026-05-15.

Changelog

2026-04-28 — wiki entry created

Initial documentation.

2026-04-21 — wired into Authentik forward-auth

Cookie-domain-level proxy provider, embedded outpost binding. /api/* bypass added in Caddy site block to keep mobile clients working.

1.9 KiB Raw Blame History

103 — paperless