{
  pkgs,
  config,
  lib,
  ...
}:
{
  xyno.services.caddy.wildcardHosts."hailsatan.eu".hosts.paperless.extraConfig =
    "import reverse_proxy_auth http://${config.services.paperless.address}:${toString config.services.paperless.port}";
  xyno.impermanence.directories = [ config.services.paperless.dataDir ];
  xyno.services.authentik.proxyApps.paperless = {
    externalHost = "https://paperless.hailsatan.eu";
    name = "Paperless";
    groups = [ "admin" ];
  };
  services.paperless = {
    configureTika = true;
    enable = true;
    database.createLocally = true;
    domain = "paperless.hailsatan.eu";
    exporter = {
      enable = true;
      directory = "/data/paperless-export";
    };
  };
}