Story Crater Bot
1260921450
paperless-ngx v3 refuses to migrate from anything before v2.20.15 (paperless.E002). 2.20.15 already covers the API version range the iOS app needs, so it fixes the phone upload issue without the v3 breaking changes.
104 lines
3.9 KiB
YAML
104 lines
3.9 KiB
YAML
# Single container runs webserver + consumer + scheduler (paperless-ngx's
|
|
# stock entrypoint does this internally) - no need to split into separate
|
|
# Deployments. replicas: 1 only: paperless-media is ReadWriteOnce, and the
|
|
# consumer polling the media dir doesn't benefit from horizontal scaling here.
|
|
#
|
|
# Pinned to talos-cp-3: paperless-media's disk physically lives there. Longhorn
|
|
# RWO volumes can only be attached from one node at a time, and the nightly
|
|
# backup-cronjob.yaml also mounts this same PVC (read-only) to mirror it into
|
|
# MinIO - pinning both to the same node avoids a cross-node attach conflict,
|
|
# and keeps the 3.5Ti read/write path off the network entirely.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: paperless
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate # ReadWriteOnce media PVC - avoid two pods fighting over it
|
|
selector:
|
|
matchLabels:
|
|
app: paperless
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: paperless
|
|
spec:
|
|
# Kubernetes injects legacy Docker-links env vars for every Service in
|
|
# this namespace (<SVC>_SERVICE_HOST, <SVC>_PORT, ...). The Service here
|
|
# is named "paperless", so that becomes PAPERLESS_PORT=tcp://<ip>:8000 -
|
|
# paperless-ngx's own entrypoint reads PAPERLESS_PORT for gunicorn's
|
|
# bind address, collides, and gunicorn crash-loops on "not a valid port
|
|
# number". Disable the injection instead of renaming the Service.
|
|
enableServiceLinks: false
|
|
nodeSelector:
|
|
kubernetes.io/hostname: talos-cp-3
|
|
containers:
|
|
- name: paperless
|
|
image: ghcr.io/paperless-ngx/paperless-ngx:2.20.15
|
|
ports:
|
|
- containerPort: 8000
|
|
envFrom:
|
|
- configMapRef:
|
|
name: paperless-config
|
|
env:
|
|
- name: PAPERLESS_DBUSER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-db-app
|
|
key: username
|
|
- name: PAPERLESS_DBPASS
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-db-app
|
|
key: password
|
|
- name: PAPERLESS_SECRET_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-secrets
|
|
key: PAPERLESS_SECRET_KEY
|
|
- name: PAPERLESS_ADMIN_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-secrets
|
|
key: PAPERLESS_ADMIN_USER
|
|
- name: PAPERLESS_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-secrets
|
|
key: PAPERLESS_ADMIN_PASSWORD
|
|
- name: PAPERLESS_SOCIALACCOUNT_PROVIDERS
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-oidc
|
|
key: SOCIALACCOUNT_PROVIDERS_JSON
|
|
resources:
|
|
requests: { cpu: "500m", memory: "1Gi" }
|
|
limits: { cpu: "2", memory: "4Gi" }
|
|
volumeMounts:
|
|
- name: media
|
|
mountPath: /usr/src/paperless/media
|
|
- name: data
|
|
mountPath: /usr/src/paperless/data
|
|
- name: consume
|
|
mountPath: /usr/src/paperless/consume
|
|
# Overrides paperless-ngx's own adapter.py in place - settings.py
|
|
# hardcodes the import path, so no Django setting changes, just
|
|
# the file content underneath it (see adapter-configmap.yaml).
|
|
- name: adapter
|
|
mountPath: /usr/src/paperless/src/paperless/adapter.py
|
|
subPath: adapter.py
|
|
readOnly: true
|
|
volumes:
|
|
- name: media
|
|
persistentVolumeClaim:
|
|
claimName: paperless-media
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: paperless-data
|
|
- name: consume
|
|
emptyDir: {}
|
|
- name: adapter
|
|
configMap:
|
|
name: paperless-adapter
|