- Add init container to fetch JWT token from Authentik at pod startup
- Use token for LLM API calls via public gateway (https://api.riotpiao.com/v1)
- Mount PVC for persistent configuration storage
- Update LLM model to qwen2.5:3b-instruct (faster, smaller)
- Reduce scan interval from 300s to 60s for faster testing
- Enable document descriptions via AI_DESCRIPTIONS env var
The init container:
- Fetches JWT via client_credentials grant using paperless-ai-agent credentials
- Stores token in /app/data/llm_token.txt for paperless-ai to read at runtime
- Token has llm:inference claim embedded for gateway authorization
- Add paperless namespace to llm-serving NetworkPolicy ingress
- Point paperless-ai CUSTOM_BASE_URL to reasoning-predictor directly
- Gateway JWT auth not yet available for service accounts
- paperless-ai-agent has llm:inference role in Authentik
Required by paperless-ai to find its own user ID for scanning.
Without this, scanning aborts with "Failed to get own user ID".Reviewed-on: #45
Co-authored-by: rock <[email protected]>
- paperless-ai deployment using clusterzx/paperless-ai
- LLM via local api-gateway (reasoning model, no auth - phase 3 pending)
- Paperless API token SOPS-encrypted
- Auto-tags new documents, 5min scan interval
- Adds 'ai-processed' tag to classified documents
rock