Services/Paperless: Add paperless-nextcloud-sync container

system/modules/sops-nix/secrets.yaml

@@ -6,6 +6,7 @@ heidi-discord-token: ENC[AES256_GCM,data:FYvfUn8tG7glqIomSDj9rGyNQjnHSCsD/C3Kk/J
 kopia-server-username: ENC[AES256_GCM,data:4onewFkWpi9g,iv:aA4WSS8T6KUcGbAIHDd8BjE0sRK/Qz0j4QvEnKdlt2U=,tag:FQlB0Wx2u8wT3TKIhMAyLg==,type:str]
 kopia-server-password: ENC[AES256_GCM,data:6nMnhRA=,iv:Qz9qP+m0obzL+eHFmW1qVmc/0TR4Iw4X1GL4zACOSMk=,tag:v3v+33+g4y6se5q+b4e8mA==,type:str]
 kopia-user-password: ENC[AES256_GCM,data:jPWeru4e2w9qzA==,iv:WpZS3Qmx8v12v3q1Lq1YrPnWw7BY0FhxurXYuaOdfwA=,tag:+8bQAnHRh55rUMdyoK6N8w==,type:str]
+paperless-nextcloud-sync-password: ENC[AES256_GCM,data:pfLg3OVBqLsM4R7mSgLQEachj9gMkexPjBMSyzU=,iv:XBe1cdwlTjPfQW70NIEjD8CikK58iGErI9ZTlLWtCA4=,tag:qO35GdjljgS3/z5/1fCOFg==,type:str]
 #ENC[AES256_GCM,data:Gdh/hjCaOuAE,iv:XjPXn3SskpUPUkDIEDl5701/g9QhuS83fACMaoPMiIM=,tag:Q7s8xZG/GsOtQrasekBnkQ==,type:comment]
 wireguard-vps-private-key: ENC[AES256_GCM,data:B6IWYuzKV9YZ+G9GIjOsXVEVugwMY14PrwmYyHsFAJEb1OJRXMg8+zeFnqs=,iv:2QroGA10UVSmNIBHFSTeCgMBD3VjtiUnng3pkR/mPVQ=,tag:FGlCrmdccgsObyut6E5ggA==,type:str]
 sops:
@@ -19,7 +20,7 @@ sops:
             SURMTmh1TGIrRmtENzc0Sk4rNFJNUE0KOpjN6jkEHO+lvdWdp4P++r9SNSPWaT0h
             FAbbvZZ/EdIk/njLEcayFN7B4ftTcD/f4XJZiyosilZnIkk76bMOHA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-07-10T21:06:15Z"
-    mac: ENC[AES256_GCM,data:D6NvUwKoV9uGQ8PhR20UCaYoViSosUlYc/BERD1j9A0nA1JvnjPyPUPUNsBJqSiFMtOjRf7NggH/Q5mSrhOBHPSBTg0tvoTHE9AM2L+w/XwfW37Envb755apHwd/M2IQKXjMMU9wFR2Y6whMqNE/QVrH0ZsQXVrMymL2NLblyz4=,iv:GKeiCzJHgOuKNEX68kCLr6jmYQDAJpnJc0DH9JTwOLo=,tag:snlfvhfnYbNzhZZnExwpIw==,type:str]
+    lastmodified: "2025-07-11T22:33:56Z"
+    mac: ENC[AES256_GCM,data:JgDATuOkDi5DETf/pfXaODyaPeysmw28nrBlswSmESslf+T3V3/JVhkcwCpkWzb9/3MkW73NH6oDHo8wvJ4fGrbbcX2AqbwwzMqwDQjuec6Ztb/cf6nB6gCMhwDUuX6B1LbnQR5jyA9NneWDNJ6f/H9wOFU74uydSgYVdy8S+Ec=,iv:Rk/JFAC/Nj63v7zYXuFKfSt1zZJfHiRACkqpo/SONuE=,tag:QscgCisgmLSoPeXrlGsgmA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.10.2

system/servenix/default.nix

@@ -75,6 +75,7 @@
       "kopia-server-username"
       "kopia-server-password"
       "kopia-user-password"
+      "paperless-nextcloud-sync-password"
     ];
   };
 

system/services/paperless.nix

@@ -5,8 +5,56 @@
   ...
 }: let
   paperlessVersion = "2.17.1";
+  paperlessNCVersion = "1.0.1";
 in {
+  sops.templates."paperless-nextcloud-sync_secrets.env".content = ''
+    WEBDRIVE_PASSWORD=${config.sops.placeholder.paperless-nextcloud-sync-password}
+  '';
+
   virtualisation.oci-containers.containers = {
+    paperless-nextcloud-sync = {
+      image = "flor1der/paperless-nextcloud-sync:${paperlessNCVersion}";
+      autoStart = true;
+
+      login = {
+        # Uses DockerHub by default
+        # registry = "";
+
+        # DockerHub Credentials
+        username = "christoph.urlacher@protonmail.com";
+        passwordFile = "${config.sops.secrets.docker-password.path}";
+      };
+
+      dependsOn = [];
+
+      ports = [];
+
+      volumes = [
+        "/media/paperless-media:/mnt/source:ro"
+        "paperless-nextcloud-sync_logs:/var/log"
+      ];
+
+      environment = let
+        user = "PaperlessNextcloudSync";
+      in {
+        WEBDRIVE_URL = "https://nextcloud.local.chriphost.de/remote.php/dav/files/${user}/";
+        WEBDRIVE_USER = "${user}";
+
+        LC_ALL = "de_DE.UTF-8";
+        TZ = "Europe/Berlin";
+      };
+
+      environmentFiles = [
+        config.sops.templates."paperless-nextcloud-sync_secrets.env".path
+      ];
+
+      extraOptions = [
+        "--privileged"
+        "--device=/dev/fuse:/dev/fuse:rwm"
+        "--net=behind-nginx"
+      ];
+    };
+
     paperless-redis = {
       image = "redis:7";
       autoStart = true;