Paperless-ngx —
Setup & IMAP-Integration

services:
  paperless:
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    container_name: paperless
    restart: unless-stopped
    ports:
      - "10.0.1.82:8000:8000"
    depends_on:
      - paperless-db
      - paperless-redis
    volumes:
      - ./data:/usr/src/paperless/data
      - ./media:/usr/src/paperless/media
      - ./export:/usr/src/paperless/export
      - ./consume:/usr/src/paperless/consume
    environment:
      PAPERLESS_REDIS: redis://paperless-redis:6379
      PAPERLESS_DBHOST: paperless-db
      PAPERLESS_DBNAME: paperless
      PAPERLESS_DBUSER: paperless
      PAPERLESS_DBPASS: sicheres-passwort
      PAPERLESS_URL: https://paperless.local
      PAPERLESS_SECRET_KEY: langer-zufaelliger-string
      PAPERLESS_OCR_LANGUAGE: deu+eng
      PAPERLESS_TIME_ZONE: Europe/Berlin
      USERMAP_UID: "1000"
      USERMAP_GID: "1000"

  paperless-db:
    image: postgres:15
    container_name: paperless-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: paperless
      POSTGRES_USER: paperless
      POSTGRES_PASSWORD: sicheres-passwort
    volumes:
      - ./pgdata:/var/lib/postgresql/data

  paperless-redis:
    image: redis:7-alpine
    container_name: paperless-redis
    restart: unless-stopped
    volumes:
      - ./redisdata:/data

mkdir -p /opt/paperless
cd /opt/paperless
docker compose up -d
docker compose logs -f paperless

# Admin-User anlegen
docker compose exec paperless python3 manage.py createsuperuser

server {
    listen 443 ssl;
    server_name paperless.local;

    ssl_certificate     /etc/nginx/certs/homelab.pem;
    ssl_certificate_key /etc/nginx/certs/homelab-key.pem;

    # Für große Dokument-Uploads
    client_max_body_size 50M;

    location / {
        proxy_pass         http://10.0.1.82:8000;
        proxy_http_version 1.1;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_read_timeout 300;
    }
}

# Adressobjekt für Server2
config firewall address
    edit "Server2"
        set subnet 10.0.1.82 255.255.255.255
    next
end

# Custom Service für IMAP SSL Port 995
config firewall service custom
    edit "IMAP-SSL-995"
        set protocol TCP
        set tcp-portrange 995
    next
end

# Firewall Policy: Server2 → IMAP-Server
config firewall policy
    edit 0
        set name     "Paperless-IMAP"
        set srcintf  "lan"
        set dstintf  "wan"
        set srcaddr  "Server2"
        set dstaddr  "all"
        set service  "IMAP-SSL-995"
        set action   accept
        set nat      enable
    next
end

# Option 1: Samba-Share auf den consume/-Ordner
# Dann am Scanner als Scan-to-SMB-Ziel eintragen

# Option 2: Scanner scannt direkt über eSCL
# Paperless consume-Ordner via bind-mount:
# ./consume:/usr/src/paperless/consume (in docker-compose)
#
# eSCL-fähiges Tool auf dem Server:
sudo apt install sane-utils

# Scanner-IP prüfen
scanimage -L