{
  pkgs,
  config,
  lib,
  ...
}: {
  sops.secrets.paperless-pwd = {
    owner = "paperless";
    group = "paperless";
  };

  systemd.services = {
    paperless-task-queue.serviceConfig = {PrivateNetwork = false;};
    paperless-scheduler.serviceConfig = {PrivateNetwork = lib.mkForce false;};
  };

  services.paperless = let
    dataDir = "/var/lib/paperless-ngx";
  in {
    package = pkgs.paperless-ngx;
    enable = true;
    address = "0.0.0.0";
    port = 28981;
    passwordFile = config.sops.secrets.paperless-pwd.path;
    dataDir = "${dataDir}";
    mediaDir = "${dataDir}/media";
    consumptionDir = "${dataDir}/consume";
    settings = {
      PAPERLESS_ADMIN_USER = "notoh";
      PAPERLESS_REDIS = "redis://:paperless-ngx@192.168.1.211:6382";
      PAPERLESS_EMAIL_TASK_CRON = "*/5 * * * *";
    };
  };
}