feat: add paperless-ngx with OIDC, CNPG db, cp-3 HDD media, MinIO backup

Fixes controlplane.tftpl's install.wipe:true (should be false, live CPs already run false) and syncs coredns Corefile back to what's actually deployed (drops an unrolled-out, stale Kong-era rewrite).
2026-08-25 11:11:37 -07:00
parent 78e788abb3
commit e8e5acfb13
24 changed files with 660 additions and 11 deletions
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: paperless-config
+data:
+  PAPERLESS_URL: "https://paperless.riotpiao.com"
+  PAPERLESS_TIME_ZONE: "America/Los_Angeles"
+  PAPERLESS_OCR_LANGUAGE: "eng"
+  PAPERLESS_DBHOST: "paperless-db-rw"
+  PAPERLESS_DBNAME: "paperless"
+  PAPERLESS_REDIS: "redis://paperless-redis:6379"
+  # django-allauth generic OIDC provider. The client_id/secret/server_url
+  # bundle itself lives in the paperless-oidc Secret
+  # (SOCIALACCOUNT_PROVIDERS_JSON key, composed by authentik-provision.py) -
+  # env vars can't be split across a ConfigMap + Secret for the same key, so
+  # this whole value is sourced from the Secret in deployment.yaml instead.
+  PAPERLESS_APPS: "allauth.socialaccount.providers.openid_connect"