Rework Paperless-ngx around Caddy, network, and storage roles

paperless-ngx/roles/caddy/handlers/main.yaml

@@ -0,0 +1,5 @@
+---
+# Handlers for Caddy role
+- name: Reload Caddy configuration
+  ansible.builtin.command: "docker exec -w /etc/caddy {{ caddy_container }} caddy reload"
+  listen: "Reload Caddy"

paperless-ngx/roles/caddy/tasks/main.yaml

@@ -0,0 +1,22 @@
+---
+- name: Read current Caddyfile
+  ansible.builtin.slurp:
+    path: "{{ caddyfile_path }}"
+  register: caddyfile_raw
+
+- name: Decode Caddyfile content
+  set_fact:
+    caddyfile_content: "{{ caddyfile_raw['content'] | b64decode }}"
+
+- name: Check if snippet already exists
+  set_fact:
+    snippet_present: "{{ snippet_block in caddyfile_content }}"
+
+- name: Add snippet if missing
+  ansible.builtin.blockinfile:
+    path: "{{ caddyfile_path }}"
+    marker: "# {mark} Ansible managed Caddy snippet for {{ host }}"
+    block: "{{ snippet_block }}"
+    create: yes
+  when: not snippet_present
+  notify: "Reload Caddy"

paperless-ngx/roles/network/tasks/main.yaml

@@ -0,0 +1,10 @@
+---
+- name: "Ensure {{ container_name }} Docker network exists"
+  docker_network:
+    name: "{{ docker_network }}"
+    state: present
+    connected:
+      - "{{ caddy_container }}"
+      - "{{ postgres_container }}"
+      - "{{ redis_container }}"
+    appends: yes

paperless-ngx/roles/nginx/handlers/main.yaml

@@ -1,6 +0,0 @@
----
-# Handlers for Nginx role
-- name: Reload Nginx
-  service:
-    name: nginx
-    state: reloaded

paperless-ngx/roles/nginx/tasks/main.yaml

@@ -1,24 +0,0 @@
----
-# Tasks for Nginx role
-- name: Check if Nginx conf file exists
-  stat:
-    path: "/etc/nginx/sites-available/{{ http_conf }}"
-  register: status
-
-- name: No need to reload Nginx
-  debug:
-    msg: "No need to reload Nginx as sites-available entries have already been created"
-
-- name: Set Nginx conf file
-  when: status.stat.exists == false
-  template:
-    src: "files/nginx.conf.j2"
-    dest: "/etc/nginx/sites-available/{{ http_conf }}"
-
-- name: Enable new site
-  when: status.stat.exists == false
-  file:
-    src: "/etc/nginx/sites-available/{{ http_conf }}"
-    dest: "/etc/nginx/sites-enabled/{{ http_conf }}"
-    state: link
-  notify: Reload Nginx

paperless-ngx/roles/paperless/tasks/main.yml

@@ -5,41 +5,46 @@
     source: pull
     force_source: yes
 
-
 - name: Ensure Paperless Directories exists
   file:
       path: "{{ item }}"
       state: directory
-      mode: 0755
+      mode: "0755"
   loop:
     - "/var/lib/{{ host_directory }}"
     - "/var/lib/{{ host_directory }}/data"
-    - "/var/lib/{{ host_directory }}/media"
-    - "/var/lib/{{ host_directory }}/export"
-    - "/var/lib/{{ host_directory }}/consume"
 
 - name: Run Paperless-NGX Docker container
   community.docker.docker_container:
     name: "{{ container_name }}"
     image: "{{ image_name }}:{{ image_version }}"
     state: started
-    restart_policy: always
-    links:
-      - postgres:db
-      - redis:redis
+    restart_policy: unless-stopped
+    networks:
+      - name: "{{ docker_network }}"
     env:
-      PAPERLESS_URL: "https://{{ http_host }}"
-      PAPERLESS_REDIS: redis://redis:6379
-      PAPERLESS_DBHOST: db
+      PAPERLESS_URL: "https://{{ host }}"
+      PAPERLESS_REDIS: redis://{{ redis_container }}:6379
+      PAPERLESS_DBHOST: "{{ postgres_container }}"
       PAPERLESS_DBUSER: "{{ postgres_user }}"
       PAPERLESS_DBPASS: "{{ postgres_password }}"
       PAPERLESS_DBNAME: "{{ postgres_db }}"
       PAPERLESS_TIME_ZONE: "{{ paperless_time_zone }}"
+      USERMAP_UID: "{{ paperless_uid }}"
+      USERMAP_GID: "{{ paperless_uid }}"
+      PAPERLESS_CONSUMER_RECURSIVE: "true"
+      # inotify cannot see changes made remotely through WebDAV, so poll
+      PAPERLESS_CONSUMER_POLLING: "60"
       PAPERLESS_OCR_USER_ARGS: '{"invalidate_digital_signatures": true}'
     volumes:
       - "/var/lib/{{ host_directory }}/data:/usr/src/paperless/data"
-      - "/var/lib/{{ host_directory }}/media:/usr/src/paperless/media"
-      - "/var/lib/{{ host_directory }}/export:/usr/src/paperless/export"
-      - "/var/lib/{{ host_directory }}/consume:/usr/src/paperless/consume"
-    ports:
-      - "127.0.0.1:{{ web_port }}:8000"
+      - "/mnt/paperless/media:/usr/src/paperless/media:rslave"
+      - "/mnt/paperless/export:/usr/src/paperless/export:rslave"
+      - "/mnt/paperless/consume:/usr/src/paperless/consume:rslave"
+
+- name: Export documents nightly to the Nextcloud export folder
+  cron:
+    name: Paperless export
+    minute: "30"
+    hour: "2"
+    job: "docker exec {{ container_name }} document_exporter ../export -d"

paperless-ngx/roles/storage/handlers/main.yaml

@@ -0,0 +1,7 @@
+---
+- name: Restart rclone mounts
+  systemd:
+    name: "paperless-{{ item.name }}.service"
+    state: restarted
+    daemon_reload: true
+  loop: "{{ rclone_mounts }}"

paperless-ngx/roles/storage/tasks/main.yaml

@@ -0,0 +1,59 @@
+---
+# rclone FUSE mounts so consume/export (Nextcloud WebDAV) and media (S3)
+# take no space on the VPS beyond a small cache.
+- name: Install rclone and fuse
+  apt:
+    name:
+      - rclone
+      - fuse3
+    state: present
+    update_cache: true
+
+- name: Obscure the Nextcloud password for rclone
+  command: rclone obscure "{{ nextcloud_app_password }}"
+  register: obscured_pass
+  changed_when: false
+  no_log: true
+
+- name: Write rclone config
+  template:
+    src: rclone.conf.j2
+    dest: /etc/rclone-paperless.conf
+    owner: root
+    group: root
+    mode: "0600"
+  no_log: true
+  notify: Restart rclone mounts
+
+- name: Ensure mount points and cache exist
+  file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0755"
+  loop:
+    - /mnt/paperless
+    - "{{ rclone_cache_dir }}"
+    - /mnt/paperless/consume
+    - /mnt/paperless/export
+    - /mnt/paperless/media
+
+- name: Ensure the Nextcloud folders exist
+  command: rclone --config /etc/rclone-paperless.conf mkdir "{{ item.remote }}"
+  loop: "{{ rclone_mounts }}"
+  changed_when: false
+
+- name: Install mount units
+  template:
+    src: rclone-mount.service.j2
+    dest: "/etc/systemd/system/paperless-{{ item.name }}.service"
+    mode: "0644"
+  loop: "{{ rclone_mounts }}"
+  notify: Restart rclone mounts
+
+- name: Enable and start mount units
+  systemd:
+    name: "paperless-{{ item.name }}.service"
+    enabled: true
+    state: started
+    daemon_reload: true
+  loop: "{{ rclone_mounts }}"

paperless-ngx/roles/storage/templates/rclone-mount.service.j2

@@ -0,0 +1,19 @@
+[Unit]
+Description=rclone mount for Paperless {{ item.name }}
+After=network-online.target
+Wants=network-online.target
+Before=docker.service
+
+[Service]
+Type=notify
+ExecStart=/usr/bin/rclone mount {{ item.remote }} /mnt/paperless/{{ item.name }} \
+  --config /etc/rclone-paperless.conf \
+  --allow-other --uid {{ paperless_uid }} --gid {{ paperless_uid }} --umask 022 \
+  --vfs-cache-mode {{ item.cache }} --cache-dir {{ rclone_cache_dir }} \
+  --vfs-cache-max-size 2G --dir-cache-time 30s
+ExecStop=/bin/fusermount3 -u /mnt/paperless/{{ item.name }}
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target

paperless-ngx/roles/storage/templates/rclone.conf.j2

@@ -0,0 +1,13 @@
+[nextcloud]
+type = webdav
+url = {{ nextcloud_url }}/remote.php/dav/files/{{ nextcloud_user }}
+vendor = nextcloud
+user = {{ nextcloud_user }}
+pass = {{ obscured_pass.stdout }}
+
+[s3]
+type = s3
+provider = AWS
+access_key_id = {{ s3_access_key }}
+secret_access_key = {{ s3_secret_key }}
+region = {{ s3_region }}