Rework Paperless-ngx around Caddy, network, and storage roles

paperless-ngx/vars/default.yml

@@ -1,21 +1,56 @@
 ---
-
+container_name: paperless-ngx
 image_name: ghcr.io/paperless-ngx/paperless-ngx
 image_version: "latest"
-container_name: paperless-ngx
 
-web_port: 8000          # Configurable port
+docker_network: paperless_net
+
+postgres_container: postgres
+caddy_container: caddy
+redis_container: valkey
+
+host: paperless.tanshu.com
+
+caddyfile_path: /var/lib/caddy/conf/Caddyfile
+snippet_block: |
+  {{ host }} {
+      request_body {
+          max_size 128MB
+      }
+
+      reverse_proxy {{ container_name }}:8000
+
+      header {
+          Strict-Transport-Security "max-age=15552000; includeSubDomains; preload"
+      }
+  }
 
 host_directory: paperless
-http_host: paperless.tanshu.com  # Replace with your domain
-http_conf: "{{ http_host }}.conf"
 
 paperless_time_zone: Etc/UTC
 postgres_user: "postgres"
 postgres_password: "123456"
 postgres_db: "paperless"
 
+# Storage: nothing bulky lives on the VPS disk. rclone mounts (see the storage role):
+#   consume/export -> Nextcloud WebDAV (Nextcloud itself is backed by S3)
+#   media          -> S3 bucket directly
+paperless_uid: 1000  # uid/gid paperless runs as; the mounts are presented as this user
+rclone_cache_dir: /var/cache/rclone
 
+nextcloud_url: https://cloud.hopsngrains.com
+nextcloud_user: admin
+nextcloud_app_password: "xxxx"  # Nextcloud > Settings > Security > App password
+nextcloud_consume_path: Paperless/Consume
+nextcloud_export_path: Paperless/Export
 
-# db_url: postgresql://postgres:123456@db:5432/paperless
+s3_bucket: "xxxx"  # use a bucket separate from Nextcloud's
+s3_region: ap-south-1
+s3_access_key: "xxxx"
+s3_secret_key: "xxxx"
+s3_media_prefix: media
 
+rclone_mounts:
+  - { name: consume, remote: "nextcloud:{{ nextcloud_consume_path }}", cache: "off" }
+  - { name: export, remote: "nextcloud:{{ nextcloud_export_path }}", cache: "writes" }
+  - { name: media, remote: "s3:{{ s3_bucket }}/{{ s3_media_prefix }}", cache: "full" }