v1.14.2

New Crowdin updates

.build-config.json

@@ -1,6 +1,6 @@
 {
   "qpdf": {
-      "version": "11.1.1"
+      "version": "11.3.0"
     },
   "jbig2enc": {
       "version": "0.29",

.codecov.yml

@@ -0,0 +1,19 @@
+# https://docs.codecov.com/docs/pull-request-comments
+# codecov will only comment if coverage changes
+comment:
+  require_changes: true
+coverage:
+  status:
+    project:
+      default:
+        # https://docs.codecov.com/docs/commit-status#threshold
+        threshold: 1%
+        # https://docs.codecov.com/docs/commit-status#only_pulls
+        only_pulls: true
+    patch:
+      default:
+        # For the changed lines only, target 75% covered, but
+        # allow as low as 50%
+        target: 75%
+        threshold: 25%
+        only_pulls: true

.github/DISCUSSION_TEMPLATE/feature-requests.yml

@@ -0,0 +1,14 @@
+title: "[Feature Request] "
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: A clear and concise description of what you would like to see.
+    validations:
+      required: true
+  - type: textarea
+    id: other
+    attributes:
+      label: Other
+      description: Add any other context or information about the feature request here.

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -6,7 +6,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        Have a question? 👉 [Start a new discussion](https://github.com/paperless-ngx/paperless-ngx/discussions/new) or [ask in chat](https://matrix.to/#/#paperless:adnidor.de).
+        Have a question? 👉 [Start a new discussion](https://github.com/paperless-ngx/paperless-ngx/discussions/new) or [ask in chat](https://matrix.to/#/#paperlessngx:matrix.org).
 
         Before opening an issue, please double check:
 

.github/ISSUE_TEMPLATE/config.yml

@@ -4,7 +4,7 @@ contact_links:
     url: https://github.com/paperless-ngx/paperless-ngx/discussions
     about: This issue tracker is not for support questions. Please refer to our Discussions.
   - name: 💬 Chat
-    url: https://matrix.to/#/#paperless:adnidor.de
+    url: https://matrix.to/#/#paperlessngx:matrix.org
     about: Want to discuss Paperless-ngx with others? Check out our chat.
   - name: 🚀 Feature Request
     url: https://github.com/paperless-ngx/paperless-ngx/discussions/new?category=feature-requests

.github/release-drafter.yml

@@ -4,6 +4,7 @@ autolabeler:
       - '/^fix/'
     title:
       - "/^fix/i"
+      - "/^Bugfix/i"
   - label: "enhancement"
     branch:
       - '/^feature/'
@@ -13,6 +14,9 @@ categories:
   - title: 'Breaking Changes'
     labels:
       - 'breaking-change'
+  - title: 'Notable Changes'
+    labels:
+      - 'notable'
   - title: 'Features'
     labels:
       - 'enhancement'
@@ -20,7 +24,8 @@ categories:
     labels:
       - 'bug'
   - title: 'Documentation'
-    label: 'documentation'
+    labels:
+      - 'documentation'
   - title: 'Maintenance'
     labels:
       - 'chore'
@@ -29,12 +34,13 @@ categories:
       - 'ci-cd'
   - title: 'Dependencies'
     collapse-after: 3
-    label: 'dependencies'
+    labels:
+      - 'dependencies'
   - title: 'All App Changes'
     labels:
       - 'frontend'
       - 'backend'
-    collapse-after: 0
+    collapse-after: 1
 include-labels:
   - 'enhancement'
   - 'bug'
@@ -46,6 +52,10 @@ include-labels:
   - 'frontend'
   - 'backend'
   - 'ci-cd'
+  - 'breaking-change'
+  - 'notable'
+exclude-labels:
+  - 'skip-changelog'
 category-template: '### $TITLE'
 change-template: '- $TITLE @$AUTHOR ([#$NUMBER]($URL))'
 change-title-escapes: '\<*_&#@'

.github/scripts/cleanup-tags.py

@@ -1,4 +1,3 @@
-#!/usr/bin/env python3
 import json
 import logging
 import os
@@ -7,6 +6,7 @@ import subprocess
 from argparse import ArgumentParser
 from typing import Dict
 from typing import Final
+from typing import Iterator
 from typing import List
 from typing import Optional
 
@@ -18,11 +18,14 @@ from github import GithubContainerRegistryApi
 logger = logging.getLogger("cleanup-tags")
 
 
-class DockerManifest2:
+class ImageProperties:
     """
-    Data class wrapping the Docker Image Manifest Version 2.
+    Data class wrapping the properties of an entry in the image index
+    manifests list.  It is NOT an actual image with layers, etc
 
-    See https://docs.docker.com/registry/spec/manifest-v2-2/
+    https://docs.docker.com/registry/spec/manifest-v2-2/
+    https://github.com/opencontainers/image-spec/blob/main/manifest.md
+    https://github.com/opencontainers/image-spec/blob/main/descriptor.md
     """
 
     def __init__(self, data: Dict) -> None:
@@ -39,6 +42,45 @@ class DockerManifest2:
         self.platform = f"{platform_data_os}/{platform_arch}{platform_variant}"
 
 
+class ImageIndex:
+    """
+    Data class wrapping up logic for an OCI Image Index
+    JSON data.  Primary use is to access the manifests listing
+
+    See https://github.com/opencontainers/image-spec/blob/main/image-index.md
+    """
+
+    def __init__(self, package_url: str, tag: str) -> None:
+        self.qualified_name = f"{package_url}:{tag}"
+        logger.info(f"Getting image index for {self.qualified_name}")
+        try:
+            proc = subprocess.run(
+                [
+                    shutil.which("docker"),
+                    "buildx",
+                    "imagetools",
+                    "inspect",
+                    "--raw",
+                    self.qualified_name,
+                ],
+                capture_output=True,
+                check=True,
+            )
+
+            self._data = json.loads(proc.stdout)
+
+        except subprocess.CalledProcessError as e:
+            logger.error(
+                f"Failed to get image index for {self.qualified_name}: {e.stderr}",
+            )
+            raise e
+
+    @property
+    def image_pointers(self) -> Iterator[ImageProperties]:
+        for manifest_data in self._data["manifests"]:
+            yield ImageProperties(manifest_data)
+
+
 class RegistryTagsCleaner:
     """
     This is the base class for the image registry cleaning.  Given a package
@@ -85,7 +127,10 @@ class RegistryTagsCleaner:
 
     def clean(self):
         """
-        This method will delete image versions, based on the selected tags to delete
+        This method will delete image versions, based on the selected tags to delete.
+        It behaves more like an unlinking than actual deletion.  Removing the tag
+        simply removes a pointer to an image, but the actual image data remains accessible
+        if one has the sha256 digest of it.
         """
         for tag_to_delete in self.tags_to_delete:
             package_version_info = self.all_pkgs_tags_to_version[tag_to_delete]
@@ -149,27 +194,16 @@ class RegistryTagsCleaner:
 
             # Parse manifests to locate digests pointed to
             for tag in sorted(self.tags_to_keep):
-                full_name = f"ghcr.io/{self.repo_owner}/{self.package_name}:{tag}"
-                logger.info(f"Checking manifest for {full_name}")
                 try:
-                    proc = subprocess.run(
-                        [
-                            shutil.which("docker"),
-                            "manifest",
-                            "inspect",
-                            full_name,
-                        ],
-                        capture_output=True,
+                    image_index = ImageIndex(
+                        f"ghcr.io/{self.repo_owner}/{self.package_name}",
+                        tag,
                     )
-
-                    manifest_list = json.loads(proc.stdout)
-                    for manifest_data in manifest_list["manifests"]:
-                        manifest = DockerManifest2(manifest_data)
-
+                    for manifest in image_index.image_pointers:
                         if manifest.digest in untagged_versions:
                             logger.info(
                                 f"Skipping deletion of {manifest.digest},"
-                                f" referred to by {full_name}"
+                                f" referred to by {image_index.qualified_name}"
                                 f" for {manifest.platform}",
                             )
                             del untagged_versions[manifest.digest]
@@ -241,6 +275,53 @@ class RegistryTagsCleaner:
         # By default, keep anything which is tagged
         self.tags_to_keep = list(set(self.all_pkgs_tags_to_version.keys()))
 
+    def check_remaining_tags_valid(self):
+        """
+        Checks the non-deleted tags are still valid.  The assumption is if the
+        manifest is can be inspected and each image manifest if points to can be
+        inspected, the image will still pull.
+
+        https://github.com/opencontainers/image-spec/blob/main/image-index.md
+        """
+        logger.info("Beginning confirmation step")
+        a_tag_failed = False
+        for tag in sorted(self.tags_to_keep):
+            try:
+                image_index = ImageIndex(
+                    f"ghcr.io/{self.repo_owner}/{self.package_name}",
+                    tag,
+                )
+                for manifest in image_index.image_pointers:
+                    logger.info(f"Checking {manifest.digest} for {manifest.platform}")
+
+                    # This follows the pointer from the index to an actual image, layers and all
+                    # Note the format is @
+                    digest_name = f"ghcr.io/{self.repo_owner}/{self.package_name}@{manifest.digest}"
+
+                    try:
+                        subprocess.run(
+                            [
+                                shutil.which("docker"),
+                                "buildx",
+                                "imagetools",
+                                "inspect",
+                                "--raw",
+                                digest_name,
+                            ],
+                            capture_output=True,
+                            check=True,
+                        )
+                    except subprocess.CalledProcessError as e:
+                        logger.error(f"Failed to inspect digest: {e.stderr}")
+                        a_tag_failed = True
+            except subprocess.CalledProcessError as e:
+                a_tag_failed = True
+                logger.error(f"Failed to inspect: {e.stderr}")
+                continue
+
+        if a_tag_failed:
+            raise Exception("At least one image tag failed to inspect")
+
 
 class MainImageTagsCleaner(RegistryTagsCleaner):
     def decide_what_tags_to_keep(self):
@@ -301,12 +382,10 @@ class MainImageTagsCleaner(RegistryTagsCleaner):
 
 class LibraryTagsCleaner(RegistryTagsCleaner):
     """
-    Exists for the off change that someday, the installer library images
+    Exists for the off chance that someday, the installer library images
     will need their own logic
     """
 
-    pass
-
 
 def _main():
     parser = ArgumentParser(
@@ -397,6 +476,10 @@ def _main():
             # Clean images which are untagged
             cleaner.clean_untagged(args.is_manifest)
 
+            # Verify remaining tags still pull
+            if args.is_manifest:
+                cleaner.check_remaining_tags_valid()
+
 
 if __name__ == "__main__":
     _main()

.github/scripts/common.py

@@ -1,4 +1,3 @@
-#!/usr/bin/env python3
 import logging
 
 

.github/scripts/get-build-json.py

@@ -1,4 +1,3 @@
-#!/usr/bin/env python3
 """
 This is a helper script for the mutli-stage Docker image builder.
 It provides a single point of configuration for package version control.

.github/scripts/github.py

@@ -1,4 +1,3 @@
-#!/usr/bin/env python3
 """
 This module contains some useful classes for interacting with the Github API.
 The full documentation for the API can be found here: https://docs.github.com/en/rest
@@ -162,10 +161,7 @@ class ContainerPackage(_EndpointResponse):
         Returns True if the image has at least one tag which matches the given regex,
         False otherwise
         """
-        for tag in self.tags:
-            if re.match(pattern, tag) is not None:
-                return True
-        return False
+        return any(re.match(pattern, tag) is not None for tag in self.tags)
 
     def __repr__(self):
         return f"Package {self.name}"

.github/workflows/ci.yml

@@ -13,57 +13,64 @@ on:
     branches-ignore:
       - 'translations**'
 
+env:
+  # This is the version of pipenv all the steps will use
+  # If changing this, change Dockerfile
+  DEFAULT_PIP_ENV_VERSION: "2023.3.20"
+  # This is the default version of Python to use in most steps
+  # If changing this, change Dockerfile
+  DEFAULT_PYTHON_VERSION: "3.9"
+
 jobs:
   pre-commit:
     name: Linting Checks
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       -
         name: Checkout repository
         uses: actions/checkout@v3
-
       -
-        name: Install tools
+        name: Install python
         uses: actions/setup-python@v4
         with:
-          python-version: "3.9"
-
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
       -
         name: Check files
         uses: pre-commit/action@v3.0.0
 
   documentation:
     name: "Build Documentation"
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     needs:
       - pre-commit
     steps:
       -
         name: Checkout
         uses: actions/checkout@v3
-      -
-        name: Install pipenv
-        run: |
-          pipx install pipenv==2022.10.12
       -
         name: Set up Python
+        id: setup-python
         uses: actions/setup-python@v4
         with:
-          python-version: 3.8
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
           cache: "pipenv"
           cache-dependency-path: 'Pipfile.lock'
+      -
+        name: Install pipenv
+        run: |
+          pip install --user pipenv==${DEFAULT_PIP_ENV_VERSION}
       -
         name: Install dependencies
         run: |
-          pipenv sync --dev
+          pipenv --python ${{ steps.setup-python.outputs.python-version }} sync --dev
       -
         name: List installed Python dependencies
         run: |
-          pipenv run pip list
+          pipenv --python ${{ steps.setup-python.outputs.python-version }} run pip list
       -
         name: Make documentation
         run: |
-          pipenv run mkdocs build --config-file ./mkdocs.yml
+          pipenv --python ${{ steps.setup-python.outputs.python-version }} run mkdocs build --config-file ./mkdocs.yml
       -
         name: Upload artifact
         uses: actions/upload-artifact@v3
@@ -73,7 +80,7 @@ jobs:
 
   documentation-deploy:
     name: "Deploy Documentation"
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     needs:
       - documentation
@@ -92,7 +99,7 @@ jobs:
 
   tests-backend:
     name: "Tests (${{ matrix.python-version }})"
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     needs:
       - pre-commit
     strategy:
@@ -106,68 +113,61 @@ jobs:
       PAPERLESS_MAIL_TEST_HOST: ${{ secrets.TEST_MAIL_HOST }}
       PAPERLESS_MAIL_TEST_USER: ${{ secrets.TEST_MAIL_USER }}
       PAPERLESS_MAIL_TEST_PASSWD: ${{ secrets.TEST_MAIL_PASSWD }}
+      # Enable Gotenberg end to end testing
+      GOTENBERG_LIVE: 1
     steps:
       -
         name: Checkout
         uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
       -
         name: Start containers
         run: |
           docker compose --file ${GITHUB_WORKSPACE}/docker/compose/docker-compose.ci-test.yml pull --quiet
           docker compose --file ${GITHUB_WORKSPACE}/docker/compose/docker-compose.ci-test.yml up --detach
-      -
-        name: Install pipenv
-        run: |
-          pipx install pipenv==2022.10.12
       -
         name: Set up Python
+        id: setup-python
         uses: actions/setup-python@v4
         with:
           python-version: "${{ matrix.python-version }}"
           cache: "pipenv"
           cache-dependency-path: 'Pipfile.lock'
+      -
+        name: Install pipenv
+        run: |
+          pip install --user pipenv==${DEFAULT_PIP_ENV_VERSION}
       -
         name: Install system dependencies
         run: |
           sudo apt-get update -qq
           sudo apt-get install -qq --no-install-recommends unpaper tesseract-ocr imagemagick ghostscript libzbar0 poppler-utils
+      -
+        name: Configure ImageMagick
+        run: |
+          sudo cp docker/imagemagick-policy.xml /etc/ImageMagick-6/policy.xml
       -
         name: Install Python dependencies
         run: |
-          pipenv sync --dev
+          pipenv --python ${{ steps.setup-python.outputs.python-version }} run python --version
+          pipenv --python ${{ steps.setup-python.outputs.python-version }} sync --dev
       -
         name: List installed Python dependencies
         run: |
-          pipenv run pip list
+          pipenv --python ${{ steps.setup-python.outputs.python-version }} run pip list
       -
         name: Tests
         run: |
           cd src/
-          pipenv run pytest -rfEp
+          pipenv --python ${{ steps.setup-python.outputs.python-version }} run pytest -ra
       -
-        name: Get changed files
-        id: changed-files-specific
-        uses: tj-actions/changed-files@v34
+        name: Upload coverage to Codecov
+        if: ${{ matrix.python-version == env.DEFAULT_PYTHON_VERSION }}
+        uses: codecov/codecov-action@v3
         with:
-          files: |
-            src/**
-      -
-        name: List all changed files
-        run: |
-          for file in ${{ steps.changed-files-specific.outputs.all_changed_files }}; do
-            echo "${file} was changed"
-          done
-      -
-        name: Publish coverage results
-        if: matrix.python-version == '3.9' && steps.changed-files-specific.outputs.any_changed == 'true'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        # https://github.com/coveralls-clients/coveralls-python/issues/251
-        run: |
-          cd src/
-          pipenv run coveralls --service=github
+          # not required for public repos, but intermittently fails otherwise
+          token: ${{ secrets.CODECOV_TOKEN }}
+          # future expansion
+          flags: backend
       -
         name: Stop containers
         if: always()
@@ -177,7 +177,7 @@ jobs:
 
   tests-frontend:
     name: "Tests Frontend"
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     needs:
       - pre-commit
     strategy:
@@ -190,20 +190,17 @@ jobs:
         uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node-version }}
+          cache: 'npm'
+          cache-dependency-path: 'src-ui/package-lock.json'
       - run: cd src-ui && npm ci
+      - run: cd src-ui && npm run lint
       - run: cd src-ui && npm run test
       - run: cd src-ui && npm run e2e:ci
 
   prepare-docker-build:
     name: Prepare Docker Pipeline Data
     if: github.event_name == 'push' && (startsWith(github.ref, 'refs/heads/feature-') || github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/beta' || contains(github.ref, 'beta.rc') || startsWith(github.ref, 'refs/tags/v'))
-    runs-on: ubuntu-20.04
-    # If the push triggered the installer library workflow, wait for it to
-    # complete here.  This ensures the required versions for the final
-    # image have been built, while not waiting at all if the versions haven't changed
-    concurrency:
-      group: build-installer-library
-      cancel-in-progress: false
+    runs-on: ubuntu-22.04
     needs:
       - documentation
       - tests-backend
@@ -222,7 +219,7 @@ jobs:
         name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: "3.9"
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
       -
         name: Setup qpdf image
         id: qpdf-setup
@@ -274,7 +271,7 @@ jobs:
 
   # build and push image to docker hub.
   build-docker-image:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     concurrency:
       group: ${{ github.workflow }}-build-docker-image-${{ github.ref_name }}
       cancel-in-progress: true
@@ -306,6 +303,7 @@ jobs:
           images: |
             ghcr.io/${{ needs.prepare-docker-build.outputs.ghcr-repository }}
             name=paperlessngx/paperless-ngx,enable=${{ steps.docker-hub.outputs.enable }}
+            name=quay.io/paperlessngx/paperless-ngx,enable=${{ steps.docker-hub.outputs.enable }}
           tags: |
             # Tag branches with branch name
             type=ref,event=branch
@@ -337,9 +335,18 @@ jobs:
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Login to Quay.io
+        uses: docker/login-action@v2
+        # Don't attempt to login is not pushing to Docker Hub
+        if: steps.docker-hub.outputs.enable == 'true'
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
       -
         name: Build and push
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v4
         with:
           context: .
           file: ./Dockerfile
@@ -379,27 +386,27 @@ jobs:
   build-release:
     needs:
       - build-docker-image
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
       -
         name: Checkout
         uses: actions/checkout@v3
-      -
-        name: Install pipenv
-        run: |
-          pip3 install --upgrade pip setuptools wheel pipx
-          pipx install pipenv
       -
         name: Set up Python
+        id: setup-python
         uses: actions/setup-python@v4
         with:
-          python-version: 3.9
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
           cache: "pipenv"
           cache-dependency-path: 'Pipfile.lock'
+      -
+        name: Install pipenv + tools
+        run: |
+          pip install --upgrade --user pipenv==${DEFAULT_PIP_ENV_VERSION} setuptools wheel
       -
         name: Install Python dependencies
         run: |
-          pipenv sync --dev
+          pipenv --python ${{ steps.setup-python.outputs.python-version }} sync --dev
       -
         name: Install system dependencies
         run: |
@@ -420,35 +427,62 @@ jobs:
       -
         name: Generate requirements file
         run: |
-          pipenv requirements > requirements.txt
+          pipenv --python ${{ steps.setup-python.outputs.python-version }} requirements > requirements.txt
       -
         name: Compile messages
         run: |
           cd src/
-          pipenv run python3 manage.py compilemessages
+          pipenv --python ${{ steps.setup-python.outputs.python-version }} run python3 manage.py compilemessages
       -
         name: Collect static files
         run: |
           cd src/
-          pipenv run python3 manage.py collectstatic --no-input
+          pipenv --python ${{ steps.setup-python.outputs.python-version }} run python3 manage.py collectstatic --no-input
       -
         name: Move files
         run: |
-          mkdir dist
-          mkdir dist/paperless-ngx
-          mkdir dist/paperless-ngx/scripts
-          cp .dockerignore .env Dockerfile Pipfile Pipfile.lock requirements.txt LICENSE README.md dist/paperless-ngx/
-          cp paperless.conf.example dist/paperless-ngx/paperless.conf
-          cp gunicorn.conf.py dist/paperless-ngx/gunicorn.conf.py
-          cp -r docker/ dist/paperless-ngx/docker
-          cp scripts/*.service scripts/*.sh dist/paperless-ngx/scripts/
-          cp -r src/ dist/paperless-ngx/src
-          cp -r docs/_build/html/ dist/paperless-ngx/docs
-          mv static dist/paperless-ngx
+          echo "Making dist folders"
+          for directory in dist \
+                          dist/paperless-ngx \
+                          dist/paperless-ngx/scripts;
+          do
+            mkdir --verbose --parents ${directory}
+          done
+
+          echo "Copying basic files"
+          for file_name in .dockerignore \
+                          .env \
+                          Dockerfile \
+                          Pipfile \
+                          Pipfile.lock \
+                          requirements.txt \
+                          LICENSE \
+                          README.md \
+                          paperless.conf.example \
+                          gunicorn.conf.py
+          do
+            cp --verbose ${file_name} dist/paperless-ngx/
+          done
+          mv --verbose dist/paperless-ngx/paperless.conf.example dist/paperless-ngx/paperless.conf
+
+          echo "Copying Docker related files"
+          cp --recursive docker/ dist/paperless-ngx/docker
+
+          echo "Copying startup scripts"
+          cp --verbose scripts/*.service scripts/*.sh scripts/*.socket dist/paperless-ngx/scripts/
+
+          echo "Copying source files"
+          cp --recursive src/ dist/paperless-ngx/src
+          echo "Copying documentation"
+          cp --recursive docs/_build/html/ dist/paperless-ngx/docs
+
+          mv --verbose static dist/paperless-ngx
       -
         name: Make release package
         run: |
+          echo "Creating release archive"
           cd dist
+          sudo chown -R 1000:1000 paperless-ngx/
           tar -cJf paperless-ngx.tar.xz paperless-ngx/
       -
         name: Upload release artifact
@@ -458,7 +492,7 @@ jobs:
           path: dist/paperless-ngx.tar.xz
 
   publish-release:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     outputs:
       prerelease: ${{ steps.get_version.outputs.prerelease }}
       changelog: ${{ steps.create-release.outputs.body }}
@@ -486,7 +520,7 @@ jobs:
       -
         name: Create Release and Changelog
         id: create-release
-        uses: paperless-ngx/release-drafter@master
+        uses: release-drafter/release-drafter@v5
         with:
           name: Paperless-ngx ${{ steps.get_version.outputs.version }}
           tag: ${{ steps.get_version.outputs.version }}
@@ -507,7 +541,7 @@ jobs:
           asset_content_type: application/x-xz
 
   append-changelog:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     needs:
       - publish-release
     if: needs.publish-release.outputs.prerelease == 'false'
@@ -517,18 +551,17 @@ jobs:
         uses: actions/checkout@v3
         with:
           ref: main
-      -
-        name: Install pipenv
-        run: |
-          pip3 install --upgrade pip setuptools wheel pipx
-          pipx install pipenv
       -
         name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: 3.9
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
           cache: "pipenv"
           cache-dependency-path: 'Pipfile.lock'
+      -
+        name: Install pipenv + tools
+        run: |
+          pip install --upgrade --user pipenv==${DEFAULT_PIP_ENV_VERSION} setuptools wheel
       -
         name: Append Changelog to docs
         id: append-Changelog
@@ -565,5 +598,5 @@ jobs:
               owner,
               repo,
               issue_number: result.data.number,
-              labels: ['documentation']
+              labels: ['documentation', 'skip-changelog']
             });

.github/workflows/cleanup-tags.yml

@@ -1,17 +1,14 @@
 # This workflow runs on certain conditions to check for and potentially
 # delete container images from the GHCR which no longer have an associated
 # code branch.
-# Requires a PAT with the correct scope set in the secrets
+# Requires a PAT with the correct scope set in the secrets.
+#
+# This workflow will not trigger runs on forked repos.
 
 name: Cleanup Image Tags
 
 on:
-  schedule:
-    - cron: '0 0 * * SAT'
   delete:
-  pull_request:
-    types:
-      - closed
   push:
     paths:
       - ".github/workflows/cleanup-tags.yml"
@@ -26,7 +23,8 @@ concurrency:
 jobs:
   cleanup-images:
     name: Cleanup Image Tags for ${{ matrix.primary-name }}
-    runs-on: ubuntu-latest
+    if: github.repository_owner == 'paperless-ngx'
+    runs-on: ubuntu-22.04
     strategy:
       matrix:
         include:
@@ -64,9 +62,9 @@ jobs:
         with:
           python-version: "3.10"
       -
-        name: Install httpx
+        name: Install Python libraries
         run: |
-          python -m pip install httpx
+          python -m pip install httpx docker
       #
       # Clean up primary package
       #
@@ -83,13 +81,3 @@ jobs:
         if: "${{ env.TOKEN != '' }}"
         run: |
           python ${GITHUB_WORKSPACE}/.github/scripts/cleanup-tags.py --untagged --delete "${{ matrix.cache-name }}"
-      #
-      # Verify tags which are left still pull
-      #
-      -
-        name: Check all tags still pull
-        run: |
-          ghcr_name=$(echo "ghcr.io/${GITHUB_REPOSITORY_OWNER}/${{ matrix.primary-name }}" | awk '{ print tolower($0) }')
-          echo "Pulling all tags of ${ghcr_name}"
-          docker pull --quiet --all-tags ${ghcr_name}
-          docker image list

.github/workflows/codeql-analysis.yml

@@ -23,7 +23,7 @@ on:
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       actions: read
       contents: read

.github/workflows/installer-library.yml

@@ -34,7 +34,7 @@ concurrency:
 jobs:
   prepare-docker-build:
     name: Prepare Docker Image Version Data
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
       -
         name: Set ghcr repository name
@@ -95,8 +95,8 @@ jobs:
         name: Setup other versions
         id: cache-bust-setup
         run: |
-          pillow_version=$(jq ".default.pillow.version" Pipfile.lock | sed 's/=//g' | sed 's/"//g')
-          lxml_version=$(jq ".default.lxml.version" Pipfile.lock | sed 's/=//g' | sed 's/"//g')
+          pillow_version=$(jq -r '.default.pillow.version | gsub("=";"")' Pipfile.lock)
+          lxml_version=$(jq -r '.default.lxml.version | gsub("=";"")' Pipfile.lock)
 
           echo "Pillow is ${pillow_version}"
           echo "lxml is ${lxml_version}"
@@ -127,6 +127,7 @@ jobs:
     uses: ./.github/workflows/reusable-workflow-builder.yml
     with:
       dockerfile: ./docker-builders/Dockerfile.qpdf
+      build-platforms: linux/amd64
       build-json: ${{ needs.prepare-docker-build.outputs.qpdf-json }}
       build-args: |
         QPDF_VERSION=${{ fromJSON(needs.prepare-docker-build.outputs.qpdf-json).version }}
@@ -168,3 +169,142 @@ jobs:
         PIKEPDF_VERSION=${{ fromJSON(needs.prepare-docker-build.outputs.pikepdf-json).version }}
         PILLOW_VERSION=${{ needs.prepare-docker-build.outputs.pillow-version }}
         LXML_VERSION=${{ needs.prepare-docker-build.outputs.lxml-version }}
+
+  commit-binary-files:
+    name: Store installers
+    needs:
+      - prepare-docker-build
+      - build-qpdf-debs
+      - build-jbig2enc
+      - build-psycopg2-wheel
+      - build-pikepdf-wheel
+    runs-on: ubuntu-22.04
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v3
+        with:
+          ref: binary-library
+      -
+        name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.9"
+      -
+        name: Install system dependencies
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -qq --no-install-recommends tree
+      -
+        name: Extract qpdf files
+        run: |
+          version=${{ fromJSON(needs.prepare-docker-build.outputs.qpdf-json).version }}
+          tag=${{ fromJSON(needs.prepare-docker-build.outputs.qpdf-json).image_tag }}
+
+          docker pull --quiet ${tag}
+          docker create --name qpdf-extract ${tag}
+
+          mkdir --parents qpdf/${version}/amd64
+          docker cp qpdf-extract:/usr/src/qpdf/${version}/amd64 qpdf/${version}
+
+          mkdir --parents qpdf/${version}/arm64
+          docker cp qpdf-extract:/usr/src/qpdf/${version}/arm64 qpdf/${version}
+
+          mkdir --parents qpdf/${version}/armv7
+          docker cp qpdf-extract:/usr/src/qpdf/${version}/armv7 qpdf/${version}
+      -
+        name: Extract psycopg2 files
+        run: |
+          version=${{ fromJSON(needs.prepare-docker-build.outputs.psycopg2-json).version }}
+          tag=${{ fromJSON(needs.prepare-docker-build.outputs.psycopg2-json).image_tag }}
+
+          docker pull --quiet --platform linux/amd64 ${tag}
+          docker create --platform linux/amd64 --name psycopg2-extract ${tag}
+          mkdir --parents psycopg2/${version}/amd64
+          docker cp psycopg2-extract:/usr/src/wheels/ psycopg2/${version}/amd64
+          mv psycopg2/${version}/amd64/wheels/* psycopg2/${version}/amd64
+          rm -r psycopg2/${version}/amd64/wheels/
+          docker rm psycopg2-extract
+
+          docker pull --quiet --platform linux/arm64 ${tag}
+          docker create --platform linux/arm64 --name psycopg2-extract ${tag}
+          mkdir --parents psycopg2/${version}/arm64
+          docker cp psycopg2-extract:/usr/src/wheels/ psycopg2/${version}/arm64
+          mv psycopg2/${version}/arm64/wheels/* psycopg2/${version}/arm64
+          rm -r psycopg2/${version}/arm64/wheels/
+          docker rm psycopg2-extract
+
+          docker pull --quiet --platform linux/arm/v7 ${tag}
+          docker create --platform linux/arm/v7 --name psycopg2-extract ${tag}
+          mkdir --parents psycopg2/${version}/armv7
+          docker cp psycopg2-extract:/usr/src/wheels/ psycopg2/${version}/armv7
+          mv psycopg2/${version}/armv7/wheels/* psycopg2/${version}/armv7
+          rm -r psycopg2/${version}/armv7/wheels/
+          docker rm psycopg2-extract
+      -
+        name: Extract pikepdf files
+        run: |
+          version=${{ fromJSON(needs.prepare-docker-build.outputs.pikepdf-json).version }}
+          tag=${{ fromJSON(needs.prepare-docker-build.outputs.pikepdf-json).image_tag }}
+
+          docker pull --quiet --platform linux/amd64 ${tag}
+          docker create --platform linux/amd64 --name pikepdf-extract ${tag}
+          mkdir --parents pikepdf/${version}/amd64
+          docker cp pikepdf-extract:/usr/src/wheels/ pikepdf/${version}/amd64
+          mv pikepdf/${version}/amd64/wheels/* pikepdf/${version}/amd64
+          rm -r pikepdf/${version}/amd64/wheels/
+          docker rm pikepdf-extract
+
+          docker pull --quiet --platform linux/arm64 ${tag}
+          docker create --platform linux/arm64 --name pikepdf-extract ${tag}
+          mkdir --parents pikepdf/${version}/arm64
+          docker cp pikepdf-extract:/usr/src/wheels/ pikepdf/${version}/arm64
+          mv pikepdf/${version}/arm64/wheels/* pikepdf/${version}/arm64
+          rm -r pikepdf/${version}/arm64/wheels/
+          docker rm pikepdf-extract
+
+          docker pull --quiet --platform linux/arm/v7 ${tag}
+          docker create --platform linux/arm/v7 --name pikepdf-extract ${tag}
+          mkdir --parents pikepdf/${version}/armv7
+          docker cp pikepdf-extract:/usr/src/wheels/ pikepdf/${version}/armv7
+          mv pikepdf/${version}/armv7/wheels/* pikepdf/${version}/armv7
+          rm -r pikepdf/${version}/armv7/wheels/
+          docker rm pikepdf-extract
+      -
+        name: Extract jbig2enc files
+        run: |
+          version=${{ fromJSON(needs.prepare-docker-build.outputs.jbig2enc-json).version }}
+          tag=${{ fromJSON(needs.prepare-docker-build.outputs.jbig2enc-json).image_tag }}
+
+          docker pull --quiet --platform linux/amd64 ${tag}
+          docker create --platform linux/amd64 --name jbig2enc-extract ${tag}
+          mkdir --parents jbig2enc/${version}/amd64
+          docker cp jbig2enc-extract:/usr/src/jbig2enc/build jbig2enc/${version}/amd64/
+          mv jbig2enc/${version}/amd64/build/* jbig2enc/${version}/amd64/
+          docker rm jbig2enc-extract
+
+          docker pull --quiet --platform linux/arm64 ${tag}
+          docker create --platform linux/arm64 --name jbig2enc-extract ${tag}
+          mkdir --parents jbig2enc/${version}/arm64
+          docker cp jbig2enc-extract:/usr/src/jbig2enc/build jbig2enc/${version}/arm64
+          mv jbig2enc/${version}/arm64/build/* jbig2enc/${version}/arm64/
+          docker rm jbig2enc-extract
+
+          docker pull --quiet --platform linux/arm/v7 ${tag}
+          docker create --platform linux/arm/v7 --name jbig2enc-extract ${tag}
+          mkdir --parents jbig2enc/${version}/armv7
+          docker cp jbig2enc-extract:/usr/src/jbig2enc/build jbig2enc/${version}/armv7
+          mv jbig2enc/${version}/armv7/build/* jbig2enc/${version}/armv7/
+          docker rm jbig2enc-extract
+      -
+        name: Show file structure
+        run: |
+          tree .
+      -
+        name: Commit files
+        run: |
+          git config --global user.name "github-actions"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add pikepdf/ qpdf/ psycopg2/ jbig2enc/
+          git commit -m "Updating installer packages" || true
+          git push origin || true

.github/workflows/project-actions.yml

@@ -24,11 +24,11 @@ env:
 jobs:
   issue_opened_or_reopened:
     name: issue_opened_or_reopened
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     if: github.event_name == 'issues' && (github.event.action == 'opened' || github.event.action == 'reopened')
     steps:
       - name: Add issue to project and set status to ${{ env.todo }}
-        uses: leonsteinhaeuser/project-beta-automations@v2.0.1
+        uses: leonsteinhaeuser/project-beta-automations@v2.1.0
         with:
           gh_token: ${{ secrets.GH_TOKEN }}
           organization: paperless-ngx
@@ -37,14 +37,14 @@ jobs:
           status_value: ${{ env.todo }} # Target status
   pr_opened_or_reopened:
     name: pr_opened_or_reopened
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       # write permission is required for autolabeler
       pull-requests: write
     if: github.event_name == 'pull_request_target' && (github.event.action == 'opened' || github.event.action == 'reopened') && github.event.pull_request.user.login != 'dependabot'
     steps:
       - name: Add PR to project and set status to "Needs Review"
-        uses: leonsteinhaeuser/project-beta-automations@v2.0.1
+        uses: leonsteinhaeuser/project-beta-automations@v2.1.0
         with:
           gh_token: ${{ secrets.GH_TOKEN }}
           organization: paperless-ngx

.github/workflows/release-chart.yml

@@ -1,31 +0,0 @@
----
-name: Release Charts
-
-on:
-  push:
-    tags:
-      - v*
-
-jobs:
-  release_chart:
-    name: "Release Chart"
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-
-      - name: Configure Git
-        run: |
-          git config user.name "$GITHUB_ACTOR"
-          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
-      - name: Install Helm
-        uses: azure/setup-helm@v3
-        with:
-          version: v3.10.0
-
-      - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.4.1
-        env:
-          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/repo-maintenance.yml

@@ -0,0 +1,47 @@
+name: 'Repository Maintenance'
+
+on:
+  schedule:
+    - cron: '0 3 * * *'
+  workflow_dispatch:
+
+permissions:
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: lock
+
+jobs:
+  stale:
+    name: 'Stale'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v8
+        with:
+          days-before-stale: 30
+          days-before-close: 7
+          only-labels: 'cant-reproduce'
+          stale-issue-label: stale
+          stale-pr-label: stale
+          stale-issue-message: >
+            This issue has been automatically marked as stale because it has not had
+            recent activity. It will be closed if no further activity occurs. Thank you
+            for your contributions.
+  lock-threads:
+    name: 'Lock Old Threads'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: dessant/lock-threads@v4
+        with:
+          issue-inactive-days: '30'
+          pr-inactive-days: '30'
+          log-output: true
+          issue-comment: >
+            This issue has been automatically locked since there
+            has not been any recent activity after it was closed.
+            Please open a new discussion or issue for related concerns.
+          pr-comment: >
+            This pull request has been automatically locked since there
+            has not been any recent activity after it was closed.
+            Please open a new discussion or issue for related concerns.

.github/workflows/reusable-workflow-builder.yml

@@ -13,6 +13,10 @@ on:
         required: false
         default: ""
         type: string
+      build-platforms:
+        required: false
+        default: linux/amd64,linux/arm64,linux/arm/v7
+        type: string
 
 concurrency:
   group: ${{ github.workflow }}-${{ fromJSON(inputs.build-json).name }}-${{ fromJSON(inputs.build-json).version }}
@@ -21,7 +25,7 @@ concurrency:
 jobs:
   build-image:
     name: Build ${{ fromJSON(inputs.build-json).name }} @ ${{ fromJSON(inputs.build-json).version }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       -
         name: Checkout
@@ -41,12 +45,12 @@ jobs:
         uses: docker/setup-qemu-action@v2
       -
         name: Build ${{ fromJSON(inputs.build-json).name }}
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v4
         with:
           context: .
           file: ${{ inputs.dockerfile }}
           tags: ${{ fromJSON(inputs.build-json).image_tag }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          platforms: ${{ inputs.build-platforms }}
           build-args: ${{ inputs.build-args }}
           push: true
           cache-from: type=registry,ref=${{ fromJSON(inputs.build-json).cache_tag }}

.gitignore

@@ -73,6 +73,7 @@ virtualenv
 .venv/
 /docker-compose.env
 /docker-compose.yml
+.ruff_cache/
 
 # Used for development
 scripts/import-for-development

.pre-commit-config.yaml

@@ -5,20 +5,19 @@
 repos:
   # General hooks
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.3.0
+    rev: v4.4.0
     hooks:
       - id: check-docstring-first
       - id: check-json
         exclude: "tsconfig.*json"
       - id: check-yaml
-        exclude: "charts/paperless-ngx/templates/common.yaml"
       - id: check-toml
       - id: check-executables-have-shebangs
       - id: end-of-file-fixer
         exclude_types:
           - svg
           - pofile
-        exclude: "^(LICENSE|charts/paperless-ngx/README.md)$"
+        exclude: "(^LICENSE$)"
       - id: mixed-line-ending
         args:
           - "--fix=lf"
@@ -35,44 +34,19 @@ repos:
           - javascript
           - ts
           - markdown
-        exclude: "(^Pipfile\\.lock$)|(^charts/paperless-ngx/README.md$)"
+        exclude: "(^Pipfile\\.lock$)"
   # Python hooks
-  - repo: https://github.com/asottile/reorder_python_imports
-    rev: v3.9.0
+  - repo: https://github.com/charliermarsh/ruff-pre-commit
+    rev: 'v0.0.263'
     hooks:
-      - id: reorder-python-imports
-        exclude: "(migrations)"
-  - repo: https://github.com/asottile/yesqa
-    rev: "v1.4.0"
-    hooks:
-      - id: yesqa
-        exclude: "(migrations)"
-  - repo: https://github.com/asottile/add-trailing-comma
-    rev: "v2.3.0"
-    hooks:
-      - id: add-trailing-comma
-        exclude: "(migrations)"
-  - repo: https://github.com/PyCQA/flake8
-    rev: 5.0.4
-    hooks:
-      - id: flake8
-        files: ^src/
-        args:
-          - "--config=./src/setup.cfg"
+      - id: ruff
   - repo: https://github.com/psf/black
-    rev: 22.10.0
+    rev: 23.3.0
     hooks:
       - id: black
-  - repo: https://github.com/asottile/pyupgrade
-    rev: v3.2.2
-    hooks:
-      - id: pyupgrade
-        exclude: "(migrations)"
-        args:
-          - "--py38-plus"
   # Dockerfile hooks
   - repo: https://github.com/AleksaC/hadolint-py
-    rev: v2.10.0
+    rev: v2.12.0.2
     hooks:
       - id: hadolint
   # Shell script hooks
@@ -83,6 +57,6 @@ repos:
         args:
           - "--tab"
   - repo: https://github.com/shellcheck-py/shellcheck-py
-    rev: "v0.8.0.4"
+    rev: "v0.9.0.2"
     hooks:
       - id: shellcheck

.python-version

@@ -0,0 +1 @@
+3.8.16

.ruff.toml

@@ -0,0 +1,23 @@
+# https://beta.ruff.rs/docs/settings/
+# https://beta.ruff.rs/docs/rules/
+extend-select = ["I", "W", "UP", "COM", "DJ", "EXE", "ISC", "ICN", "G201", "INP", "PIE", "RSE", "SIM", "TID", "PLC", "PLE", "RUF"]
+# TODO PTH
+ignore = ["DJ001", "SIM105"]
+fix = true
+line-length = 88
+respect-gitignore = true
+src = ["src"]
+target-version = "py38"
+format = "grouped"
+show-fixes = true
+
+[per-file-ignores]
+".github/scripts/*.py" = ["E501", "INP001", "SIM117"]
+"docker/wait-for-redis.py" = ["INP001"]
+"*/tests/*.py" = ["E501", "SIM117"]
+"*/migrations/*.py" = ["E501", "SIM"]
+"src/paperless_tesseract/tests/test_parser.py" = ["RUF001"]
+"src/documents/models.py" = ["SIM115"]
+
+[isort]
+force-single-line = true

Dockerfile

@@ -1,26 +1,12 @@
 # syntax=docker/dockerfile:1.4
+# https://github.com/moby/buildkit/blob/master/frontend/dockerfile/docs/reference.md
 
-# Pull the installer images from the library
-# These are all built previously
-# They provide either a .deb or .whl
-
-ARG JBIG2ENC_VERSION
-ARG QPDF_VERSION
-ARG PIKEPDF_VERSION
-ARG PSYCOPG2_VERSION
-
-FROM ghcr.io/paperless-ngx/paperless-ngx/builder/jbig2enc:${JBIG2ENC_VERSION} as jbig2enc-builder
-FROM ghcr.io/paperless-ngx/paperless-ngx/builder/qpdf:${QPDF_VERSION} as qpdf-builder
-FROM ghcr.io/paperless-ngx/paperless-ngx/builder/pikepdf:${PIKEPDF_VERSION} as pikepdf-builder
-FROM ghcr.io/paperless-ngx/paperless-ngx/builder/psycopg2:${PSYCOPG2_VERSION} as psycopg2-builder
-
+# Stage: compile-frontend
+# Purpose: Compiles the frontend
+# Notes:
+#  - Does NPM stuff with Typescript and such
 FROM --platform=$BUILDPLATFORM node:16-bullseye-slim AS compile-frontend
 
-# This stage compiles the frontend
-# This stage runs once for the native platform, as the outputs are not
-# dependent on target arch
-# Inputs: None
-
 COPY ./src-ui /src/src-ui
 
 WORKDIR /src/src-ui
@@ -30,25 +16,27 @@ RUN set -eux \
 RUN set -eux \
   && ./node_modules/.bin/ng build --configuration production
 
+# Stage: pipenv-base
+# Purpose: Generates a requirements.txt file for building
+# Comments:
+#  - pipenv dependencies are not left in the final image
+#  - pipenv can't touch the final image somehow
 FROM --platform=$BUILDPLATFORM python:3.9-slim-bullseye as pipenv-base
 
-# This stage generates the requirements.txt file using pipenv
-# This stage runs once for the native platform, as the outputs are not
-# dependent on target arch
-# This way, pipenv dependencies are not left in the final image
-# nor can pipenv mess up the final image somehow
-# Inputs: None
-
 WORKDIR /usr/src/pipenv
 
 COPY Pipfile* ./
 
 RUN set -eux \
   && echo "Installing pipenv" \
-    && python3 -m pip install --no-cache-dir --upgrade pipenv \
+    && python3 -m pip install --no-cache-dir --upgrade pipenv==2023.3.20 \
   && echo "Generating requirement.txt" \
     && pipenv requirements > requirements.txt
 
+# Stage: main-app
+# Purpose: The final image
+# Comments:
+#  - Don't leave anything extra in here
 FROM python:3.9-slim-bullseye as main-app
 
 LABEL org.opencontainers.image.authors="paperless-ngx team <hello@paperless-ngx.com>"
@@ -64,18 +52,8 @@ ARG DEBIAN_FRONTEND=noninteractive
 # Order the steps below from least often changed to most
 #
 
-# copy jbig2enc
-# Basically will never change again
-COPY --from=jbig2enc-builder /usr/src/jbig2enc/src/.libs/libjbig2enc* /usr/local/lib/
-COPY --from=jbig2enc-builder /usr/src/jbig2enc/src/jbig2 /usr/local/bin/
-COPY --from=jbig2enc-builder /usr/src/jbig2enc/src/*.h /usr/local/include/
-
 # Packages need for running
 ARG RUNTIME_PACKAGES="\
-  # Python
-  python3 \
-  python3-pip \
-  python3-setuptools \
   # General utils
   curl \
   # Docker specific
@@ -139,7 +117,7 @@ RUN set -eux \
     && apt-get install --yes --quiet --no-install-recommends ${RUNTIME_PACKAGES} \
     && rm -rf /var/lib/apt/lists/* \
   && echo "Installing supervisor" \
-    && python3 -m pip install --default-timeout=1000 --upgrade --no-cache-dir supervisor==4.2.4
+    && python3 -m pip install --default-timeout=1000 --upgrade --no-cache-dir supervisor==4.2.5
 
 # Copy gunicorn config
 # Changes very infrequently
@@ -148,7 +126,6 @@ WORKDIR /usr/src/paperless/
 COPY gunicorn.conf.py .
 
 # setup docker-specific things
-# Use mounts to avoid copying installer files into the image
 # These change sometimes, but rarely
 WORKDIR /usr/src/paperless/src/docker/
 
@@ -159,6 +136,7 @@ COPY [ \
   "docker/docker-prepare.sh", \
   "docker/paperless_cmd.sh", \
   "docker/wait-for-redis.py", \
+  "docker/env-from-file.sh", \
   "docker/management_script.sh", \
   "docker/flower-conditional.sh", \
   "docker/install_management_commands.sh", \
@@ -178,6 +156,8 @@ RUN set -eux \
     && chmod 755 /sbin/docker-prepare.sh \
     && mv wait-for-redis.py /sbin/wait-for-redis.py \
     && chmod 755 /sbin/wait-for-redis.py \
+    && mv env-from-file.sh /sbin/env-from-file.sh \
+    && chmod 755 /sbin/env-from-file.sh \
     && mv paperless_cmd.sh /usr/local/bin/paperless_cmd.sh \
     && chmod 755 /usr/local/bin/paperless_cmd.sh \
     && mv flower-conditional.sh /usr/local/bin/flower-conditional.sh \
@@ -186,26 +166,42 @@ RUN set -eux \
     && chmod +x install_management_commands.sh \
     && ./install_management_commands.sh
 
+# Buildx provided, must be defined to use though
+ARG TARGETARCH
+ARG TARGETVARIANT
+
+# Workflow provided, defaults set for manual building
+ARG JBIG2ENC_VERSION=0.29
+ARG QPDF_VERSION=11.3.0
+ARG PIKEPDF_VERSION=7.1.1
+ARG PSYCOPG2_VERSION=2.9.5
+
 # Install the built packages from the installer library images
-# Use mounts to avoid copying installer files into the image
 # These change sometimes
-RUN --mount=type=bind,from=qpdf-builder,target=/qpdf \
-    --mount=type=bind,from=psycopg2-builder,target=/psycopg2 \
-    --mount=type=bind,from=pikepdf-builder,target=/pikepdf \
-  set -eux \
+RUN set -eux \
+  && echo "Getting binaries" \
+    && mkdir paperless-ngx \
+    && curl --fail --silent --show-error --output paperless-ngx.tar.gz --location https://github.com/paperless-ngx/paperless-ngx/archive/ba28a1e16c27d121b644b4f6bdb78855a2850561.tar.gz \
+    && tar -xf paperless-ngx.tar.gz --directory paperless-ngx --strip-components=1 \
+    && cd paperless-ngx \
+    # Setting a specific revision ensures we know what this installed
+    # and ensures cache breaking on changes
+  && echo "Installing jbig2enc" \
+    && cp ./jbig2enc/${JBIG2ENC_VERSION}/${TARGETARCH}${TARGETVARIANT}/jbig2 /usr/local/bin/ \
+    && cp ./jbig2enc/${JBIG2ENC_VERSION}/${TARGETARCH}${TARGETVARIANT}/libjbig2enc* /usr/local/lib/ \
   && echo "Installing qpdf" \
-    && apt-get install --yes --no-install-recommends /qpdf/usr/src/qpdf/libqpdf29_*.deb \
-    && apt-get install --yes --no-install-recommends /qpdf/usr/src/qpdf/qpdf_*.deb \
+    && apt-get install --yes --no-install-recommends ./qpdf/${QPDF_VERSION}/${TARGETARCH}${TARGETVARIANT}/libqpdf29_*.deb \
+    && apt-get install --yes --no-install-recommends ./qpdf/${QPDF_VERSION}/${TARGETARCH}${TARGETVARIANT}/qpdf_*.deb \
   && echo "Installing pikepdf and dependencies" \
-    && python3 -m pip install --no-cache-dir /pikepdf/usr/src/wheels/pyparsing*.whl \
-    && python3 -m pip install --no-cache-dir /pikepdf/usr/src/wheels/packaging*.whl \
-    && python3 -m pip install --no-cache-dir /pikepdf/usr/src/wheels/lxml*.whl \
-    && python3 -m pip install --no-cache-dir /pikepdf/usr/src/wheels/Pillow*.whl \
-    && python3 -m pip install --no-cache-dir /pikepdf/usr/src/wheels/pikepdf*.whl \
+    && python3 -m pip install --no-cache-dir ./pikepdf/${PIKEPDF_VERSION}/${TARGETARCH}${TARGETVARIANT}/*.whl \
     && python3 -m pip list \
   && echo "Installing psycopg2" \
-    && python3 -m pip install --no-cache-dir /psycopg2/usr/src/wheels/psycopg2*.whl \
-    && python3 -m pip list
+    && python3 -m pip install --no-cache-dir ./psycopg2/${PSYCOPG2_VERSION}/${TARGETARCH}${TARGETVARIANT}/psycopg2*.whl \
+    && python3 -m pip list \
+  && echo "Cleaning up image layer" \
+    && cd ../ \
+    && rm -rf paperless-ngx \
+    && rm paperless-ngx.tar.gz
 
 WORKDIR /usr/src/paperless/src/
 
@@ -228,6 +224,10 @@ RUN set -eux \
     && python3 -m pip install --no-cache-dir --upgrade wheel \
   && echo "Installing Python requirements" \
     && python3 -m pip install --default-timeout=1000 --no-cache-dir --requirement requirements.txt \
+  && echo "Installing NLTK data" \
+    && python3 -W ignore::RuntimeWarning -m nltk.downloader -d "/usr/share/nltk_data" snowball_data \
+    && python3 -W ignore::RuntimeWarning -m nltk.downloader -d "/usr/share/nltk_data" stopwords \
+    && python3 -W ignore::RuntimeWarning -m nltk.downloader -d "/usr/share/nltk_data" punkt \
   && echo "Cleaning up image" \
     && apt-get -y purge ${BUILD_PACKAGES} \
     && apt-get -y autoremove --purge \
@@ -245,11 +245,12 @@ COPY ./src ./
 COPY --from=compile-frontend /src/src/documents/static/frontend/ ./documents/static/frontend/
 
 # add users, setup scripts
+# Mount the compiled frontend to expected location
 RUN set -eux \
   && addgroup --gid 1000 paperless \
   && useradd --uid 1000 --gid paperless --home-dir /usr/src/paperless paperless \
-  && chown -R paperless:paperless ../ \
-  && gosu paperless python3 manage.py collectstatic --clear --no-input \
+  && chown -R paperless:paperless /usr/src/paperless \
+  && gosu paperless python3 manage.py collectstatic --clear --no-input --link \
   && gosu paperless python3 manage.py compilemessages
 
 VOLUME ["/usr/src/paperless/data", \

Pipfile

@@ -12,15 +12,20 @@ name = "piwheels"
 dateparser = "~=1.1"
 django = "~=4.1"
 django-cors-headers = "*"
+django-celery-results = "*"
+django-compression-middleware = "*"
+django-guardian = "*"
 django-extensions = "*"
 django-filter = "~=22.1"
 djangorestframework = "~=3.14"
+djangorestframework-guardian = "*"
+django-ipware = "*"
 filelock = "*"
 gunicorn = "*"
 imap-tools = "*"
 langdetect = "*"
 pathvalidate = "*"
-pillow = "~=9.3"
+pillow = "~=9.4"
 pikepdf = "*"
 python-gnupg = "*"
 python-dotenv = "*"
@@ -29,12 +34,10 @@ python-magic = "*"
 psycopg2 = "*"
 rapidfuzz = "*"
 redis = {extras = ["hiredis"], version = "*"}
-scikit-learn = "~=1.1"
-# Pin this until piwheels is building 1.9 (see https://www.piwheels.org/project/scipy/)
-scipy = "==1.8.1"
+scikit-learn = "~=1.2"
 numpy = "*"
-whitenoise = "~=6.2"
-watchdog = "~=2.1"
+whitenoise = "~=6.3"
+watchdog = "~=2.2"
 whoosh="~=2.7"
 inotifyrecursive = "~=0.3"
 ocrmypdf = "~=14.0"
@@ -43,37 +46,56 @@ tika = "*"
 # TODO: This will sadly also install daphne+dependencies,
 #  which an ASGI server we don't need. Adds about 15MB image size.
 channels = "~=3.0"
-# Locked version until https://github.com/django/channels_redis/issues/332
-# is resolved
-channels-redis = "==3.4.1"
+channels-redis = "*"
 uvicorn = {extras = ["standard"], version = "*"}
 concurrent-log-handler = "*"
 "pdfminer.six" = "*"
-"backports.zoneinfo" = {version = "*", markers = "python_version < '3.9'"}
-"importlib-resources" = {version = "*", markers = "python_version < '3.9'"}
-zipp = {version = "*", markers = "python_version < '3.9'"}
 pyzbar = "*"
 mysqlclient = "*"
 celery = {extras = ["redis"], version = "*"}
-django-celery-results = "*"
 setproctitle = "*"
 nltk = "*"
 pdf2image = "*"
 flower = "*"
+bleach = "*"
+zxing-cpp = {version = "*", platform_machine = "== 'x86_64'"}
+#
+# Packages locked due to issues (try to check if these are fixed in a release every so often)
+#
+# Pin this until piwheels is building 1.9 (see https://www.piwheels.org/project/scipy/)
+scipy = "==1.8.1"
 
 [dev-packages]
 coveralls = "*"
 factory-boy = "*"
-pycodestyle = "*"
 pytest = "*"
 pytest-cov = "*"
 pytest-django = "*"
 pytest-env = "*"
 pytest-sugar = "*"
 pytest-xdist = "*"
-tox = "*"
 black = "*"
 pre-commit = "*"
-sphinx-autobuild = "*"
-myst-parser = "*"
+imagehash = "*"
 mkdocs-material = "*"
+ruff = "*"
+
+[typing-dev]
+mypy = "*"
+types-Pillow = "*"
+django-filter-stubs = "*"
+types-python-dateutil = "*"
+djangorestframework-stubs = {extras= ["compatible-mypy"], version="*"}
+celery-types = "*"
+django-stubs = {extras= ["compatible-mypy"], version="*"}
+types-dateparser = "*"
+types-bleach = "*"
+types-humanfriendly = "*"
+types-redis = "*"
+types-tqdm = "*"
+types-Markdown = "*"
+types-Pygments = "*"
+types-backports = "*"
+types-colorama = "*"
+types-psycopg2 = "*"
+types-setuptools = "*"

README.md

@@ -1,7 +1,7 @@
 [![ci](https://github.com/paperless-ngx/paperless-ngx/workflows/ci/badge.svg)](https://github.com/paperless-ngx/paperless-ngx/actions)
 [![Crowdin](https://badges.crowdin.net/paperless-ngx/localized.svg)](https://crowdin.com/project/paperless-ngx)
 [![Documentation Status](https://img.shields.io/github/deployments/paperless-ngx/paperless-ngx/github-pages?label=docs)](https://docs.paperless-ngx.com)
-[![Coverage Status](https://coveralls.io/repos/github/paperless-ngx/paperless-ngx/badge.svg?branch=master)](https://coveralls.io/github/paperless-ngx/paperless-ngx?branch=master)
+[![codecov](https://codecov.io/gh/paperless-ngx/paperless-ngx/branch/main/graph/badge.svg?token=VK6OUPJ3TY)](https://codecov.io/gh/paperless-ngx/paperless-ngx)
 [![Chat on Matrix](https://matrix.to/img/matrix-badge.svg)](https://matrix.to/#/%23paperlessngx%3Amatrix.org)
 [![demo](https://cronitor.io/badges/ve7ItY/production/W5E_B9jkelG9ZbDiNHUPQEVH3MY.svg)](https://demo.paperless-ngx.com)
 
@@ -101,22 +101,16 @@ For bugs please [open an issue](https://github.com/paperless-ngx/paperless-ngx/i
 
 # Affiliated Projects
 
-Paperless has been around a while now, and people are starting to build stuff on top of it. If you're one of those people, we can add your project to this list:
+Paperless has been around for a while now, and people have built tools that interact with it. If you're one of them, please reach out and we can add your project to the list. Current projects include:
 
-- [Paperless App](https://github.com/bauerj/paperless_app): An Android/iOS app for Paperless-ngx. Also works with the original Paperless and Paperless-ng.
-- [Paperless Share](https://github.com/qcasey/paperless_share). Share any files from your Android application with paperless. Very simple, but works with all of the mobile scanning apps out there that allow you to share scanned documents.
-- [Scan to Paperless](https://github.com/sbrunner/scan-to-paperless): Scan and prepare (crop, deskew, OCR, ...) your documents for Paperless.
-- [Paperless Mobile](https://github.com/astubenbord/paperless-mobile): A modern, feature rich mobile application for Paperless.
-
-These projects also exist, but their status and compatibility with paperless-ngx is unknown.
-
-- [paperless-cli](https://github.com/stgarf/paperless-cli): A golang command line binary to interact with a Paperless instance.
-
-This project also exists, but needs updates to be compatible with paperless-ngx.
-
-- [Paperless Desktop](https://github.com/thomasbrueggemann/paperless-desktop): A desktop UI for your Paperless installation. Runs on Mac, Linux, and Windows.
-  Known issues on Mac: (Could not load reminders and documents)
+- **Mobile**
+  - [Paperless App](https://github.com/bauerj/paperless_app): An Android/iOS application for Paperless-ngx.
+  - [Paperless Mobile](https://github.com/astubenbord/paperless-mobile): A modern, feature rich Android app for Paperless-ngx.
+  - [Paperless Share](https://github.com/qcasey/paperless_share): Share any files from your Android application with Paperless-ngx. Very simple, but works with all mobile scanning apps that allow you to share scanned documents.
+- **Desktop**
+  - [Scan to Paperless](https://github.com/sbrunner/scan-to-paperless): Scan and prepare (crop, deskew, OCR, ...) your documents for use in Paperless-ngx.
 
 # Important Note
 
-Document scanners are typically used to scan sensitive documents. Things like your social insurance number, tax records, invoices, etc. Everything is stored in the clear without encryption. This means that Paperless should never be run on an untrusted host. Instead, I recommend that if you do want to use it, run it locally on a server in your own home.
+> Document scanners are typically used to scan sensitive documents like your social insurance number, tax records, invoices, etc. **Paperless-ngx should never be run on an untrusted host** because information is stored in clear text without encryption. No guarantees are made regarding security (but we do try!) and you use the app at your own risk.
+> **The safest way to run Paperless-ngx is on a local server in your own home with backups in place**.

build-docker-image.sh

@@ -10,9 +10,9 @@
 # Example Usage:
 #	./build-docker-image.sh Dockerfile -t paperless-ngx:my-awesome-feature
 
-set -eux
+set -eu
 
-if ! command -v jq;  then
+if ! command -v jq &> /dev/null ;  then
 	echo "jq required"
 	exit 1
 elif [ ! -f "$1" ]; then
@@ -20,28 +20,62 @@ elif [ ! -f "$1" ]; then
 	exit 1
 fi
 
-# Parse what we can from Pipfile.lock
-pikepdf_version=$(jq ".default.pikepdf.version" Pipfile.lock  | sed 's/=//g' | sed 's/"//g')
-psycopg2_version=$(jq ".default.psycopg2.version" Pipfile.lock | sed 's/=//g' | sed 's/"//g')
-pillow_version=$(jq ".default.pillow.version" Pipfile.lock | sed 's/=//g' | sed 's/"//g')
-lxml_version=$(jq ".default.lxml.version" Pipfile.lock | sed 's/=//g' | sed 's/"//g')
-# Read this from the other config file
-qpdf_version=$(jq ".qpdf.version" .build-config.json | sed 's/"//g')
-jbig2enc_version=$(jq ".jbig2enc.version" .build-config.json | sed 's/"//g')
 # Get the branch name (used for caching)
 branch_name=$(git rev-parse --abbrev-ref HEAD)
 
-# https://docs.docker.com/develop/develop-images/build_enhancements/
-# Required to use cache-from
-export DOCKER_BUILDKIT=1
+# Parse eithe Pipfile.lock or the .build-config.json
+jbig2enc_version=$(jq -r '.jbig2enc.version' .build-config.json)
+qpdf_version=$(jq -r '.qpdf.version' .build-config.json)
+psycopg2_version=$(jq -r '.default.psycopg2.version | gsub("=";"")' Pipfile.lock)
+pikepdf_version=$(jq -r '.default.pikepdf.version | gsub("=";"")' Pipfile.lock)
+pillow_version=$(jq -r '.default.pillow.version | gsub("=";"")' Pipfile.lock)
+lxml_version=$(jq -r '.default.lxml.version | gsub("=";"")' Pipfile.lock)
 
-docker build --file "$1" \
+base_filename="$(basename -- "${1}")"
+build_args_str=""
+cache_from_str=""
+
+case "${base_filename}" in
+
+	*.jbig2enc)
+		build_args_str="--build-arg JBIG2ENC_VERSION=${jbig2enc_version}"
+		cache_from_str="--cache-from ghcr.io/paperless-ngx/paperless-ngx/builder/cache/jbig2enc:${jbig2enc_version}"
+		;;
+
+	*.psycopg2)
+		build_args_str="--build-arg PSYCOPG2_VERSION=${psycopg2_version}"
+		cache_from_str="--cache-from ghcr.io/paperless-ngx/paperless-ngx/builder/cache/psycopg2:${psycopg2_version}"
+		;;
+
+	*.qpdf)
+		build_args_str="--build-arg QPDF_VERSION=${qpdf_version}"
+		cache_from_str="--cache-from ghcr.io/paperless-ngx/paperless-ngx/builder/cache/qpdf:${qpdf_version}"
+		;;
+
+	*.pikepdf)
+		build_args_str="--build-arg QPDF_VERSION=${qpdf_version} --build-arg PIKEPDF_VERSION=${pikepdf_version} --build-arg PILLOW_VERSION=${pillow_version} --build-arg LXML_VERSION=${lxml_version}"
+		cache_from_str="--cache-from ghcr.io/paperless-ngx/paperless-ngx/builder/cache/pikepdf:${pikepdf_version}"
+		;;
+
+	Dockerfile)
+		build_args_str="--build-arg QPDF_VERSION=${qpdf_version} --build-arg PIKEPDF_VERSION=${pikepdf_version} --build-arg PSYCOPG2_VERSION=${psycopg2_version} --build-arg JBIG2ENC_VERSION=${jbig2enc_version}"
+		cache_from_str="--cache-from ghcr.io/paperless-ngx/paperless-ngx/builder/cache/app:${branch_name} --cache-from ghcr.io/paperless-ngx/paperless-ngx/builder/cache/app:dev"
+		;;
+
+	*)
+		echo "Unable to match ${base_filename}"
+		exit 1
+		;;
+esac
+
+read -r -a build_args_arr <<< "${build_args_str}"
+read -r -a cache_from_arr <<< "${cache_from_str}"
+
+set -eux
+
+docker buildx build --file "${1}" \
 	--progress=plain \
-	--cache-from ghcr.io/paperless-ngx/paperless-ngx/builder/cache/app:"${branch_name}" \
-	--cache-from ghcr.io/paperless-ngx/paperless-ngx/builder/cache/app:dev \
-	--build-arg JBIG2ENC_VERSION="${jbig2enc_version}" \
-	--build-arg QPDF_VERSION="${qpdf_version}" \
-	--build-arg PIKEPDF_VERSION="${pikepdf_version}" \
-	--build-arg PILLOW_VERSION="${pillow_version}" \
-	--build-arg LXML_VERSION="${lxml_version}" \
-	--build-arg PSYCOPG2_VERSION="${psycopg2_version}" "${@:2}" .
+	--output=type=docker \
+	"${cache_from_arr[@]}" \
+	"${build_args_arr[@]}" \
+	"${@:2}" .

charts/paperless-ngx/.helmignore

@@ -1,26 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/
-# OWNERS file for Kubernetes
-OWNERS
-# helm-docs templates
-*.gotmpl

charts/paperless-ngx/Chart.yaml

@@ -1,35 +0,0 @@
----
-apiVersion: v2
-appVersion: "1.9.2"
-description: Paperless-ngx - Index and archive all of your scanned paper documents
-name: paperless
-version: 10.0.0
-kubeVersion: ">=1.16.0-0"
-keywords:
-  - paperless
-  - paperless-ngx
-  - dms
-  - document
-home: https://github.com/paperless-ngx/paperless-ngx/tree/main/charts/paperless-ngx
-icon: https://github.com/paperless-ngx/paperless-ngx/raw/main/resources/logo/web/svg/square.svg
-sources:
-  - https://github.com/paperless-ngx/paperless-ngx
-maintainers:
-  - name: Paperless-ngx maintainers
-dependencies:
-  - name: common
-    repository: https://library-charts.k8s-at-home.com
-    version: 4.5.2
-  - name: postgresql
-    version: 11.6.12
-    repository: https://charts.bitnami.com/bitnami
-    condition: postgresql.enabled
-  - name: redis
-    version: 16.13.1
-    repository: https://charts.bitnami.com/bitnami
-    condition: redis.enabled
-deprecated: false
-annotations:
-  artifacthub.io/changes: |
-    - kind: changed
-      description: Moved to Paperless-ngx ownership

charts/paperless-ngx/LICENSE

@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 2020 k8s@Home
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

charts/paperless-ngx/README.md

@@ -1,50 +0,0 @@
-# paperless
-
-![Version: 10.0.0](https://img.shields.io/badge/Version-10.0.0-informational?style=flat-square) ![AppVersion: 1.9.2](https://img.shields.io/badge/AppVersion-1.9.2-informational?style=flat-square)
-
-Paperless-ngx - Index and archive all of your scanned paper documents
-
-**Homepage:** <https://github.com/paperless-ngx/paperless-ngx/tree/main/charts/paperless-ngx>
-
-## Maintainers
-
-| Name | Email | Url |
-| ---- | ------ | --- |
-| Paperless-ngx maintainers |  |  |
-
-## Source Code
-
-* <https://github.com/paperless-ngx/paperless-ngx>
-
-## Requirements
-
-Kubernetes: `>=1.16.0-0`
-
-| Repository | Name | Version |
-|------------|------|---------|
-| https://charts.bitnami.com/bitnami | postgresql | 11.6.12 |
-| https://charts.bitnami.com/bitnami | redis | 16.13.1 |
-| https://library-charts.k8s-at-home.com | common | 4.5.2 |
-
-## Values
-
-| Key | Type | Default | Description |
-|-----|------|---------|-------------|
-| env | object | See below | See the following files for additional environment variables: https://github.com/paperless-ngx/paperless-ngx/tree/main/docker/compose/ https://github.com/paperless-ngx/paperless-ngx/blob/main/paperless.conf.example |
-| env.COMPOSE_PROJECT_NAME | string | `"paperless"` | Project name |
-| env.PAPERLESS_DBHOST | string | `nil` | Database host to use |
-| env.PAPERLESS_OCR_LANGUAGE | string | `"eng"` | OCR languages to install |
-| env.PAPERLESS_PORT | int | `8000` | Port to use |
-| env.PAPERLESS_REDIS | string | `nil` | Redis to use |
-| image.pullPolicy | string | `"IfNotPresent"` | image pull policy |
-| image.repository | string | `"ghcr.io/paperless-ngx/paperless-ngx"` | image repository |
-| image.tag | string | chart.appVersion | image tag |
-| ingress.main | object | See values.yaml | Enable and configure ingress settings for the chart under this key. |
-| persistence.consume | object | See values.yaml | Configure volume to monitor for new documents. |
-| persistence.data | object | See values.yaml | Configure persistence for data. |
-| persistence.export | object | See values.yaml | Configure export volume. |
-| persistence.media | object | See values.yaml | Configure persistence for media. |
-| postgresql | object | See values.yaml | Enable and configure postgresql database subchart under this key.    For more options see [postgresql chart documentation](https://github.com/bitnami/charts/tree/master/bitnami/postgresql) |
-| redis | object | See values.yaml | Enable and configure redis subchart under this key.    For more options see [redis chart documentation](https://github.com/bitnami/charts/tree/master/bitnami/redis) |
-| service | object | See values.yaml | Configures service settings for the chart. |
-

charts/paperless-ngx/README_CONFIG.md.gotmpl

@@ -1,8 +0,0 @@
-{{- define "custom.custom.configuration.header" -}}
-## Custom configuration
-{{- end -}}
-
-{{- define "custom.custom.configuration" -}}
-{{ template "custom.custom.configuration.header" . }}
-N/A
-{{- end -}}

charts/paperless-ngx/ci/ct-values.yaml

@@ -1,26 +0,0 @@
-env:
-  PAPERLESS_REDIS: redis://paperless-redis-headless:6379
-
-persistence:
-  data:
-    enabled: true
-    type: emptyDir
-  media:
-    enabled: true
-    type: emptyDir
-  consume:
-    enabled: true
-    type: emptyDir
-  export:
-    enabled: true
-    type: emptyDir
-
-redis:
-  enabled: true
-  architecture: standalone
-  auth:
-    enabled: false
-  master:
-    persistence:
-      enabled: false
-  fullnameOverride: paperless-redis

charts/paperless-ngx/templates/NOTES.txt

@@ -1,4 +0,0 @@
-{{- include "common.notes.defaultNotes" . }}
-2. Create a super user by running the command:
-  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "common.names.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
-  kubectl exec -it --namespace {{ .Release.Namespace }} $POD_NAME -- bash -c "python manage.py createsuperuser"

charts/paperless-ngx/templates/common.yaml

@@ -1,11 +0,0 @@
-{{/* Make sure all variables are set properly */}}
-{{- include "common.values.setup" . }}
-
-{{/* Append the hardcoded settings */}}
-{{- define "paperless.harcodedValues" -}}
-env:
-    PAPERLESS_URL: http{{if ne ( len .Values.ingress.main.tls ) 0 }}s{{end}}://{{ (first .Values.ingress.main.hosts).host }}
-{{- end -}}
-{{- $_ := merge .Values (include "paperless.harcodedValues" . | fromYaml) -}}
-
-{{ include "common.all" . }}

charts/paperless-ngx/values.yaml

@@ -1,107 +0,0 @@
-#
-# IMPORTANT NOTE
-#
-# This chart inherits from our common library chart. You can check the default values/options here:
-# https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common/values.yaml
-#
-
-image:
-  # -- image repository
-  repository: ghcr.io/paperless-ngx/paperless-ngx
-  # -- image pull policy
-  pullPolicy: IfNotPresent
-  # -- image tag
-  # @default -- chart.appVersion
-  tag:
-
-# -- See the following files for additional environment variables:
-# https://github.com/paperless-ngx/paperless-ngx/tree/main/docker/compose/
-# https://github.com/paperless-ngx/paperless-ngx/blob/main/paperless.conf.example
-# @default -- See below
-env:
-  # -- Project name
-  COMPOSE_PROJECT_NAME: paperless
-  # -- Redis to use
-  PAPERLESS_REDIS:
-  # -- OCR languages to install
-  PAPERLESS_OCR_LANGUAGE: eng
-  # USERMAP_UID: 1000
-  # USERMAP_GID: 1000
-  # PAPERLESS_TIME_ZONE: Europe/London
-  # -- Database host to use
-  PAPERLESS_DBHOST:
-  # -- Port to use
-  PAPERLESS_PORT: 8000
-  # -- Username for the root user
-  # PAPERLESS_ADMIN_USER: admin
-  # -- Password for the root user
-  # PAPERLESS_ADMIN_PASSWORD: admin
-  # PAPERLESS_URL: <set to main ingress by default>
-
-# -- Configures service settings for the chart.
-# @default -- See values.yaml
-service:
-  main:
-    ports:
-      http:
-        port: 8000
-
-ingress:
-  # -- Enable and configure ingress settings for the chart under this key.
-  # @default -- See values.yaml
-  main:
-    enabled: false
-
-persistence:
-  # -- Configure persistence for data.
-  # @default -- See values.yaml
-  data:
-    enabled: false
-    mountPath: /usr/src/paperless/data
-    accessMode: ReadWriteOnce
-    emptyDir:
-      enabled: false
-  # -- Configure persistence for media.
-  # @default -- See values.yaml
-  media:
-    enabled: false
-    mountPath: /usr/src/paperless/media
-    accessMode: ReadWriteOnce
-    emptyDir:
-      enabled: false
-  # -- Configure volume to monitor for new documents.
-  # @default -- See values.yaml
-  consume:
-    enabled: false
-    mountPath: /usr/src/paperless/consume
-    accessMode: ReadWriteOnce
-    emptyDir:
-      enabled: false
-  # -- Configure export volume.
-  # @default -- See values.yaml
-  export:
-    enabled: false
-    mountPath: /usr/src/paperless/export
-    accessMode: ReadWriteOnce
-    emptyDir:
-      enabled: false
-
-# -- Enable and configure postgresql database subchart under this key.
-#    For more options see [postgresql chart documentation](https://github.com/bitnami/charts/tree/master/bitnami/postgresql)
-# @default -- See values.yaml
-postgresql:
-  enabled: false
-  postgresqlUsername: paperless
-  postgresqlPassword: paperless
-  postgresqlDatabase: paperless
-  persistence:
-    enabled: false
-    # storageClass: ""
-
-# -- Enable and configure redis subchart under this key.
-#    For more options see [redis chart documentation](https://github.com/bitnami/charts/tree/master/bitnami/redis)
-# @default -- See values.yaml
-redis:
-  enabled: false
-  auth:
-    enabled: false

docker-builders/Dockerfile.jbig2enc

@@ -29,7 +29,20 @@ RUN set -eux \
     && ./autogen.sh \
     && ./configure \
     && make \
+  && echo "Gathering package data" \
+    && dpkg-query -f '${Package;-40}${Version}\n' -W > ./pkg-list.txt \
   && echo "Cleaning up image" \
     && apt-get -y purge ${BUILD_PACKAGES} \
     && apt-get -y autoremove --purge \
-    && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/* \
+  && echo "Moving files around" \
+    && mkdir build \
+    # Unlink a symlink that causes problems
+    && unlink ./src/.libs/libjbig2enc.la \
+    # Move what the link pointed to
+    && mv ./src/libjbig2enc.la ./build/ \
+    # Move the shared library .so files
+    && mv ./src/.libs/libjbig2enc* ./build/ \
+    # And move the cli binary
+    && mv ./src/jbig2 ./build/ \
+    && mv ./pkg-list.txt ./build/

docker-builders/Dockerfile.pikepdf

@@ -7,16 +7,27 @@
 # Default to pulling from the main repo registry when manually building
 ARG REPO="paperless-ngx/paperless-ngx"
 
-ARG QPDF_VERSION
-FROM ghcr.io/${REPO}/builder/qpdf:${QPDF_VERSION} as qpdf-builder
-
 # This does nothing, except provide a name for a copy below
+ARG QPDF_VERSION
+FROM --platform=$BUILDPLATFORM ghcr.io/${REPO}/builder/qpdf:${QPDF_VERSION} as qpdf-builder
 
-FROM python:3.9-slim-bullseye as main
+#
+# Stage: builder
+# Purpose:
+#  - Build the pikepdf wheel
+#  - Build any dependent wheels which can't be found
+#
+FROM python:3.9-slim-bullseye as builder
 
 LABEL org.opencontainers.image.description="A intermediate image with pikepdf wheel built"
 
+# Buildx provided
+ARG TARGETARCH
+ARG TARGETVARIANT
+
 ARG DEBIAN_FRONTEND=noninteractive
+# Workflow provided
+ARG QPDF_VERSION
 ARG PIKEPDF_VERSION
 # These are not used, but will still bust the cache if one changes
 # Otherwise, the main image will try to build thing (and fail)
@@ -54,7 +65,7 @@ ARG BUILD_PACKAGES="\
 
 WORKDIR /usr/src
 
-COPY --from=qpdf-builder /usr/src/qpdf/*.deb ./
+COPY --from=qpdf-builder /usr/src/qpdf/${QPDF_VERSION}/${TARGETARCH}${TARGETVARIANT}/*.deb ./
 
 # As this is an base image for a multi-stage final image
 # the added size of the install is basically irrelevant
@@ -77,6 +88,8 @@ RUN set -eux \
     && python3 -m pip wheel \
       # Build the package at the required version
       pikepdf==${PIKEPDF_VERSION} \
+      # Look to piwheels for additional pre-built wheels
+      --extra-index-url https://www.piwheels.org/simple \
       # Output the *.whl into this directory
       --wheel-dir wheels \
       # Do not use a binary packge for the package being built
@@ -86,7 +99,20 @@ RUN set -eux \
       # Don't cache build files
       --no-cache-dir \
     && ls -ahl wheels \
+  && echo "Gathering package data" \
+    && dpkg-query -f '${Package;-40}${Version}\n' -W > ./wheels/pkg-list.txt \
   && echo "Cleaning up image" \
     && apt-get -y purge ${BUILD_PACKAGES} \
     && apt-get -y autoremove --purge \
     && rm -rf /var/lib/apt/lists/*
+
+#
+# Stage: package
+# Purpose: Holds the compiled .whl files in a tiny image to pull
+#
+FROM alpine:3.17 as package
+
+WORKDIR /usr/src/wheels/
+
+COPY --from=builder /usr/src/wheels/*.whl ./
+COPY --from=builder /usr/src/wheels/pkg-list.txt ./

docker-builders/Dockerfile.psycopg2

@@ -2,7 +2,12 @@
 # Inputs:
 #    - PSYCOPG2_VERSION - Version to build
 
-FROM python:3.9-slim-bullseye as main
+#
+# Stage: builder
+# Purpose:
+#  - Build the psycopg2 wheel
+#
+FROM python:3.9-slim-bullseye as builder
 
 LABEL org.opencontainers.image.description="A intermediate image with psycopg2 wheel built"
 
@@ -42,7 +47,20 @@ RUN set -eux \
       # Don't cache build files
       --no-cache-dir \
     && ls -ahl wheels/ \
+  && echo "Gathering package data" \
+    && dpkg-query -f '${Package;-40}${Version}\n' -W > ./wheels/pkg-list.txt \
   && echo "Cleaning up image" \
     && apt-get -y purge ${BUILD_PACKAGES} \
     && apt-get -y autoremove --purge \
     && rm -rf /var/lib/apt/lists/*
+
+#
+# Stage: package
+# Purpose: Holds the compiled .whl files in a tiny image to pull
+#
+FROM alpine:3.17 as package
+
+WORKDIR /usr/src/wheels/
+
+COPY --from=builder /usr/src/wheels/*.whl ./
+COPY --from=builder /usr/src/wheels/pkg-list.txt ./

docker-builders/Dockerfile.qpdf

@@ -1,48 +1,156 @@
-# This Dockerfile compiles the jbig2enc library
-# Inputs:
-#    - QPDF_VERSION - the version of qpdf to build a .deb.
-#                     Must be present as a deb-src in bookworm
+#
+# Stage: pre-build
+# Purpose:
+#  - Installs common packages
+#  - Sets common environment variables related to dpkg
+#  - Aquires the qpdf source from bookwork
+# Useful Links:
+#  - https://qpdf.readthedocs.io/en/stable/installation.html#system-requirements
+#  - https://wiki.debian.org/Multiarch/HOWTO
+#  - https://wiki.debian.org/CrossCompiling
+#
 
-FROM debian:bullseye-slim as main
+FROM debian:bullseye-slim as pre-build
 
-LABEL org.opencontainers.image.description="A intermediate image with qpdf built"
-
-ARG DEBIAN_FRONTEND=noninteractive
-# This must match to pikepdf's minimum at least
 ARG QPDF_VERSION
 
-ARG BUILD_PACKAGES="\
-  build-essential \
-  debhelper \
+ARG COMMON_BUILD_PACKAGES="\
+  cmake \
+  debhelper\
   debian-keyring \
   devscripts \
-  equivs  \
-  libtool \
-  # https://qpdf.readthedocs.io/en/stable/installation.html#system-requirements
-  libjpeg62-turbo-dev \
-  libgnutls28-dev \
+  dpkg-dev \
+  equivs \
   packaging-dev \
-  cmake \
-  zlib1g-dev"
+  libtool"
+
+ENV DEB_BUILD_OPTIONS="terse nocheck nodoc parallel=2"
 
 WORKDIR /usr/src
 
 RUN set -eux \
-  && echo "Installing build tools" \
+  && echo "Installing common packages" \
     && apt-get update --quiet \
-    && apt-get install --yes --quiet --no-install-recommends $BUILD_PACKAGES \
-  && echo "Getting qpdf src" \
+    && apt-get install --yes --quiet --no-install-recommends ${COMMON_BUILD_PACKAGES} \
+  && echo "Getting qpdf source" \
     && echo "deb-src http://deb.debian.org/debian/ bookworm main" > /etc/apt/sources.list.d/bookworm-src.list \
-    && apt-get update \
-    && mkdir qpdf \
-    && cd qpdf \
-    && apt-get source --yes --quiet qpdf=${QPDF_VERSION}-1/bookworm \
-  && echo "Building qpdf" \
-    && cd qpdf-$QPDF_VERSION \
-    && export DEB_BUILD_OPTIONS="terse nocheck nodoc parallel=2" \
-    && dpkg-buildpackage --build=binary --unsigned-source --unsigned-changes --post-clean \
-    && ls -ahl ../*.deb \
-  && echo "Cleaning up image" \
-    && apt-get -y purge ${BUILD_PACKAGES} \
-    && apt-get -y autoremove --purge \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get update --quiet \
+    && apt-get source --yes --quiet qpdf=${QPDF_VERSION}-1/bookworm
+
+#
+# Stage: amd64-builder
+# Purpose: Builds qpdf for x86_64 (native build)
+#
+FROM pre-build as amd64-builder
+
+ARG AMD64_BUILD_PACKAGES="\
+  build-essential \
+  libjpeg62-turbo-dev:amd64 \
+  libgnutls28-dev:amd64 \
+  zlib1g-dev:amd64"
+
+WORKDIR /usr/src/qpdf-${QPDF_VERSION}
+
+RUN set -eux \
+  && echo "Beginning amd64" \
+    && echo "Install amd64 packages" \
+      && apt-get update --quiet \
+      && apt-get install --yes --quiet --no-install-recommends ${AMD64_BUILD_PACKAGES} \
+    && echo "Building amd64" \
+      && dpkg-buildpackage --build=binary --unsigned-source --unsigned-changes --post-clean \
+    && echo "Removing debug files" \
+      && rm -f ../libqpdf29-dbgsym* \
+      && rm -f ../qpdf-dbgsym* \
+    && echo "Gathering package data" \
+      && dpkg-query -f '${Package;-40}${Version}\n' -W > ../pkg-list.txt
+#
+# Stage: armhf-builder
+# Purpose:
+#  - Sets armhf specific environment
+#  - Builds qpdf for armhf (cross compile)
+#
+FROM pre-build as armhf-builder
+
+ARG ARMHF_PACKAGES="\
+  crossbuild-essential-armhf \
+  libjpeg62-turbo-dev:armhf \
+  libgnutls28-dev:armhf \
+  zlib1g-dev:armhf"
+
+WORKDIR /usr/src/qpdf-${QPDF_VERSION}
+
+ENV CXX="/usr/bin/arm-linux-gnueabihf-g++" \
+    CC="/usr/bin/arm-linux-gnueabihf-gcc"
+
+RUN set -eux \
+  && echo "Beginning armhf" \
+    && echo "Install armhf packages" \
+      && dpkg --add-architecture armhf \
+      && apt-get update --quiet \
+      && apt-get install --yes --quiet --no-install-recommends ${ARMHF_PACKAGES} \
+    && echo "Building armhf" \
+      && dpkg-buildpackage --build=binary --unsigned-source --unsigned-changes --post-clean --host-arch armhf \
+    && echo "Removing debug files" \
+      && rm -f ../libqpdf29-dbgsym* \
+      && rm -f ../qpdf-dbgsym* \
+    && echo "Gathering package data" \
+      && dpkg-query -f '${Package;-40}${Version}\n' -W > ../pkg-list.txt
+
+#
+# Stage: aarch64-builder
+# Purpose:
+#  - Sets aarch64 specific environment
+#  - Builds qpdf for aarch64 (cross compile)
+#
+FROM pre-build as aarch64-builder
+
+ARG ARM64_PACKAGES="\
+  crossbuild-essential-arm64 \
+  libjpeg62-turbo-dev:arm64 \
+  libgnutls28-dev:arm64 \
+  zlib1g-dev:arm64"
+
+ENV CXX="/usr/bin/aarch64-linux-gnu-g++" \
+    CC="/usr/bin/aarch64-linux-gnu-gcc"
+
+WORKDIR /usr/src/qpdf-${QPDF_VERSION}
+
+RUN set -eux \
+  && echo "Beginning arm64" \
+    && echo "Install arm64 packages" \
+      && dpkg --add-architecture arm64 \
+      && apt-get update --quiet \
+      && apt-get install --yes --quiet --no-install-recommends ${ARM64_PACKAGES} \
+    && echo "Building arm64" \
+      && dpkg-buildpackage --build=binary --unsigned-source --unsigned-changes --post-clean --host-arch arm64 \
+    && echo "Removing debug files" \
+      && rm -f ../libqpdf29-dbgsym* \
+      && rm -f ../qpdf-dbgsym* \
+    && echo "Gathering package data" \
+      && dpkg-query -f '${Package;-40}${Version}\n' -W > ../pkg-list.txt
+
+#
+# Stage: package
+# Purpose: Holds the compiled .deb files in arch/variant specific folders
+#
+FROM alpine:3.17 as package
+
+LABEL org.opencontainers.image.description="A image with qpdf installers stored in architecture & version specific folders"
+
+ARG QPDF_VERSION
+
+WORKDIR /usr/src/qpdf/${QPDF_VERSION}/amd64
+
+COPY --from=amd64-builder /usr/src/*.deb ./
+COPY --from=amd64-builder /usr/src/pkg-list.txt ./
+
+# Note this is ${TARGETARCH}${TARGETVARIANT} for armv7
+WORKDIR /usr/src/qpdf/${QPDF_VERSION}/armv7
+
+COPY --from=armhf-builder /usr/src/*.deb ./
+COPY --from=armhf-builder /usr/src/pkg-list.txt ./
+
+WORKDIR /usr/src/qpdf/${QPDF_VERSION}/arm64
+
+COPY --from=aarch64-builder /usr/src/*.deb ./
+COPY --from=aarch64-builder /usr/src/pkg-list.txt ./

docker-builders/README.md

@@ -0,0 +1,57 @@
+# Installer Library
+
+This folder contains the Dockerfiles for building certain installers or libraries, which are then pulled into the main image.
+
+## [jbig2enc](https://github.com/agl/jbig2enc)
+
+### Why
+
+JBIG is an image coding which can achieve better compression of images for PDFs.
+
+### What
+
+The Docker image builds a shared library file and utility, which is copied into the correct location in the final image.
+
+### Updating
+
+1. Ensure the given qpdf version is present in [Debian bookworm](https://packages.debian.org/bookworm/qpdf)
+2. Update `.build-config.json` to the given version
+3. If the Debian specific version has incremented, update `Dockerfile.qpdf`
+
+See Also:
+
+- [OCRMyPDF Documentation](https://ocrmypdf.readthedocs.io/en/latest/jbig2.html)
+
+## [psycopg2](https://www.psycopg.org/)
+
+### Why
+
+The pre-built wheels of psycopg2 are built on Debian 9, which provides a quite old version of libpq-dev. This causes issue with authentication methods.
+
+### What
+
+The image builds psycopg2 wheels on Debian 10 and places the produced wheels into `/usr/src/wheels/`.
+
+See Also:
+
+- [Issue 266](https://github.com/paperless-ngx/paperless-ngx/issues/266)
+
+## [qpdf](https://qpdf.readthedocs.io/en/stable/index.html)
+
+### Why
+
+qpdf and it's library provide tools to read, manipulate and fix up PDFs. Version 11 is also required by `pikepdf` 6+ and Debian 9 does not provide above version 10.
+
+### What
+
+The Docker image cross compiles .deb installers for each supported architecture of the main image. The installers are placed in `/usr/src/qpdf/${QPDF_VERSION}/${TARGETARCH}${TARGETVARIANT}/`
+
+## [pikepdf](https://pikepdf.readthedocs.io/en/latest/)
+
+### Why
+
+Required by OCRMyPdf, this is a general purpose library for PDF manipulation in Python via the qpdf libraries.
+
+### What
+
+The built wheels are placed into `/usr/src/wheels/`

docker/compose/docker-compose.ci-test.yml

@@ -6,14 +6,17 @@
 version: "3.7"
 services:
   gotenberg:
-    image: docker.io/gotenberg/gotenberg:7.6
+    image: docker.io/gotenberg/gotenberg:7.8
     hostname: gotenberg
     container_name: gotenberg
     network_mode: host
     restart: unless-stopped
+    # The gotenberg chromium route is used to convert .eml files. We do not
+    # want to allow external content like tracking pixels or even javascript.
     command:
       - "gotenberg"
-      - "--chromium-disable-routes=true"
+      - "--chromium-disable-javascript=true"
+      - "--chromium-allow-list=file:///tmp/.*"
   tika:
     image: ghcr.io/paperless-ngx/tika:latest
     hostname: tika

docker/compose/docker-compose.mariadb-tika.yml

@@ -49,8 +49,6 @@ services:
       MARIADB_USER: paperless
       MARIADB_PASSWORD: paperless
       MARIADB_ROOT_PASSWORD: paperless
-    ports:
-      - "3306:3306"
 
   webserver:
     image: ghcr.io/paperless-ngx/paperless-ngx:latest
@@ -61,7 +59,7 @@ services:
       - gotenberg
       - tika
     ports:
-      - 8000:8000
+      - "8000:8000"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8000"]
       interval: 30s
@@ -85,11 +83,14 @@ services:
       PAPERLESS_TIKA_ENDPOINT: http://tika:9998
 
   gotenberg:
-    image: docker.io/gotenberg/gotenberg:7.6
+    image: docker.io/gotenberg/gotenberg:7.8
     restart: unless-stopped
+    # The gotenberg chromium route is used to convert .eml files. We do not
+    # want to allow external content like tracking pixels or even javascript.
     command:
       - "gotenberg"
-      - "--chromium-disable-routes=true"
+      - "--chromium-disable-javascript=true"
+      - "--chromium-allow-list=file:///tmp/.*"
 
   tika:
     image: ghcr.io/paperless-ngx/tika:latest

docker/compose/docker-compose.mariadb.yml

@@ -45,8 +45,6 @@ services:
       MARIADB_USER: paperless
       MARIADB_PASSWORD: paperless
       MARIADB_ROOT_PASSWORD: paperless
-    ports:
-      - "3306:3306"
 
   webserver:
     image: ghcr.io/paperless-ngx/paperless-ngx:latest
@@ -55,7 +53,7 @@ services:
       - db
       - broker
     ports:
-      - 8000:8000
+      - "8000:8000"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8000"]
       interval: 30s

docker/compose/docker-compose.portainer.yml

@@ -53,7 +53,7 @@ services:
       - db
       - broker
     ports:
-      - 8010:8000
+      - "8010:8000"
     healthcheck:
       test: ["CMD", "curl", "-fs", "-S", "--max-time", "2", "http://localhost:8000"]
       interval: 30s

docker/compose/docker-compose.postgres-tika.yml

@@ -57,7 +57,7 @@ services:
       - gotenberg
       - tika
     ports:
-      - 8000:8000
+      - "8000:8000"
     healthcheck:
       test: ["CMD", "curl", "-fs", "-S", "--max-time", "2", "http://localhost:8000"]
       interval: 30s
@@ -77,11 +77,15 @@ services:
       PAPERLESS_TIKA_ENDPOINT: http://tika:9998
 
   gotenberg:
-    image: docker.io/gotenberg/gotenberg:7.6
+    image: docker.io/gotenberg/gotenberg:7.8
     restart: unless-stopped
+
+    # The gotenberg chromium route is used to convert .eml files. We do not
+    # want to allow external content like tracking pixels or even javascript.
     command:
       - "gotenberg"
-      - "--chromium-disable-routes=true"
+      - "--chromium-disable-javascript=true"
+      - "--chromium-allow-list=file:///tmp/.*"
 
   tika:
     image: ghcr.io/paperless-ngx/tika:latest

docker/compose/docker-compose.postgres.yml

@@ -51,7 +51,7 @@ services:
       - db
       - broker
     ports:
-      - 8000:8000
+      - "8000:8000"
     healthcheck:
       test: ["CMD", "curl", "-fs", "-S", "--max-time", "2", "http://localhost:8000"]
       interval: 30s

docker/compose/docker-compose.sqlite-tika.yml

@@ -46,7 +46,7 @@ services:
       - gotenberg
       - tika
     ports:
-      - 8000:8000
+      - "8000:8000"
     healthcheck:
       test: ["CMD", "curl", "-fs", "-S", "--max-time", "2", "http://localhost:8000"]
       interval: 30s
@@ -65,11 +65,15 @@ services:
       PAPERLESS_TIKA_ENDPOINT: http://tika:9998
 
   gotenberg:
-    image: docker.io/gotenberg/gotenberg:7.6
+    image: docker.io/gotenberg/gotenberg:7.8
     restart: unless-stopped
+
+    # The gotenberg chromium route is used to convert .eml files. We do not
+    # want to allow external content like tracking pixels or even javascript.
     command:
       - "gotenberg"
-      - "--chromium-disable-routes=true"
+      - "--chromium-disable-javascript=true"
+      - "--chromium-allow-list=file:///tmp/.*"
 
   tika:
     image: ghcr.io/paperless-ngx/tika:latest

docker/compose/docker-compose.sqlite.yml

@@ -37,7 +37,7 @@ services:
     depends_on:
       - broker
     ports:
-      - 8000:8000
+      - "8000:8000"
     healthcheck:
       test: ["CMD", "curl", "-fs", "-S", "--max-time", "2", "http://localhost:8000"]
       interval: 30s

docker/docker-entrypoint.sh

@@ -2,37 +2,6 @@
 
 set -e
 
-# Adapted from:
-# https://github.com/docker-library/postgres/blob/master/docker-entrypoint.sh
-# usage: file_env VAR
-#    ie: file_env 'XYZ_DB_PASSWORD' will allow for "$XYZ_DB_PASSWORD_FILE" to
-# fill in the value of "$XYZ_DB_PASSWORD" from a file, especially for Docker's
-# secrets feature
-file_env() {
-	local -r var="$1"
-	local -r fileVar="${var}_FILE"
-
-	# Basic validation
-	if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
-		echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
-		exit 1
-	fi
-
-	# Only export var if the _FILE exists
-	if [ "${!fileVar:-}" ]; then
-		# And the file exists
-		if [[ -f ${!fileVar} ]]; then
-			echo "Setting ${var} from file"
-			val="$(< "${!fileVar}")"
-			export "$var"="$val"
-		else
-			echo "File ${!fileVar} doesn't exist"
-			exit 1
-		fi
-	fi
-
-}
-
 # Source: https://github.com/sameersbn/docker-gitlab/
 map_uidgid() {
 	local -r usermap_original_uid=$(id -u paperless)
@@ -53,30 +22,6 @@ map_folders() {
 	export CONSUME_DIR="${PAPERLESS_CONSUMPTION_DIR:-/usr/src/paperless/consume}"
 }
 
-nltk_data () {
-	# Store the NLTK data outside the Docker container
-	local -r nltk_data_dir="${DATA_DIR}/nltk"
-	local -r truthy_things=("yes y 1 t true")
-
-	# If not set, or it looks truthy
-	if [[ -z "${PAPERLESS_ENABLE_NLTK}" ]] || [[ "${truthy_things[*]}" =~ ${PAPERLESS_ENABLE_NLTK,} ]]; then
-
-		# Download or update the snowball stemmer data
-		python3 -W ignore::RuntimeWarning -m nltk.downloader -d "${nltk_data_dir}" snowball_data
-
-		# Download or update the stopwords corpus
-		python3 -W ignore::RuntimeWarning -m nltk.downloader -d "${nltk_data_dir}" stopwords
-
-		# Download or update the punkt tokenizer data
-		python3 -W ignore::RuntimeWarning -m nltk.downloader -d "${nltk_data_dir}" punkt
-
-	else
-		echo "Skipping NLTK data download"
-
-	fi
-
-}
-
 custom_container_init() {
 	# Mostly borrowed from the LinuxServer.io base image
 	# https://github.com/linuxserver/docker-baseimage-ubuntu/tree/bionic/root/etc/cont-init.d
@@ -120,19 +65,11 @@ custom_container_init() {
 initialize() {
 
 	# Setup environment from secrets before anything else
-	for env_var in \
-		PAPERLESS_DBUSER \
-		PAPERLESS_DBPASS \
-		PAPERLESS_SECRET_KEY \
-		PAPERLESS_AUTO_LOGIN_USERNAME \
-		PAPERLESS_ADMIN_USER \
-		PAPERLESS_ADMIN_MAIL \
-		PAPERLESS_ADMIN_PASSWORD \
-		PAPERLESS_REDIS; do
-		# Check for a version of this var with _FILE appended
-		# and convert the contents to the env var value
-		file_env ${env_var}
-	done
+	# Check for a version of this var with _FILE appended
+	# and convert the contents to the env var value
+	# Source it so export is persistent
+	# shellcheck disable=SC1091
+	source /sbin/env-from-file.sh
 
 	# Change the user and group IDs if needed
 	map_uidgid
@@ -157,8 +94,6 @@ initialize() {
 	echo "Creating directory ${tmp_dir}"
 	mkdir -p "${tmp_dir}"
 
-	nltk_data
-
 	set +e
 	echo "Adjusting permissions of paperless files. This may take a while."
 	chown -R paperless:paperless ${tmp_dir}
@@ -191,10 +126,6 @@ install_languages() {
 
 	for lang in "${langs[@]}"; do
 		pkg="tesseract-ocr-$lang"
-		# English is installed by default
-		#if [[ "$lang" ==  "eng" ]]; then
-		#    continue
-		#fi
 
 		if dpkg -s "$pkg" &>/dev/null; then
 			echo "Package $pkg already installed!"

docker/docker-prepare.sh

@@ -20,7 +20,6 @@ wait_for_postgres() {
 			exit 1
 		else
 			echo "Attempt $attempt_num failed! Trying again in 5 seconds..."
-
 		fi
 
 		attempt_num=$(("$attempt_num" + 1))
@@ -37,6 +36,8 @@ wait_for_mariadb() {
 	local attempt_num=1
 	local -r max_attempts=5
 
+	# Disable warning, host and port can't have spaces
+	# shellcheck disable=SC2086
 	while ! true > /dev/tcp/$host/$port; do
 
 		if [ $attempt_num -eq $max_attempts ]; then
@@ -67,13 +68,19 @@ migrations() {
 		# of the current container starts.
 		flock 200
 		echo "Apply database migrations..."
-		python3 manage.py migrate
+		python3 manage.py migrate --skip-checks --no-input
 	) 200>"${DATA_DIR}/migration_lock"
 }
 
+django_checks() {
+	# Explicitly run the Django system checks
+	echo "Running Django checks"
+	python3 manage.py check
+}
+
 search_index() {
 
-	local -r index_version=1
+	local -r index_version=4
 	local -r index_version_file=${DATA_DIR}/.index_version
 
 	if [[ (! -f "${index_version_file}") || $(<"${index_version_file}") != "$index_version" ]]; then
@@ -100,6 +107,8 @@ do_work() {
 
 	migrations
 
+	django_checks
+
 	search_index
 
 	superuser

docker/env-from-file.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+# Scans the environment variables for those with the suffix _FILE
+# When located, checks the file exists, and exports the contents
+# of the file as the same name, minus the suffix
+# This allows the use of Docker secrets or mounted files
+# to fill in any of the settings configurable via environment
+# variables
+
+set -eu
+
+for line in $(printenv)
+do
+	# Extract the name of the environment variable
+	env_name=${line%%=*}
+	# Check if it starts with "PAPERLESS_" and ends in "_FILE"
+	if [[ ${env_name} == PAPERLESS_*_FILE ]]; then
+		# Extract the value of the environment
+		env_value=${line#*=}
+
+		# Check the file exists
+		if [[ -f ${env_value} ]]; then
+
+			# Trim off the _FILE suffix
+			non_file_env_name=${env_name%"_FILE"}
+			echo "Setting ${non_file_env_name} from file"
+
+			# Reads the value from th file
+			val="$(< "${!env_name}")"
+
+			# Sets the normal name to the read file contents
+			export "${non_file_env_name}"="${val}"
+
+		else
+			echo "File ${env_value} referenced by ${env_name} doesn't exist"
+		fi
+	fi
+done

docker/flower-conditional.sh

@@ -3,5 +3,10 @@
 echo "Checking if we should start flower..."
 
 if [[ -n  "${PAPERLESS_ENABLE_FLOWER}" ]]; then
-	celery --app paperless flower
+	# Small delay to allow celery to be up first
+	echo "Starting flower in 5s"
+	sleep 5
+	celery --app paperless flower --conf=/usr/src/paperless/src/paperless/flowerconfig.py
+else
+	echo "Not starting flower"
 fi

docker/management_script.sh

@@ -3,6 +3,9 @@
 set -e
 
 cd /usr/src/paperless/src/
+# This ensures environment is setup
+# shellcheck disable=SC1091
+source /sbin/env-from-file.sh
 
 if [[ $(id -u) == 0 ]] ;
 then

docker/supervisord.conf

@@ -28,7 +28,7 @@ stderr_logfile_maxbytes=0
 
 [program:celery]
 
-command = celery --app paperless worker --loglevel INFO
+command = celery --app paperless worker --loglevel INFO --without-mingle --without-gossip
 user=paperless
 stopasgroup = true
 stopwaitsecs = 60

docker/wait-for-redis.py

@@ -12,13 +12,12 @@ from typing import Final
 from redis import Redis
 
 if __name__ == "__main__":
-
     MAX_RETRY_COUNT: Final[int] = 5
     RETRY_SLEEP_SECONDS: Final[int] = 5
 
     REDIS_URL: Final[str] = os.getenv("PAPERLESS_REDIS", "redis://localhost:6379")
 
-    print(f"Waiting for Redis...", flush=True)
+    print("Waiting for Redis...", flush=True)
 
     attempt = 0
     with Redis.from_url(url=REDIS_URL) as client:
@@ -37,8 +36,8 @@ if __name__ == "__main__":
                 attempt += 1
 
     if attempt >= MAX_RETRY_COUNT:
-        print(f"Failed to connect to redis using environment variable PAPERLESS_REDIS.")
+        print("Failed to connect to redis using environment variable PAPERLESS_REDIS.")
         sys.exit(os.EX_UNAVAILABLE)
     else:
-        print(f"Connected to Redis broker.")
+        print("Connected to Redis broker.")
         sys.exit(os.EX_OK)

docs/administration.md

@@ -9,7 +9,7 @@ Before making backups, make sure that paperless is not running.
 
 Options available to any installation of paperless:
 
-- Use the [document exporter](administration#exporter). The document exporter exports all your documents,
+- Use the [document exporter](#exporter). The document exporter exports all your documents,
   thumbnails and metadata to a specific folder. You may import your
   documents into a fresh instance of paperless again or store your
   documents in another DMS with this export.
@@ -52,7 +52,7 @@ Options available to bare-metal and non-docker installations:
 
 ## Updating Paperless {#updating}
 
-### Docker Route
+### Docker Route {#docker-updating}
 
 If a new release of paperless-ngx is available, upgrading depends on how
 you installed paperless-ngx in the first place. The releases are
@@ -68,23 +68,23 @@ $ docker-compose down
 
 After that, [make a backup](#backup).
 
-A. If you pull the image from the docker hub, all you need to do is:
+1. If you pull the image from the docker hub, all you need to do is:
 
-    ``` shell-session
-    $ docker-compose pull
-    $ docker-compose up
-    ```
+   ```shell-session
+   $ docker-compose pull
+   $ docker-compose up
+   ```
 
-    The docker-compose files refer to the `latest` version, which is
-    always the latest stable release.
+   The docker-compose files refer to the `latest` version, which is
+   always the latest stable release.
 
-B. If you built the image yourself, do the following:
+2. If you built the image yourself, do the following:
 
-    ``` shell-session
-    $ git pull
-    $ docker-compose build
-    $ docker-compose up
-    ```
+   ```shell-session
+   $ git pull
+   $ docker-compose build
+   $ docker-compose up
+   ```
 
 Running `docker-compose up` will also apply any new database migrations.
 If you see everything working, press CTRL+C once to gracefully stop
@@ -98,7 +98,7 @@ the background.
     won't automatically update to newer versions. In order to enable
     updates as described above, either get the new `docker-compose.yml`
     file from
-    [here](https://github.com/paperless-ngx/paperless-ngx/tree/master/docker/compose)
+    [here](https://github.com/paperless-ngx/paperless-ngx/tree/main/docker/compose)
     or edit the `docker-compose.yml` file, find the line that says
 
     ```
@@ -131,7 +131,7 @@ the background.
     image: ghcr.io/paperless-ngx/paperless-ngx:1.7
     ```
 
-### Bare Metal Route
+### Bare Metal Route {#bare-metal-updating}
 
 After grabbing the new release and unpacking the contents, do the
 following:
@@ -152,13 +152,15 @@ following:
 
     ```shell-session
     $ cd src
-    $ python3 manage.py migrate
+    $ python3 manage.py migrate # (1)
     ```
 
+    1.  Including `sudo -Hu <paperless_user>` may be required
+
     This might not actually do anything. Not every new paperless version
     comes with new database migrations.
 
-## Downgrading Paperless
+## Downgrading Paperless {#downgrade-paperless}
 
 Downgrades are possible. However, some updates also contain database
 migrations (these change the layout of the database and may move data).
@@ -210,9 +212,11 @@ Bare metal:
 
 ```shell-session
 $ cd /path/to/paperless/src
-$ python3 manage.py <command> <arguments>
+$ python3 manage.py <command> <arguments> # (1)
 ```
 
+1.  Including `sudo -Hu <paperless_user>` may be required
+
 All commands have built-in help, which can be accessed by executing them
 with the argument `--help`.
 
@@ -227,12 +231,17 @@ is not a TTY" errors. For example:
 `docker-compose exec -T webserver document_exporter ../export`
 
 ```
-document_exporter target [-c] [-f] [-d]
+document_exporter target [-c] [-d] [-f] [-na] [-nt] [-p] [-sm] [-z]
 
 optional arguments:
 -c, --compare-checksums
--f, --use-filename-format
 -d, --delete
+-f, --use-filename-format
+-na, --no-archive
+-nt, --no-thumbnail
+-p, --use-folder-prefix
+-sm, --split-manifest
+-z  --zip
 ```
 
 `target` is a folder to which the data gets written. This includes
@@ -248,25 +257,58 @@ will assume that the contents of the export directory are a previous
 export and will attempt to update the previous export. Paperless will
 only export changed and added files. Paperless determines whether a file
 has changed by inspecting the file attributes "date/time modified" and
-"size". If that does not work out for you, specify
+"size". If that does not work out for you, specify `-c` or
 `--compare-checksums` and paperless will attempt to compare file
 checksums instead. This is slower.
 
 Paperless will not remove any existing files in the export directory. If
 you want paperless to also remove files that do not belong to the
-current export such as files from deleted documents, specify `--delete`.
+current export such as files from deleted documents, specify `-d` or `--delete`.
 Be careful when pointing paperless to a directory that already contains
 other files.
 
 The filenames generated by this command follow the format
 `[date created] [correspondent] [title].[extension]`. If you want
 paperless to use `PAPERLESS_FILENAME_FORMAT` for exported filenames
-instead, specify `--use-filename-format`.
+instead, specify `-f` or `--use-filename-format`.
+
+If `-na` or `--no-archive` is provided, no archive files will be exported,
+only the original files.
+
+If `-nt` or `--no-thumbnail` is provided, thumbnail files will not be exported.
+
+!!! note
+
+    When using the `-na`/`--no-archive` or `-nt`/`--no-thumbnail` options
+    the exporter will not output these files for backup.  After importing,
+    the [sanity checker](#sanity-checker) will warn about missing thumbnails and archive files
+    until they are regenerated with `document_thumbnails` or [`document_archiver`](#archiver).
+    It can make sense to omit these files from backup as their content and checksum
+    can change (new archiver algorithm) and may then cause additional used space in
+    a deduplicated backup.
+
+If `-p` or `--use-folder-prefix` is provided, files will be exported
+in dedicated folders according to their nature: `archive`, `originals`,
+`thumbnails` or `json`
+
+If `-sm` or `--split-manifest` is provided, information about document
+will be placed in individual json files, instead of a single JSON file. The main
+manifest.json will still contain application wide information (e.g. tags, correspondent,
+documenttype, etc)
+
+If `-z` or `--zip` is provided, the export will be a zipfile
+in the target directory, named according to the current date.
+
+!!! warning
+
+    If exporting with the file name format, there may be errors due to
+    your operating system's maximum path lengths.  Try adjusting the export
+    target or consider not using the filename format.
 
 ### Document importer {#importer}
 
 The document importer takes the export produced by the [Document
-exporter](#document-exporter) and imports it into paperless.
+exporter](#exporter) and imports it into paperless.
 
 The importer works just like the exporter. You point it at a directory,
 and the script does the rest of the work:
@@ -343,6 +385,14 @@ document_create_classifier
 
 This command takes no arguments.
 
+### Document thumbnails {#thumbnails}
+
+Use this command to re-create document thumbnails. Optionally include the ` --document {id}` option to generate thumbnails for a specific document only.
+
+```
+document_thumbnails
+```
+
 ### Managing the document search index {#index}
 
 The document search index is responsible for delivering search results
@@ -366,7 +416,7 @@ task scheduler.
 ### Managing filenames {#renamer}
 
 If you use paperless' feature to
-[assign custom filenames to your documents](/advanced_usage#file_name_handling), you can use this command to move all your files after
+[assign custom filenames to your documents](/advanced_usage#file-name-handling), you can use this command to move all your files after
 changing the naming scheme.
 
 !!! warning
@@ -425,14 +475,13 @@ mail_fetcher
 The command takes no arguments and processes all your mail accounts and
 rules.
 
-!!! note
+!!! tip
 
-    As of October 2022 Microsoft no longer supports IMAP authentication
-    for Exchange servers, thus Exchange is no longer supported until a
-    solution is implemented in the Python IMAP library used by Paperless.
-    See
-
-[learn.microsoft.com](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online)
+    To use OAuth access tokens for mail fetching,
+    select the box to indicate the password is actually
+    a token when creating or editing a mail account. The
+    details for creating a token depend on your email
+    provider.
 
 ### Creating archived documents {#archiver}
 
@@ -467,13 +516,13 @@ document.
     documents, such as encrypted PDF documents. The archiver will skip over
     these documents each time it sees them.
 
-### Managing encryption {#encyption}
+### Managing encryption {#encryption}
 
 Documents can be stored in Paperless using GnuPG encryption.
 
 !!! warning
 
-    Encryption is deprecated since paperless-ngx 0.9 and doesn't really
+    Encryption is deprecated since [paperless-ng 0.9](/changelog#paperless-ng-090) and doesn't really
     provide any additional security, since you have to store the passphrase
     in a configuration file on the same system as the encrypted documents
     for paperless to work. Furthermore, the entire text content of the

docs/advanced_usage.md

@@ -9,7 +9,7 @@ Paperless will compare the matching algorithms defined by every tag,
 correspondent, document type, and storage path in your database to see
 if they apply to the text in a document. In other words, if you define a
 tag called `Home Utility` that had a `match` property of `bc hydro` and
-a `matching_algorithm` of `literal`, Paperless will automatically tag
+a `matching_algorithm` of `Exact`, Paperless will automatically tag
 your newly-consumed document with your `Home Utility` tag so long as the
 text `bc hydro` appears in the body of the document somewhere.
 
@@ -25,12 +25,13 @@ documents.
 
 The following algorithms are available:
 
+- **None:** No matching will be performed.
 - **Any:** Looks for any occurrence of any word provided in match in
   the PDF. If you define the match as `Bank1 Bank2`, it will match
   documents containing either of these terms.
 - **All:** Requires that every word provided appears in the PDF,
   albeit not in the order provided.
-- **Literal:** Matches only if the match appears exactly as provided
+- **Exact:** Matches only if the match appears exactly as provided
   (i.e. preserve ordering) in the PDF.
 - **Regular expression:** Parses the match as a regular expression and
   tries to find a match within the document.
@@ -50,7 +51,7 @@ and run another document through the consumer. Once complete, you should
 see the newly-created document, automatically tagged with the
 appropriate data.
 
-### Automatic matching {#automatic_matching}
+### Automatic matching {#automatic-matching}
 
 Paperless-ngx comes with a new matching algorithm called _Auto_. This
 matching algorithm tries to assign tags, correspondents, document types,
@@ -59,8 +60,8 @@ assigned these on existing documents. It uses a neural network under the
 hood.
 
 If, for example, all your bank statements of your account 123 at the
-Bank of America are tagged with the tag "bofa*123" and the matching
-algorithm of this tag is set to \_Auto*, this neural network will examine
+Bank of America are tagged with the tag "bofa123" and the matching
+algorithm of this tag is set to _Auto_, this neural network will examine
 your documents and automatically learn when to assign this tag.
 
 Paperless tries to hide much of the involved complexity with this
@@ -95,7 +96,7 @@ when using this feature:
   of these correspondents to ANY new document, if both are set to
   automatic matching.
 
-## Hooking into the consumption process
+## Hooking into the consumption process {#consume-hooks}
 
 Sometimes you may want to do something arbitrary whenever a document is
 consumed. Rather than try to predict what you may want to do, Paperless
@@ -115,13 +116,23 @@ and then put the path to that script in `paperless.conf` or
     asynchronously, you'll have to fork the process in your script and
     exit.
 
-### Pre-consumption script
+### Pre-consumption script {#pre-consume-script}
 
 Executed after the consumer sees a new document in the consumption
 folder, but before any processing of the document is performed. This
 script can access the following relevant environment variables set:
 
-- `DOCUMENT_SOURCE_PATH`
+| Environment Variable    | Description                                                  |
+| ----------------------- | ------------------------------------------------------------ |
+| `DOCUMENT_SOURCE_PATH`  | Original path of the consumed document                       |
+| `DOCUMENT_WORKING_PATH` | Path to a copy of the original that consumption will work on |
+
+!!! note
+
+    Pre-consume scripts which modify the document should only change
+    the `DOCUMENT_WORKING_PATH` file or a second consume task may
+    be triggered, leading to failures as two tasks work on the
+    same document path
 
 A simple but common example for this would be creating a simple script
 like this:
@@ -130,7 +141,7 @@ like this:
 
 ```bash
 #!/usr/bin/env bash
-pdf2pdfocr.py -i ${DOCUMENT_SOURCE_PATH}
+pdf2pdfocr.py -i ${DOCUMENT_WORKING_PATH}
 ```
 
 `/etc/paperless.conf`
@@ -151,63 +162,74 @@ with the newly modified file.
 The script's stdout and stderr will be logged line by line to the
 webserver log, along with the exit code of the script.
 
-### Post-consumption script {#post_consume_script}
+### Post-consumption script {#post-consume-script}
 
 Executed after the consumer has successfully processed a document and
 has moved it into paperless. It receives the following environment
 variables:
 
-- `DOCUMENT_ID`
-- `DOCUMENT_FILE_NAME`
-- `DOCUMENT_CREATED`
-- `DOCUMENT_MODIFIED`
-- `DOCUMENT_ADDED`
-- `DOCUMENT_SOURCE_PATH`
-- `DOCUMENT_ARCHIVE_PATH`
-- `DOCUMENT_THUMBNAIL_PATH`
-- `DOCUMENT_DOWNLOAD_URL`
-- `DOCUMENT_THUMBNAIL_URL`
-- `DOCUMENT_CORRESPONDENT`
-- `DOCUMENT_TAGS`
-- `DOCUMENT_ORIGINAL_FILENAME`
+| Environment Variable         | Description                                   |
+| ---------------------------- | --------------------------------------------- |
+| `DOCUMENT_ID`                | Database primary key of the document          |
+| `DOCUMENT_FILE_NAME`         | Formatted filename, not including paths       |
+| `DOCUMENT_CREATED`           | Date & time when document created             |
+| `DOCUMENT_MODIFIED`          | Date & time when document was last modified   |
+| `DOCUMENT_ADDED`             | Date & time when document was added           |
+| `DOCUMENT_SOURCE_PATH`       | Path to the original document file            |
+| `DOCUMENT_ARCHIVE_PATH`      | Path to the generate archive file (if any)    |
+| `DOCUMENT_THUMBNAIL_PATH`    | Path to the generated thumbnail               |
+| `DOCUMENT_DOWNLOAD_URL`      | URL for document download                     |
+| `DOCUMENT_THUMBNAIL_URL`     | URL for the document thumbnail                |
+| `DOCUMENT_CORRESPONDENT`     | Assigned correspondent (if any)               |
+| `DOCUMENT_TAGS`              | Comma separated list of tags applied (if any) |
+| `DOCUMENT_ORIGINAL_FILENAME` | Filename of original document                 |
 
-The script can be in any language, but for a simple shell script
-example, you can take a look at
-[post-consumption-example.sh](https://github.com/paperless-ngx/paperless-ngx/blob/main/scripts/post-consumption-example.sh)
-in this project.
+The script can be in any language, A simple shell script example:
 
-The post consumption script cannot cancel the consumption process.
+```bash title="post-consumption-example"
+--8<-- "./scripts/post-consumption-example.sh"
+```
+
+!!! note
+
+    The post consumption script cannot cancel the consumption process.
+
+!!! warning
+
+    The post consumption script should not modify the document files
+    directly
 
 The script's stdout and stderr will be logged line by line to the
 webserver log, along with the exit code of the script.
 
-#### Docker
+### Docker {#docker-consume-hooks}
 
-Assumed you have
-`/home/foo/paperless-ngx/scripts/post-consumption-example.sh`.
+To hook into the consumption process when using Docker, you
+will need to pass the scripts into the container via a host mount
+in your `docker-compose.yml`.
 
-You can pass that script into the consumer container via a host mount in
-your `docker-compose.yml`.
+Assuming you have
+`/home/paperless-ngx/scripts/post-consumption-example.sh` as a
+script which you'd like to run.
 
-```bash
+You can pass that script into the consumer container via a host mount:
+
+```yaml
 ...
-consumer:
+webserver:
   ...
   volumes:
     ...
-    - /home/paperless-ngx/scripts:/path/in/container/scripts/
+    - /home/paperless-ngx/scripts:/path/in/container/scripts/ # (1)!
+  environment: # (3)!
+    ...
+    PAPERLESS_POST_CONSUME_SCRIPT: /path/in/container/scripts/post-consumption-example.sh # (2)!
 ...
 ```
 
-Example (docker-compose.yml):
-`- /home/foo/paperless-ngx/scripts:/usr/src/paperless/scripts`
-
-which in turn requires the variable `PAPERLESS_POST_CONSUME_SCRIPT` in
-`docker-compose.env` to point to
-`/path/in/container/scripts/post-consumption-example.sh`.
-
-Example (docker-compose.env):
-`PAPERLESS_POST_CONSUME_SCRIPT=/usr/src/paperless/scripts/post-consumption-example.sh`
+1. The external scripts directory is mounted to a location inside the container.
+2. The internal location of the script is used to set the script to run
+3. This can also be set in `docker-compose.env`
 
 Troubleshooting:
 
@@ -218,7 +240,7 @@ Troubleshooting:
 - Pipe your scripts's output to a log file e.g.
   `echo "${DOCUMENT_ID}" | tee --append /usr/src/paperless/scripts/post-consumption-example.log`
 
-## File name handling {#file_name_handling}
+## File name handling {#file-name-handling}
 
 By default, paperless stores your documents in the media directory and
 renames them using the identifier which it has assigned to each
@@ -287,6 +309,8 @@ Paperless provides the following placeholders within filenames:
 - `{added_month_name_short}`: Month added abbreviated name, as per
   locale
 - `{added_day}`: Day added only (number 01-31).
+- `{owner_username}`: Username of document owner, if any, or "none"
+- `{original_name}`: Document original filename, minus the extension, if any, or "none"
 
 Paperless will try to conserve the information from your database as
 much as possible. However, some characters that you can use in document
@@ -301,7 +325,7 @@ value.
 !!! tip
 
     You can affect how empty placeholders are treated by changing the
-    following setting to [true]{.title-ref}.
+    following setting to `true`.
 
     ```
     PAPERLESS_FILENAME_FORMAT_REMOVE_NONE=True
@@ -316,7 +340,7 @@ value.
     Paperless checks the filename of a document whenever it is saved.
     Therefore, you need to update the filenames of your documents and move
     them after altering this setting by invoking the
-    [`document renamer <utilities-renamer>`]().
+    [`document renamer`](/administration#renamer).
 
 !!! warning
 
@@ -335,16 +359,23 @@ value.
     However, keep in mind that inside docker, if files get stored outside of
     the predefined volumes, they will be lost after a restart of paperless.
 
+!!! warning
+
+    When file naming handling, in particular when using `{tag_list}`,
+    you may run into the limits of your operating system's maximum
+    path lengths.  Files will retain the previous path instead and
+    the issue logged.
+
 ## Storage paths
 
 One of the best things in Paperless is that you can not only access the
 documents via the web interface, but also via the file system.
 
-When as single storage layout is not sufficient for your use case,
+When a single storage layout is not sufficient for your use case,
 storage paths come to the rescue. Storage paths allow you to configure
 more precisely where each document is stored in the file system.
 
-- Each storage path is a [PAPERLESS_FILENAME_FORMAT]{.title-ref} and
+- Each storage path is a `PAPERLESS_FILENAME_FORMAT` and
   follows the rules described above
 - Each document is assigned a storage path using the matching
   algorithms described above, but can be overwritten at any time
@@ -352,7 +383,7 @@ more precisely where each document is stored in the file system.
 For example, you could define the following two storage paths:
 
 1.  Normal communications are put into a folder structure sorted by
-    [year/correspondent]{.title-ref}
+    `year/correspondent`
 2.  Communications with insurance companies are stored in a flat
     structure with longer file names, but containing the full date of
     the correspondence.
@@ -363,7 +394,7 @@ Insurances = Insurances/{correspondent}/{created_year}-{created_month}-{created_
 ```
 
 If you then map these storage paths to the documents, you might get the
-following result. For simplicity, [By Year]{.title-ref} defines the same
+following result. For simplicity, `By Year` defines the same
 structure as in the previous example above.
 
 ```text
@@ -372,7 +403,7 @@ structure as in the previous example above.
      Statement January.pdf
      Statement February.pdf
 
- Insurances/                           # Insurances
+Insurances/                             # Insurances
    Healthcare 123/
      2022-01-01 Statement January.pdf
      2022-02-02 Letter.pdf
@@ -384,14 +415,7 @@ structure as in the previous example above.
 !!! tip
 
     Defining a storage path is optional. If no storage path is defined for a
-    document, the global [PAPERLESS_FILENAME_FORMAT]{.title-ref} is applied.
-
-!!! warning
-
-    If you adjust the format of an existing storage path, old documents
-    don't get relocated automatically. You need to run the
-    [document renamer](/administration#renamer) to
-    adjust their pathes.
+    document, the global `PAPERLESS_FILENAME_FORMAT` is applied.
 
 ## Celery Monitoring {#celery-monitoring}
 
@@ -403,33 +427,38 @@ queued and completed tasks, timing and more. Flower can also be used
 with Prometheus, as it exports metrics. For details on its capabilities,
 refer to the Flower documentation.
 
-To configure Flower further, create a [flowerconfig.py]{.title-ref} and
-place it into the [src/paperless]{.title-ref} directory. For a Docker
+To configure Flower further, create a `flowerconfig.py` and
+place it into the `src/paperless` directory. For a Docker
 installation, you can use volumes to accomplish this:
 
 ```yaml
 services:
   # ...
   webserver:
+    ports:
+      - 5555:5555 # (2)!
     # ...
     volumes:
-      - /path/to/my/flowerconfig.py:/usr/src/paperless/src/paperless/flowerconfig.py:ro
+      - /path/to/my/flowerconfig.py:/usr/src/paperless/src/paperless/flowerconfig.py:ro # (1)!
 ```
 
+1. Note the `:ro` tag means the file will be mounted as read only.
+2. `flower` runs by default on port 5555, but this can be configured
+
 ## Custom Container Initialization
 
 The Docker image includes the ability to run custom user scripts during
 startup. This could be utilized for installing additional tools or
-Python packages, for example.
+Python packages, for example. Scripts are expected to be shell scripts.
 
 To utilize this, mount a folder containing your scripts to the custom
-initialization directory, [/custom-cont-init.d]{.title-ref} and place
+initialization directory, `/custom-cont-init.d` and place
 scripts you wish to run inside. For security, the folder must be owned
 by `root` and should have permissions of `a=rx`. Additionally, scripts
 must only be writable by `root`.
 
 Your scripts will be run directly before the webserver completes
-startup. Scripts will be run by the [root]{.title-ref} user.
+startup. Scripts will be run by the `root` user.
 If you would like to switch users, the utility `gosu` is available and
 preferred over `sudo`.
 
@@ -445,9 +474,11 @@ services:
   webserver:
     # ...
     volumes:
-      - /path/to/my/scripts:/custom-cont-init.d:ro
+      - /path/to/my/scripts:/custom-cont-init.d:ro # (1)!
 ```
 
+1. Note the `:ro` tag means the folder will be mounted as read only. This is for extra security against changes
+
 ## MySQL Caveats {#mysql-caveats}
 
 ### Case Sensitivity
@@ -466,3 +497,49 @@ You can also set the default for new tables (this does NOT affect
 existing tables) with:
 
 `ALTER DATABASE <db_name> CHARACTER SET utf8mb4 COLLATE utf8mb4_bin;`
+
+!!! warning
+
+    Using mariadb version 10.4+ is recommended. Using the `utf8mb3` character set on
+    an older system may fix issues that can arise while setting up Paperless-ngx but
+    `utf8mb3` can cause issues with consumption (where `utf8mb4` does not).
+
+## Barcodes {#barcodes}
+
+Paperless is able to utilize barcodes for automatically preforming some tasks.
+
+At this time, the library utilized for detection of bacodes supports the following types:
+
+- AN-13/UPC-A
+- UPC-E
+- EAN-8
+- Code 128
+- Code 93
+- Code 39
+- Codabar
+- Interleaved 2 of 5
+- QR Code
+- SQ Code
+
+You may check for updates on the [zbar library homepage](https://github.com/mchehab/zbar).
+For usage in Paperless, the type of barcode does not matter, only the contents of it.
+
+For how to enable barcode usage, see [the configuration](/configuration#barcodes).
+The two settings may be enabled independently, but do have interactions as explained
+below.
+
+### Document Splitting
+
+When enabled, Paperless will look for a barcode with the configured value and create a new document
+starting from the next page. The page with the barcode on it will _not_ be retained. It
+is expected to be a page existing only for triggering the split.
+
+### Archive Serial Number Assignment
+
+When enabled, the value of the barcode (as an integer) will be used to set the document's
+archive serial number, allowing quick reference back to the original, paper document.
+
+If document splitting via barcode is also enabled, documents will be split when an ASN
+barcode is located. However, differing from the splitting, the page with the
+barcode _will_ be retained. This allows application of a barcode to any page, including
+one which holds data to keep in the document.

docs/api.md

@@ -1,12 +1,12 @@
 # The REST API
 
 Paperless makes use of the [Django REST
-Framework](http://django-rest-framework.org/) standard API interface. It
+Framework](https://django-rest-framework.org/) standard API interface. It
 provides a browsable API for most of its endpoints, which you can
 inspect at `http://<paperless-host>:<port>/api/`. This also documents
 most of the available filters and ordering fields.
 
-The API provides 5 main endpoints:
+The API provides 7 main endpoints:
 
 - `/api/documents/`: Full CRUD support, except POSTing new documents.
   See below.
@@ -14,12 +14,15 @@ The API provides 5 main endpoints:
 - `/api/document_types/`: Full CRUD support.
 - `/api/logs/`: Read-Only.
 - `/api/tags/`: Full CRUD support.
+- `/api/tasks/`: Read-only.
 - `/api/mail_accounts/`: Full CRUD support.
 - `/api/mail_rules/`: Full CRUD support.
+- `/api/users/`: Full CRUD support.
+- `/api/groups/`: Full CRUD support.
 
 All of these endpoints except for the logging endpoint allow you to
-fetch, edit and delete individual objects by appending their primary key
-to the path, for example `/api/documents/454/`.
+fetch (and edit and delete where appropriate) individual objects by
+appending their primary key to the path, e.g. `/api/documents/454/`.
 
 The objects served by the document endpoint contain the following
 fields:
@@ -162,7 +165,7 @@ specific query parameters cause the API to return full text search
 results:
 
 - `/api/documents/?query=your%20search%20query`: Search for a document
-  using a full text query. For details on the syntax, see [Basic Usage - Searching](usage#basic-usage_searching).
+  using a full text query. For details on the syntax, see [Basic Usage - Searching](/usage#basic-usage_searching).
 - `/api/documents/?more_like=1234`: Search for documents similar to
   the document with id 1234.
 
@@ -225,7 +228,7 @@ Query parameters:
 
 Results returned by the endpoint are ordered by importance of the term
 in the document index. The first result is the term that has the highest
-Tf/Idf score in the index.
+[Tf/Idf](https://en.wikipedia.org/wiki/Tf%E2%80%93idf) score in the index.
 
 ```json
 ["term1", "term3", "term6", "term4"]
@@ -254,11 +257,15 @@ The endpoint supports the following optional form fields:
 - `document_type`: Similar to correspondent.
 - `tags`: Similar to correspondent. Specify this multiple times to
   have multiple tags added to the document.
+- `archive_serial_number`: An optional archive serial number to set.
 
-The endpoint will immediately return "OK" if the document consumption
-process was started successfully. No additional status information about
-the consumption process itself is available, since that happens in a
-different process.
+The endpoint will immediately return HTTP 200 if the document consumption
+process was started successfully, with the UUID of the consumption task
+as the data. No additional status information about the consumption process
+itself is available immediately, since that happens in a different process.
+However, querying the tasks endpoint with the returned UUID e.g.
+`/api/tasks/?task_id={uuid}` will provide information on the state of the
+consumption including the ID of a created document if consumption succeeded.
 
 ## API Versioning
 

docs/changelog.md

@@ -1,5 +1,553 @@
 # Changelog
 
+## paperless-ngx 1.14.1
+
+### Bug Fixes
+
+- Fix: reduce frequency of permissions queries to speed up v1.14.0 [@shamoon](https://github.com/shamoon) ([#3201](https://github.com/paperless-ngx/paperless-ngx/pull/3201))
+- Fix: permissions-aware statistics [@shamoon](https://github.com/shamoon) ([#3199](https://github.com/paperless-ngx/paperless-ngx/pull/3199))
+- Fix: Use document owner for matching if set [@shamoon](https://github.com/shamoon) ([#3198](https://github.com/paperless-ngx/paperless-ngx/pull/3198))
+- Fix: respect permissions on document view actions [@shamoon](https://github.com/shamoon) ([#3174](https://github.com/paperless-ngx/paperless-ngx/pull/3174))
+- Increment API version for 1.14.1+ [@shamoon](https://github.com/shamoon) ([#3191](https://github.com/paperless-ngx/paperless-ngx/pull/3191))
+- Fix: dropdown Private items with empty set [@shamoon](https://github.com/shamoon) ([#3189](https://github.com/paperless-ngx/paperless-ngx/pull/3189))
+- Documentation: add note for macOS [@shamoon](https://github.com/shamoon) ([#3190](https://github.com/paperless-ngx/paperless-ngx/pull/3190))
+- Fix: make the importer a little more robust against some errors [@stumpylog](https://github.com/stumpylog) ([#3188](https://github.com/paperless-ngx/paperless-ngx/pull/3188))
+- Fix: Specify backend for auto-login [@shamoon](https://github.com/shamoon) ([#3163](https://github.com/paperless-ngx/paperless-ngx/pull/3163))
+- Fix: StoragePath missing the owned or granted filter [@stumpylog](https://github.com/stumpylog) ([#3180](https://github.com/paperless-ngx/paperless-ngx/pull/3180))
+- Fix: Redis socket connections fail due to redis-py [@stumpylog](https://github.com/stumpylog) ([#3176](https://github.com/paperless-ngx/paperless-ngx/pull/3176))
+- Fix: Handle delete mail action with no filters [@shamoon](https://github.com/shamoon) ([#3161](https://github.com/paperless-ngx/paperless-ngx/pull/3161))
+- Fix typos and wrong version number in doc [@FizzyMUC](https://github.com/FizzyMUC) ([#3171](https://github.com/paperless-ngx/paperless-ngx/pull/3171))
+
+### Documentation
+
+- Documentation: add note for macOS [@shamoon](https://github.com/shamoon) ([#3190](https://github.com/paperless-ngx/paperless-ngx/pull/3190))
+- Fix typos and wrong version number in doc [@FizzyMUC](https://github.com/FizzyMUC) ([#3171](https://github.com/paperless-ngx/paperless-ngx/pull/3171))
+
+### Maintenance
+
+- Chore: Fix isort not running, upgrade to the latest black [@stumpylog](https://github.com/stumpylog) ([#3177](https://github.com/paperless-ngx/paperless-ngx/pull/3177))
+
+### All App Changes
+
+<details>
+<summary>11 changes</summary>
+
+- Fix: reduce frequency of permissions queries to speed up v1.14.0 [@shamoon](https://github.com/shamoon) ([#3201](https://github.com/paperless-ngx/paperless-ngx/pull/3201))
+- Fix: permissions-aware statistics [@shamoon](https://github.com/shamoon) ([#3199](https://github.com/paperless-ngx/paperless-ngx/pull/3199))
+- Fix: Use document owner for matching if set [@shamoon](https://github.com/shamoon) ([#3198](https://github.com/paperless-ngx/paperless-ngx/pull/3198))
+- Chore: Fix isort not running, upgrade to the latest black [@stumpylog](https://github.com/stumpylog) ([#3177](https://github.com/paperless-ngx/paperless-ngx/pull/3177))
+- Fix: respect permissions on document view actions [@shamoon](https://github.com/shamoon) ([#3174](https://github.com/paperless-ngx/paperless-ngx/pull/3174))
+- Increment API version for 1.14.1+ [@shamoon](https://github.com/shamoon) ([#3191](https://github.com/paperless-ngx/paperless-ngx/pull/3191))
+- Fix: dropdown Private items with empty set [@shamoon](https://github.com/shamoon) ([#3189](https://github.com/paperless-ngx/paperless-ngx/pull/3189))
+- Fix: make the importer a little more robust against some errors [@stumpylog](https://github.com/stumpylog) ([#3188](https://github.com/paperless-ngx/paperless-ngx/pull/3188))
+- Fix: Specify backend for auto-login [@shamoon](https://github.com/shamoon) ([#3163](https://github.com/paperless-ngx/paperless-ngx/pull/3163))
+- Fix: StoragePath missing the owned or granted filter [@stumpylog](https://github.com/stumpylog) ([#3180](https://github.com/paperless-ngx/paperless-ngx/pull/3180))
+- Fix: Handle delete mail action with no filters [@shamoon](https://github.com/shamoon) ([#3161](https://github.com/paperless-ngx/paperless-ngx/pull/3161))
+</details>
+
+## paperless-ngx 1.14.0
+
+### Notable Changes
+
+- Feature: multi-user permissions [@shamoon](https://github.com/shamoon) ([#2147](https://github.com/paperless-ngx/paperless-ngx/pull/2147))
+
+### Features
+
+- Feature: Stronger typing for file consumption [@stumpylog](https://github.com/stumpylog) ([#2744](https://github.com/paperless-ngx/paperless-ngx/pull/2744))
+- Feature: double-click docs [@shamoon](https://github.com/shamoon) ([#2966](https://github.com/paperless-ngx/paperless-ngx/pull/2966))
+- feature: Add support for zxing as barcode scanning lib [@margau](https://github.com/margau) ([#2907](https://github.com/paperless-ngx/paperless-ngx/pull/2907))
+- Feature: Enable images to be released on Quay.io [@stumpylog](https://github.com/stumpylog) ([#2972](https://github.com/paperless-ngx/paperless-ngx/pull/2972))
+- Feature: test mail account [@shamoon](https://github.com/shamoon) ([#2949](https://github.com/paperless-ngx/paperless-ngx/pull/2949))
+- Feature: Capture celery and kombu logs to a file [@stumpylog](https://github.com/stumpylog) ([#2954](https://github.com/paperless-ngx/paperless-ngx/pull/2954))
+- Fix: Resolve Redis connection issues with ACLs [@stumpylog](https://github.com/stumpylog) ([#2939](https://github.com/paperless-ngx/paperless-ngx/pull/2939))
+- Feature: Allow mail account to use access tokens [@stumpylog](https://github.com/stumpylog) ([#2930](https://github.com/paperless-ngx/paperless-ngx/pull/2930))
+- Fix: Consumer polling could overwhelm database [@stumpylog](https://github.com/stumpylog) ([#2922](https://github.com/paperless-ngx/paperless-ngx/pull/2922))
+- Feature: Improved statistics widget [@shamoon](https://github.com/shamoon) ([#2910](https://github.com/paperless-ngx/paperless-ngx/pull/2910))
+- Enhancement: rename comments to notes and improve notes UI [@shamoon](https://github.com/shamoon) ([#2904](https://github.com/paperless-ngx/paperless-ngx/pull/2904))
+- Allow psql client certificate authentication [@Ongy](https://github.com/Ongy) ([#2899](https://github.com/paperless-ngx/paperless-ngx/pull/2899))
+- Enhancement: support filtering multiple correspondents, doctypes \& storage paths [@shamoon](https://github.com/shamoon) ([#2893](https://github.com/paperless-ngx/paperless-ngx/pull/2893))
+- Feature: Change celery serializer to pickle [@stumpylog](https://github.com/stumpylog) ([#2861](https://github.com/paperless-ngx/paperless-ngx/pull/2861))
+- Feature: Allow naming to include owner and original name [@stumpylog](https://github.com/stumpylog) ([#2873](https://github.com/paperless-ngx/paperless-ngx/pull/2873))
+- Feature: Allows filtering email by the TO value(s) as well [@stumpylog](https://github.com/stumpylog) ([#2871](https://github.com/paperless-ngx/paperless-ngx/pull/2871))
+- Feature: owner-aware unique model name constraint [@shamoon](https://github.com/shamoon) ([#2827](https://github.com/paperless-ngx/paperless-ngx/pull/2827))
+- Feature/2396 better mail actions [@jonaswinkler](https://github.com/jonaswinkler) ([#2718](https://github.com/paperless-ngx/paperless-ngx/pull/2718))
+- Feature: Reduce classifier memory usage somewhat during training [@stumpylog](https://github.com/stumpylog) ([#2733](https://github.com/paperless-ngx/paperless-ngx/pull/2733))
+- Feature: Add PAPERLESS_OCR_SKIP_ARCHIVE_FILE config setting [@bdr99](https://github.com/bdr99) ([#2743](https://github.com/paperless-ngx/paperless-ngx/pull/2743))
+- Feature: dynamic document counts in dropdowns [@shamoon](https://github.com/shamoon) ([#2704](https://github.com/paperless-ngx/paperless-ngx/pull/2704))
+- Allow setting the ASN on document upload [@stumpylog](https://github.com/stumpylog) ([#2713](https://github.com/paperless-ngx/paperless-ngx/pull/2713))
+- Feature: Log failed login attempts [@shamoon](https://github.com/shamoon) ([#2359](https://github.com/paperless-ngx/paperless-ngx/pull/2359))
+- Feature: Rename documents when storage path format changes [@stumpylog](https://github.com/stumpylog) ([#2696](https://github.com/paperless-ngx/paperless-ngx/pull/2696))
+- Feature: update error message colors \& show on document failures [@shamoon](https://github.com/shamoon) ([#2689](https://github.com/paperless-ngx/paperless-ngx/pull/2689))
+- Feature: multi-user permissions [@shamoon](https://github.com/shamoon) ([#2147](https://github.com/paperless-ngx/paperless-ngx/pull/2147))
+
+### Bug Fixes
+
+- Fix: Allow setting additional Django settings for proxies [@stumpylog](https://github.com/stumpylog) ([#3135](https://github.com/paperless-ngx/paperless-ngx/pull/3135))
+- Fix: Use exclude instead of difference for mariadb [@shamoon](https://github.com/shamoon) ([#2983](https://github.com/paperless-ngx/paperless-ngx/pull/2983))
+- Fix: permissions display should not show users with inherited permissions \& unable to change owner [@shamoon](https://github.com/shamoon) ([#2818](https://github.com/paperless-ngx/paperless-ngx/pull/2818))
+- Fix: Resolve Redis connection issues with ACLs [@stumpylog](https://github.com/stumpylog) ([#2939](https://github.com/paperless-ngx/paperless-ngx/pull/2939))
+- Fix: unable to edit correspondents (in ) [@shamoon](https://github.com/shamoon) ([#2938](https://github.com/paperless-ngx/paperless-ngx/pull/2938))
+- Fix: Consumer polling could overwhelm database [@stumpylog](https://github.com/stumpylog) ([#2922](https://github.com/paperless-ngx/paperless-ngx/pull/2922))
+- Fix: Chrome struggles with commas [@stumpylog](https://github.com/stumpylog) ([#2892](https://github.com/paperless-ngx/paperless-ngx/pull/2892))
+- Fix formatting in Setup documentation page [@igrybkov](https://github.com/igrybkov) ([#2880](https://github.com/paperless-ngx/paperless-ngx/pull/2880))
+- Fix: logout on change password via frontend [@shamoon](https://github.com/shamoon) ([#2863](https://github.com/paperless-ngx/paperless-ngx/pull/2863))
+- Fix: give superuser full doc perms [@shamoon](https://github.com/shamoon) ([#2820](https://github.com/paperless-ngx/paperless-ngx/pull/2820))
+- Fix: Append Gmail labels instead of replacing [@stumpylog](https://github.com/stumpylog) ([#2860](https://github.com/paperless-ngx/paperless-ngx/pull/2860))
+- Fix: Ensure email date is made aware during action processing [@stumpylog](https://github.com/stumpylog) ([#2837](https://github.com/paperless-ngx/paperless-ngx/pull/2837))
+- Fix: disable bulk edit dialog buttons during operation [@shamoon](https://github.com/shamoon) ([#2819](https://github.com/paperless-ngx/paperless-ngx/pull/2819))
+- fix database locked error [@jonaswinkler](https://github.com/jonaswinkler) ([#2808](https://github.com/paperless-ngx/paperless-ngx/pull/2808))
+- Fix: Disable suggestions for read-only docs [@shamoon](https://github.com/shamoon) ([#2813](https://github.com/paperless-ngx/paperless-ngx/pull/2813))
+- Update processed mail migration [@shamoon](https://github.com/shamoon) ([#2804](https://github.com/paperless-ngx/paperless-ngx/pull/2804))
+- Fix: Ensure scratch directory exists before using [@stumpylog](https://github.com/stumpylog) ([#2775](https://github.com/paperless-ngx/paperless-ngx/pull/2775))
+- Don't submit owner via API on document upload [@jonaswinkler](https://github.com/jonaswinkler) ([#2777](https://github.com/paperless-ngx/paperless-ngx/pull/2777))
+- Fix: only offer log files that exist [@shamoon](https://github.com/shamoon) ([#2739](https://github.com/paperless-ngx/paperless-ngx/pull/2739))
+- Fix: permissions editing and initial view issues [@shamoon](https://github.com/shamoon) ([#2717](https://github.com/paperless-ngx/paperless-ngx/pull/2717))
+- Fix: reset saved view ID on quickFilter [@shamoon](https://github.com/shamoon) ([#2703](https://github.com/paperless-ngx/paperless-ngx/pull/2703))
+- Fix: bulk edit reset apply button state [@shamoon](https://github.com/shamoon) ([#2701](https://github.com/paperless-ngx/paperless-ngx/pull/2701))
+- Fix: add missing i18n for mobile preview tab title [@nathanaelhoun](https://github.com/nathanaelhoun) ([#2692](https://github.com/paperless-ngx/paperless-ngx/pull/2692))
+
+### Documentation
+
+- Whitespace changes, making sure the example is correcly aligned [@denilsonsa](https://github.com/denilsonsa) ([#3089](https://github.com/paperless-ngx/paperless-ngx/pull/3089))
+- Docs: Include additional information about barcodes [@stumpylog](https://github.com/stumpylog) ([#2889](https://github.com/paperless-ngx/paperless-ngx/pull/2889))
+- Fix formatting in Setup documentation page [@igrybkov](https://github.com/igrybkov) ([#2880](https://github.com/paperless-ngx/paperless-ngx/pull/2880))
+- [Documentation] Update docker-compose steps to support podman [@white-gecko](https://github.com/white-gecko) ([#2855](https://github.com/paperless-ngx/paperless-ngx/pull/2855))
+- docs: better language code help [@tooomm](https://github.com/tooomm) ([#2830](https://github.com/paperless-ngx/paperless-ngx/pull/2830))
+- Feature: Add an option to disable matching [@bdr99](https://github.com/bdr99) ([#2727](https://github.com/paperless-ngx/paperless-ngx/pull/2727))
+- Docs: Remove outdated PAPERLESS_WORKER_RETRY [@shamoon](https://github.com/shamoon) ([#2694](https://github.com/paperless-ngx/paperless-ngx/pull/2694))
+- Fix: add missing i18n for mobile preview tab title [@nathanaelhoun](https://github.com/nathanaelhoun) ([#2692](https://github.com/paperless-ngx/paperless-ngx/pull/2692))
+
+### Maintenance
+
+- Chore: Configure ruff as the primary linter for Python [@stumpylog](https://github.com/stumpylog) ([#2988](https://github.com/paperless-ngx/paperless-ngx/pull/2988))
+- Feature: Enable images to be released on Quay.io [@stumpylog](https://github.com/stumpylog) ([#2972](https://github.com/paperless-ngx/paperless-ngx/pull/2972))
+- Chore: Updates locked pipenv to latest version [@stumpylog](https://github.com/stumpylog) ([#2943](https://github.com/paperless-ngx/paperless-ngx/pull/2943))
+- Chore: Properly collapse section in releases [@tooomm](https://github.com/tooomm) ([#2838](https://github.com/paperless-ngx/paperless-ngx/pull/2838))
+- Chore: Don't include changelog PR for different releases [@tooomm](https://github.com/tooomm) ([#2832](https://github.com/paperless-ngx/paperless-ngx/pull/2832))
+- Chore: Speed up frontend CI testing [@stumpylog](https://github.com/stumpylog) ([#2796](https://github.com/paperless-ngx/paperless-ngx/pull/2796))
+- Bump leonsteinhaeuser/project-beta-automations from 2.0.1 to 2.1.0 [@dependabot](https://github.com/dependabot) ([#2789](https://github.com/paperless-ngx/paperless-ngx/pull/2789))
+
+### Dependencies
+
+<details>
+<summary>15 changes</summary>
+
+- Bump ng2-pdf-viewer from 9.1.4 to 9.1.5 in /src-ui [@dependabot](https://github.com/dependabot) ([#3109](https://github.com/paperless-ngx/paperless-ngx/pull/3109))
+- Grouped bump angular packages from 15.2.6 to 15.2.7 in /src-ui [@dependabot](https://github.com/dependabot) ([#3108](https://github.com/paperless-ngx/paperless-ngx/pull/3108))
+- Bump typescript from 4.8.4 to 4.9.5 in /src-ui [@dependabot](https://github.com/dependabot) ([#3071](https://github.com/paperless-ngx/paperless-ngx/pull/3071))
+- Bulk Bump npm packages 04.23 [@dependabot](https://github.com/dependabot) ([#3068](https://github.com/paperless-ngx/paperless-ngx/pull/3068))
+- Bump wait-on from 6.0.1 to 7.0.1 in /src-ui [@dependabot](https://github.com/dependabot) ([#2990](https://github.com/paperless-ngx/paperless-ngx/pull/2990))
+- Bulk bump angular packages to 15.2.5 in /src-ui [@dependabot](https://github.com/dependabot) ([#2991](https://github.com/paperless-ngx/paperless-ngx/pull/2991))
+- Bump [@<!---->types/node from 18.11.18 to 18.15.11 in /src-ui @dependabot](https://github.com/<!---->types/node from 18.11.18 to 18.15.11 in /src-ui @dependabot) ([#2993](https://github.com/paperless-ngx/paperless-ngx/pull/2993))
+- Bump [@<!---->ng-select/ng-select from 10.0.3 to 10.0.4 in /src-ui @dependabot](https://github.com/<!---->ng-select/ng-select from 10.0.3 to 10.0.4 in /src-ui @dependabot) ([#2992](https://github.com/paperless-ngx/paperless-ngx/pull/2992))
+- Bump [@<!---->typescript-eslint/eslint-plugin from 5.50.0 to 5.57.0 in /src-ui @dependabot](https://github.com/<!---->typescript-eslint/eslint-plugin from 5.50.0 to 5.57.0 in /src-ui @dependabot) ([#2989](https://github.com/paperless-ngx/paperless-ngx/pull/2989))
+- Chore: Update cryptography to latest version [@stumpylog](https://github.com/stumpylog) ([#2891](https://github.com/paperless-ngx/paperless-ngx/pull/2891))
+- Chore: Update to qpdf 11.3.0 in Docker image [@stumpylog](https://github.com/stumpylog) ([#2862](https://github.com/paperless-ngx/paperless-ngx/pull/2862))
+- Bump leonsteinhaeuser/project-beta-automations from 2.0.1 to 2.1.0 [@dependabot](https://github.com/dependabot) ([#2789](https://github.com/paperless-ngx/paperless-ngx/pull/2789))
+- Bump zone.js from 0.11.8 to 0.12.0 in /src-ui [@dependabot](https://github.com/dependabot) ([#2793](https://github.com/paperless-ngx/paperless-ngx/pull/2793))
+- Bump [@<!---->typescript-eslint/parser from 5.50.0 to 5.54.0 in /src-ui @dependabot](https://github.com/<!---->typescript-eslint/parser from 5.50.0 to 5.54.0 in /src-ui @dependabot) ([#2792](https://github.com/paperless-ngx/paperless-ngx/pull/2792))
+- Bulk Bump angular packages to 15.2.1 in /src-ui [@dependabot](https://github.com/dependabot) ([#2788](https://github.com/paperless-ngx/paperless-ngx/pull/2788))
+</details>
+
+### All App Changes
+
+<details>
+<summary>72 changes</summary>
+
+- Feature: Catalan translation [@shamoon](https://github.com/shamoon) ([#3146](https://github.com/paperless-ngx/paperless-ngx/pull/3146))
+- Fix: Allow setting additional Django settings for proxies [@stumpylog](https://github.com/stumpylog) ([#3135](https://github.com/paperless-ngx/paperless-ngx/pull/3135))
+- Fix: Increase mail account password field length [@stumpylog](https://github.com/stumpylog) ([#3134](https://github.com/paperless-ngx/paperless-ngx/pull/3134))
+- Fix: respect permissions for matching suggestions [@shamoon](https://github.com/shamoon) ([#3103](https://github.com/paperless-ngx/paperless-ngx/pull/3103))
+- Bump ng2-pdf-viewer from 9.1.4 to 9.1.5 in /src-ui [@dependabot](https://github.com/dependabot) ([#3109](https://github.com/paperless-ngx/paperless-ngx/pull/3109))
+- Grouped bump angular packages from 15.2.6 to 15.2.7 in /src-ui [@dependabot](https://github.com/dependabot) ([#3108](https://github.com/paperless-ngx/paperless-ngx/pull/3108))
+- Fix: update PaperlessTask on hard failures [@shamoon](https://github.com/shamoon) ([#3062](https://github.com/paperless-ngx/paperless-ngx/pull/3062))
+- Bump typescript from 4.8.4 to 4.9.5 in /src-ui [@dependabot](https://github.com/dependabot) ([#3071](https://github.com/paperless-ngx/paperless-ngx/pull/3071))
+- Bulk Bump npm packages 04.23 [@dependabot](https://github.com/dependabot) ([#3068](https://github.com/paperless-ngx/paperless-ngx/pull/3068))
+- Fix: Hide UI tour steps if user doesnt have permissions [@shamoon](https://github.com/shamoon) ([#3060](https://github.com/paperless-ngx/paperless-ngx/pull/3060))
+- Fix: Hide Permissions tab if user cannot view users [@shamoon](https://github.com/shamoon) ([#3061](https://github.com/paperless-ngx/paperless-ngx/pull/3061))
+- v1.14.0 delete document fixes [@shamoon](https://github.com/shamoon) ([#3020](https://github.com/paperless-ngx/paperless-ngx/pull/3020))
+- Bump wait-on from 6.0.1 to 7.0.1 in /src-ui [@dependabot](https://github.com/dependabot) ([#2990](https://github.com/paperless-ngx/paperless-ngx/pull/2990))
+- Fix: inline plaintext docs to enforce styling [@shamoon](https://github.com/shamoon) ([#3013](https://github.com/paperless-ngx/paperless-ngx/pull/3013))
+- Chore: Configure ruff as the primary linter for Python [@stumpylog](https://github.com/stumpylog) ([#2988](https://github.com/paperless-ngx/paperless-ngx/pull/2988))
+- Bulk bump angular packages to 15.2.5 in /src-ui [@dependabot](https://github.com/dependabot) ([#2991](https://github.com/paperless-ngx/paperless-ngx/pull/2991))
+- Bump [@<!---->types/node from 18.11.18 to 18.15.11 in /src-ui @dependabot](https://github.com/<!---->types/node from 18.11.18 to 18.15.11 in /src-ui @dependabot) ([#2993](https://github.com/paperless-ngx/paperless-ngx/pull/2993))
+- Bump [@<!---->ng-select/ng-select from 10.0.3 to 10.0.4 in /src-ui @dependabot](https://github.com/<!---->ng-select/ng-select from 10.0.3 to 10.0.4 in /src-ui @dependabot) ([#2992](https://github.com/paperless-ngx/paperless-ngx/pull/2992))
+- Bump [@<!---->typescript-eslint/eslint-plugin from 5.50.0 to 5.57.0 in /src-ui @dependabot](https://github.com/<!---->typescript-eslint/eslint-plugin from 5.50.0 to 5.57.0 in /src-ui @dependabot) ([#2989](https://github.com/paperless-ngx/paperless-ngx/pull/2989))
+- Feature: Stronger typing for file consumption [@stumpylog](https://github.com/stumpylog) ([#2744](https://github.com/paperless-ngx/paperless-ngx/pull/2744))
+- Fix: Use exclude instead of difference for mariadb [@shamoon](https://github.com/shamoon) ([#2983](https://github.com/paperless-ngx/paperless-ngx/pull/2983))
+- Fix: permissions display should not show users with inherited permissions \& unable to change owner [@shamoon](https://github.com/shamoon) ([#2818](https://github.com/paperless-ngx/paperless-ngx/pull/2818))
+- Feature: double-click docs [@shamoon](https://github.com/shamoon) ([#2966](https://github.com/paperless-ngx/paperless-ngx/pull/2966))
+- feature: Add support for zxing as barcode scanning lib [@margau](https://github.com/margau) ([#2907](https://github.com/paperless-ngx/paperless-ngx/pull/2907))
+- Feature: test mail account [@shamoon](https://github.com/shamoon) ([#2949](https://github.com/paperless-ngx/paperless-ngx/pull/2949))
+- Feature: Capture celery and kombu logs to a file [@stumpylog](https://github.com/stumpylog) ([#2954](https://github.com/paperless-ngx/paperless-ngx/pull/2954))
+- Fix: Resolve Redis connection issues with ACLs [@stumpylog](https://github.com/stumpylog) ([#2939](https://github.com/paperless-ngx/paperless-ngx/pull/2939))
+- Feature: Allow mail account to use access tokens [@stumpylog](https://github.com/stumpylog) ([#2930](https://github.com/paperless-ngx/paperless-ngx/pull/2930))
+- Fix: Consumer polling could overwhelm database [@stumpylog](https://github.com/stumpylog) ([#2922](https://github.com/paperless-ngx/paperless-ngx/pull/2922))
+- Feature: Improved statistics widget [@shamoon](https://github.com/shamoon) ([#2910](https://github.com/paperless-ngx/paperless-ngx/pull/2910))
+- Enhancement: rename comments to notes and improve notes UI [@shamoon](https://github.com/shamoon) ([#2904](https://github.com/paperless-ngx/paperless-ngx/pull/2904))
+- Allow psql client certificate authentication [@Ongy](https://github.com/Ongy) ([#2899](https://github.com/paperless-ngx/paperless-ngx/pull/2899))
+- Enhancement: support filtering multiple correspondents, doctypes \& storage paths [@shamoon](https://github.com/shamoon) ([#2893](https://github.com/paperless-ngx/paperless-ngx/pull/2893))
+- Fix: frontend handle private tags, doctypes, correspondents [@shamoon](https://github.com/shamoon) ([#2839](https://github.com/paperless-ngx/paperless-ngx/pull/2839))
+- Fix: Chrome struggles with commas [@stumpylog](https://github.com/stumpylog) ([#2892](https://github.com/paperless-ngx/paperless-ngx/pull/2892))
+- Feature: Change celery serializer to pickle [@stumpylog](https://github.com/stumpylog) ([#2861](https://github.com/paperless-ngx/paperless-ngx/pull/2861))
+- Feature: Allow naming to include owner and original name [@stumpylog](https://github.com/stumpylog) ([#2873](https://github.com/paperless-ngx/paperless-ngx/pull/2873))
+- Feature: Allows filtering email by the TO value(s) as well [@stumpylog](https://github.com/stumpylog) ([#2871](https://github.com/paperless-ngx/paperless-ngx/pull/2871))
+- Fix: logout on change password via frontend [@shamoon](https://github.com/shamoon) ([#2863](https://github.com/paperless-ngx/paperless-ngx/pull/2863))
+- Fix: give superuser full doc perms [@shamoon](https://github.com/shamoon) ([#2820](https://github.com/paperless-ngx/paperless-ngx/pull/2820))
+- Fix: Append Gmail labels instead of replacing [@stumpylog](https://github.com/stumpylog) ([#2860](https://github.com/paperless-ngx/paperless-ngx/pull/2860))
+- Feature: owner-aware unique model name constraint [@shamoon](https://github.com/shamoon) ([#2827](https://github.com/paperless-ngx/paperless-ngx/pull/2827))
+- Chore: Create list parsing utility for settings [@stumpylog](https://github.com/stumpylog) ([#2816](https://github.com/paperless-ngx/paperless-ngx/pull/2816))
+- Fix: Ensure email date is made aware during action processing [@stumpylog](https://github.com/stumpylog) ([#2837](https://github.com/paperless-ngx/paperless-ngx/pull/2837))
+- Chore: Convert more code to pathlib [@stumpylog](https://github.com/stumpylog) ([#2817](https://github.com/paperless-ngx/paperless-ngx/pull/2817))
+- Fix: disable bulk edit dialog buttons during operation [@shamoon](https://github.com/shamoon) ([#2819](https://github.com/paperless-ngx/paperless-ngx/pull/2819))
+- fix database locked error [@jonaswinkler](https://github.com/jonaswinkler) ([#2808](https://github.com/paperless-ngx/paperless-ngx/pull/2808))
+- Fix: Disable suggestions for read-only docs [@shamoon](https://github.com/shamoon) ([#2813](https://github.com/paperless-ngx/paperless-ngx/pull/2813))
+- update django.po messages [@jonaswinkler](https://github.com/jonaswinkler) ([#2806](https://github.com/paperless-ngx/paperless-ngx/pull/2806))
+- Update processed mail migration [@shamoon](https://github.com/shamoon) ([#2804](https://github.com/paperless-ngx/paperless-ngx/pull/2804))
+- Feature/2396 better mail actions [@jonaswinkler](https://github.com/jonaswinkler) ([#2718](https://github.com/paperless-ngx/paperless-ngx/pull/2718))
+- Bump zone.js from 0.11.8 to 0.12.0 in /src-ui [@dependabot](https://github.com/dependabot) ([#2793](https://github.com/paperless-ngx/paperless-ngx/pull/2793))
+- Bump [@<!---->typescript-eslint/parser from 5.50.0 to 5.54.0 in /src-ui @dependabot](https://github.com/<!---->typescript-eslint/parser from 5.50.0 to 5.54.0 in /src-ui @dependabot) ([#2792](https://github.com/paperless-ngx/paperless-ngx/pull/2792))
+- Bulk Bump angular packages to 15.2.1 in /src-ui [@dependabot](https://github.com/dependabot) ([#2788](https://github.com/paperless-ngx/paperless-ngx/pull/2788))
+- Fix: Ensure scratch directory exists before using [@stumpylog](https://github.com/stumpylog) ([#2775](https://github.com/paperless-ngx/paperless-ngx/pull/2775))
+- Don't submit owner via API on document upload [@jonaswinkler](https://github.com/jonaswinkler) ([#2777](https://github.com/paperless-ngx/paperless-ngx/pull/2777))
+- Feature: Reduce classifier memory usage somewhat during training [@stumpylog](https://github.com/stumpylog) ([#2733](https://github.com/paperless-ngx/paperless-ngx/pull/2733))
+- Chore: Setup for mypy typing checks [@stumpylog](https://github.com/stumpylog) ([#2742](https://github.com/paperless-ngx/paperless-ngx/pull/2742))
+- Feature: Add PAPERLESS_OCR_SKIP_ARCHIVE_FILE config setting [@bdr99](https://github.com/bdr99) ([#2743](https://github.com/paperless-ngx/paperless-ngx/pull/2743))
+- Fix: only offer log files that exist [@shamoon](https://github.com/shamoon) ([#2739](https://github.com/paperless-ngx/paperless-ngx/pull/2739))
+- Feature: dynamic document counts in dropdowns [@shamoon](https://github.com/shamoon) ([#2704](https://github.com/paperless-ngx/paperless-ngx/pull/2704))
+- Fix: permissions editing and initial view issues [@shamoon](https://github.com/shamoon) ([#2717](https://github.com/paperless-ngx/paperless-ngx/pull/2717))
+- Fix: reset saved view ID on quickFilter [@shamoon](https://github.com/shamoon) ([#2703](https://github.com/paperless-ngx/paperless-ngx/pull/2703))
+- Feature: Add an option to disable matching [@bdr99](https://github.com/bdr99) ([#2727](https://github.com/paperless-ngx/paperless-ngx/pull/2727))
+- Chore: Improve clarity of some test asserting [@stumpylog](https://github.com/stumpylog) ([#2714](https://github.com/paperless-ngx/paperless-ngx/pull/2714))
+- Allow setting the ASN on document upload [@stumpylog](https://github.com/stumpylog) ([#2713](https://github.com/paperless-ngx/paperless-ngx/pull/2713))
+- Fix: bulk edit reset apply button state [@shamoon](https://github.com/shamoon) ([#2701](https://github.com/paperless-ngx/paperless-ngx/pull/2701))
+- Feature: Log failed login attempts [@shamoon](https://github.com/shamoon) ([#2359](https://github.com/paperless-ngx/paperless-ngx/pull/2359))
+- Feature: Rename documents when storage path format changes [@stumpylog](https://github.com/stumpylog) ([#2696](https://github.com/paperless-ngx/paperless-ngx/pull/2696))
+- Feature: update error message colors \& show on document failures [@shamoon](https://github.com/shamoon) ([#2689](https://github.com/paperless-ngx/paperless-ngx/pull/2689))
+- Feature: multi-user permissions [@shamoon](https://github.com/shamoon) ([#2147](https://github.com/paperless-ngx/paperless-ngx/pull/2147))
+- Fix: add missing i18n for mobile preview tab title [@nathanaelhoun](https://github.com/nathanaelhoun) ([#2692](https://github.com/paperless-ngx/paperless-ngx/pull/2692))
+</details>
+
+## paperless-ngx 1.13.0
+
+### Features
+
+- Feature: allow disable warn on close saved view with changes [@shamoon](https://github.com/shamoon) ([#2681](https://github.com/paperless-ngx/paperless-ngx/pull/2681))
+- Feature: Add option to enable response compression [@stumpylog](https://github.com/stumpylog) ([#2621](https://github.com/paperless-ngx/paperless-ngx/pull/2621))
+- Feature: split documents on ASN barcode [@muued](https://github.com/muued) ([#2554](https://github.com/paperless-ngx/paperless-ngx/pull/2554))
+
+### Bug Fixes
+
+- Fix: Ignore path filtering didn't handle sub directories [@stumpylog](https://github.com/stumpylog) ([#2674](https://github.com/paperless-ngx/paperless-ngx/pull/2674))
+- Bugfix: Generation of secret key hangs during install script [@stumpylog](https://github.com/stumpylog) ([#2657](https://github.com/paperless-ngx/paperless-ngx/pull/2657))
+- Fix: Remove files produced by barcode splitting when completed [@stumpylog](https://github.com/stumpylog) ([#2648](https://github.com/paperless-ngx/paperless-ngx/pull/2648))
+- Fix: add missing storage path placeholders [@shamoon](https://github.com/shamoon) ([#2651](https://github.com/paperless-ngx/paperless-ngx/pull/2651))
+- Fix long dropdown contents break document detail column view [@shamoon](https://github.com/shamoon) ([#2638](https://github.com/paperless-ngx/paperless-ngx/pull/2638))
+- Fix: tags dropdown should stay closed when removing [@shamoon](https://github.com/shamoon) ([#2625](https://github.com/paperless-ngx/paperless-ngx/pull/2625))
+- Bugfix: Configure scheduled tasks to expire after some time [@stumpylog](https://github.com/stumpylog) ([#2614](https://github.com/paperless-ngx/paperless-ngx/pull/2614))
+- Bugfix: Limit management list pagination maxSize to 5 [@Kaaybi](https://github.com/Kaaybi) ([#2618](https://github.com/paperless-ngx/paperless-ngx/pull/2618))
+- Fix: Don't crash on bad ASNs during indexing [@stumpylog](https://github.com/stumpylog) ([#2586](https://github.com/paperless-ngx/paperless-ngx/pull/2586))
+- Fix: Prevent mktime OverflowError except in even more rare caes [@stumpylog](https://github.com/stumpylog) ([#2574](https://github.com/paperless-ngx/paperless-ngx/pull/2574))
+- Bugfix: Whoosh relative date queries weren't handling timezones [@stumpylog](https://github.com/stumpylog) ([#2566](https://github.com/paperless-ngx/paperless-ngx/pull/2566))
+- Fix importing files with non-ascii names [@Kexogg](https://github.com/Kexogg) ([#2555](https://github.com/paperless-ngx/paperless-ngx/pull/2555))
+
+### Documentation
+
+- Chore: update recommended Gotenberg to 7.8, docs note possible incompatibility [@shamoon](https://github.com/shamoon) ([#2608](https://github.com/paperless-ngx/paperless-ngx/pull/2608))
+- [Documentation] Add v1.12.2 changelog [@github-actions](https://github.com/github-actions) ([#2553](https://github.com/paperless-ngx/paperless-ngx/pull/2553))
+
+### Maintenance
+
+- Chore: Faster Docker image cleanup [@stumpylog](https://github.com/stumpylog) ([#2687](https://github.com/paperless-ngx/paperless-ngx/pull/2687))
+- Chore: Remove duplicated folder [@stumpylog](https://github.com/stumpylog) ([#2561](https://github.com/paperless-ngx/paperless-ngx/pull/2561))
+- Chore: Switch test coverage to Codecov [@stumpylog](https://github.com/stumpylog) ([#2582](https://github.com/paperless-ngx/paperless-ngx/pull/2582))
+- Bump docker/build-push-action from 3 to 4 [@dependabot](https://github.com/dependabot) ([#2576](https://github.com/paperless-ngx/paperless-ngx/pull/2576))
+- Chore: Run tests which require convert in the CI [@stumpylog](https://github.com/stumpylog) ([#2570](https://github.com/paperless-ngx/paperless-ngx/pull/2570))
+
+- Feature: split documents on ASN barcode [@muued](https://github.com/muued) ([#2554](https://github.com/paperless-ngx/paperless-ngx/pull/2554))
+- Bugfix: Whoosh relative date queries weren't handling timezones [@stumpylog](https://github.com/stumpylog) ([#2566](https://github.com/paperless-ngx/paperless-ngx/pull/2566))
+- Fix importing files with non-ascii names [@Kexogg](https://github.com/Kexogg) ([#2555](https://github.com/paperless-ngx/paperless-ngx/pull/2555))
+
+## paperless-ngx 1.12.2
+
+_Note: Version 1.12.x introduced searching of comments which will work for comments added after the upgrade but a reindex of the search index is required in order to be able to search
+older comments. The Docker image will automatically perform this reindex, bare metal installations will have to perform this manually, see [the docs](https://docs.paperless-ngx.com/administration/#index)._
+
+### Bug Fixes
+
+- Bugfix: Allow pre-consume scripts to modify incoming file [@stumpylog](https://github.com/stumpylog) ([#2547](https://github.com/paperless-ngx/paperless-ngx/pull/2547))
+- Bugfix: Return to page based barcode scanning [@stumpylog](https://github.com/stumpylog) ([#2544](https://github.com/paperless-ngx/paperless-ngx/pull/2544))
+- Fix: Try to prevent title debounce overwriting [@shamoon](https://github.com/shamoon) ([#2543](https://github.com/paperless-ngx/paperless-ngx/pull/2543))
+- Fix comment search highlight + multi-word search [@shamoon](https://github.com/shamoon) ([#2542](https://github.com/paperless-ngx/paperless-ngx/pull/2542))
+- Bugfix: Request PDF/A format from Gotenberg [@stumpylog](https://github.com/stumpylog) ([#2530](https://github.com/paperless-ngx/paperless-ngx/pull/2530))
+- Fix: Trigger reindex for pre-existing comments [@shamoon](https://github.com/shamoon) ([#2519](https://github.com/paperless-ngx/paperless-ngx/pull/2519))
+
+### Documentation
+
+- Bugfix: Allow pre-consume scripts to modify incoming file [@stumpylog](https://github.com/stumpylog) ([#2547](https://github.com/paperless-ngx/paperless-ngx/pull/2547))
+- Fix: Trigger reindex for pre-existing comments [@shamoon](https://github.com/shamoon) ([#2519](https://github.com/paperless-ngx/paperless-ngx/pull/2519))
+- Minor updates to development documentation [@clemensrieder](https://github.com/clemensrieder) ([#2474](https://github.com/paperless-ngx/paperless-ngx/pull/2474))
+- [Documentation] Add v1.12.1 changelog [@github-actions](https://github.com/github-actions) ([#2515](https://github.com/paperless-ngx/paperless-ngx/pull/2515))
+
+### Maintenance
+
+- Chore: Fix tag cleaner to work with attestations [@stumpylog](https://github.com/stumpylog) ([#2532](https://github.com/paperless-ngx/paperless-ngx/pull/2532))
+- Chore: Make installers statically versioned [@stumpylog](https://github.com/stumpylog) ([#2517](https://github.com/paperless-ngx/paperless-ngx/pull/2517))
+
+### All App Changes
+
+- Bugfix: Allow pre-consume scripts to modify incoming file [@stumpylog](https://github.com/stumpylog) ([#2547](https://github.com/paperless-ngx/paperless-ngx/pull/2547))
+- Bugfix: Return to page based barcode scanning [@stumpylog](https://github.com/stumpylog) ([#2544](https://github.com/paperless-ngx/paperless-ngx/pull/2544))
+- Fix: Try to prevent title debounce overwriting [@shamoon](https://github.com/shamoon) ([#2543](https://github.com/paperless-ngx/paperless-ngx/pull/2543))
+- Fix comment search highlight + multi-word search [@shamoon](https://github.com/shamoon) ([#2542](https://github.com/paperless-ngx/paperless-ngx/pull/2542))
+- Bugfix: Request PDF/A format from Gotenberg [@stumpylog](https://github.com/stumpylog) ([#2530](https://github.com/paperless-ngx/paperless-ngx/pull/2530))
+
+## paperless-ngx 1.12.1
+
+### Bug Fixes
+
+- Fix: comments not showing in search until after manual reindex in v1.12 [@shamoon](https://github.com/shamoon) ([#2513](https://github.com/paperless-ngx/paperless-ngx/pull/2513))
+- Fix: date range search broken in 1.12 [@shamoon](https://github.com/shamoon) ([#2509](https://github.com/paperless-ngx/paperless-ngx/pull/2509))
+
+### Documentation
+
+- [Documentation] Add v1.12.0 changelog [@github-actions](https://github.com/github-actions) ([#2507](https://github.com/paperless-ngx/paperless-ngx/pull/2507))
+
+### Maintenance
+
+- Moves back to the main release-drafter now that it does what we wanted [@stumpylog](https://github.com/stumpylog) ([#2503](https://github.com/paperless-ngx/paperless-ngx/pull/2503))
+
+### All App Changes
+
+- Fix: comments not showing in search until after manual reindex in v1.12 [@shamoon](https://github.com/shamoon) ([#2513](https://github.com/paperless-ngx/paperless-ngx/pull/2513))
+- Fix: date range search broken in 1.12 [@shamoon](https://github.com/shamoon) ([#2509](https://github.com/paperless-ngx/paperless-ngx/pull/2509))
+
+## paperless-ngx 1.12.0
+
+### Features
+
+- New document_exporter options [@mhelleboid](https://github.com/mhelleboid) ([#2448](https://github.com/paperless-ngx/paperless-ngx/pull/2448))
+- Read ASN from barcode on page [@peterkappelt](https://github.com/peterkappelt) ([#2437](https://github.com/paperless-ngx/paperless-ngx/pull/2437))
+- Add AppleMail color tag support [@clemensrieder](https://github.com/clemensrieder) ([#2407](https://github.com/paperless-ngx/paperless-ngx/pull/2407))
+- Feature: Retain original filename on upload [@stumpylog](https://github.com/stumpylog) ([#2404](https://github.com/paperless-ngx/paperless-ngx/pull/2404))
+- Feature: Control scheduled tasks via cron expressions [@stumpylog](https://github.com/stumpylog) ([#2403](https://github.com/paperless-ngx/paperless-ngx/pull/2403))
+- Simplify json parsing in build scripts [@tribut](https://github.com/tribut) ([#2370](https://github.com/paperless-ngx/paperless-ngx/pull/2370))
+- Feature: include comments in advanced search [@shamoon](https://github.com/shamoon) ([#2351](https://github.com/paperless-ngx/paperless-ngx/pull/2351))
+
+### Bug Fixes
+
+- Fix: limit asn integer size [@shamoon](https://github.com/shamoon) ([#2498](https://github.com/paperless-ngx/paperless-ngx/pull/2498))
+- Bugfix: Rescales images for better barcode locating [@stumpylog](https://github.com/stumpylog) ([#2468](https://github.com/paperless-ngx/paperless-ngx/pull/2468))
+- Fix: fix downgrade migration [@shamoon](https://github.com/shamoon) ([#2494](https://github.com/paperless-ngx/paperless-ngx/pull/2494))
+- Fix: Allow setting mailrule order from frontend [@shamoon](https://github.com/shamoon) ([#2459](https://github.com/paperless-ngx/paperless-ngx/pull/2459))
+- Fix: tag color ordering [@shamoon](https://github.com/shamoon) ([#2456](https://github.com/paperless-ngx/paperless-ngx/pull/2456))
+- Fix: Better Handle arbitrary ISO 8601 strings after celery serializing [@shamoon](https://github.com/shamoon) ([#2441](https://github.com/paperless-ngx/paperless-ngx/pull/2441))
+- Use correct canonical path for nltk_data [@amo13](https://github.com/amo13) ([#2429](https://github.com/paperless-ngx/paperless-ngx/pull/2429))
+- Fix: Include optional socket file in release [@stumpylog](https://github.com/stumpylog) ([#2409](https://github.com/paperless-ngx/paperless-ngx/pull/2409))
+- Fix: display rtl content in correct direction [@shamoon](https://github.com/shamoon) ([#2302](https://github.com/paperless-ngx/paperless-ngx/pull/2302))
+- Fixed endpoint count in Docs The REST API [@PascalSenn](https://github.com/PascalSenn) ([#2386](https://github.com/paperless-ngx/paperless-ngx/pull/2386))
+- Fix subpath for websockets [@tribut](https://github.com/tribut) ([#2371](https://github.com/paperless-ngx/paperless-ngx/pull/2371))
+- Fix: Make missing environment from file files informational only [@stumpylog](https://github.com/stumpylog) ([#2368](https://github.com/paperless-ngx/paperless-ngx/pull/2368))
+- Bugfix: Backend tests weren't using correct Python version [@stumpylog](https://github.com/stumpylog) ([#2363](https://github.com/paperless-ngx/paperless-ngx/pull/2363))
+- Fix: preview content remains hidden on mobile [@shamoon](https://github.com/shamoon) ([#2346](https://github.com/paperless-ngx/paperless-ngx/pull/2346))
+- Bugfix: Removal of alpha channel truncates multipage TIFFs [@stumpylog](https://github.com/stumpylog) ([#2335](https://github.com/paperless-ngx/paperless-ngx/pull/2335))
+- Documentation: update build instructions to remove deprecated [@shamoon](https://github.com/shamoon) ([#2334](https://github.com/paperless-ngx/paperless-ngx/pull/2334))
+
+### Documentation
+
+- Docs: Fix typo - docker-compose.yml file name in setup doc [@muli](https://github.com/muli) ([#2477](https://github.com/paperless-ngx/paperless-ngx/pull/2477))
+- document existence of document_thumbnails [@frrad](https://github.com/frrad) ([#2470](https://github.com/paperless-ngx/paperless-ngx/pull/2470))
+- Add optional sudo command to bare metal docs [@shamoon](https://github.com/shamoon) ([#2464](https://github.com/paperless-ngx/paperless-ngx/pull/2464))
+- Fix link [@edenhaus](https://github.com/edenhaus) ([#2458](https://github.com/paperless-ngx/paperless-ngx/pull/2458))
+- Documentation: Fix comment re bare metal runserver command [@shamoon](https://github.com/shamoon) ([#2420](https://github.com/paperless-ngx/paperless-ngx/pull/2420))
+- Fix formatting of config variable in docs [@peterkappelt](https://github.com/peterkappelt) ([#2445](https://github.com/paperless-ngx/paperless-ngx/pull/2445))
+- Update docs nginx reverse proxy example [@Sprinterfreak](https://github.com/Sprinterfreak) ([#2443](https://github.com/paperless-ngx/paperless-ngx/pull/2443))
+- [Documentation] Add note re for dev server [@shamoon](https://github.com/shamoon) ([#2387](https://github.com/paperless-ngx/paperless-ngx/pull/2387))
+- Fixed endpoint count in Docs The REST API [@PascalSenn](https://github.com/PascalSenn) ([#2386](https://github.com/paperless-ngx/paperless-ngx/pull/2386))
+- [ Docs] Update bare metal setup instructions [@natrius](https://github.com/natrius) ([#2281](https://github.com/paperless-ngx/paperless-ngx/pull/2281))
+- [Docs] Add Paperless Mobile app to docs [@astubenbord](https://github.com/astubenbord) ([#2378](https://github.com/paperless-ngx/paperless-ngx/pull/2378))
+- Tiny spelling change [@veverkap](https://github.com/veverkap) ([#2369](https://github.com/paperless-ngx/paperless-ngx/pull/2369))
+- Documentation: update build instructions to remove deprecated [@shamoon](https://github.com/shamoon) ([#2334](https://github.com/paperless-ngx/paperless-ngx/pull/2334))
+- [Documentation] Add note that PAPERLESS_URL cant contain a path [@shamoon](https://github.com/shamoon) ([#2319](https://github.com/paperless-ngx/paperless-ngx/pull/2319))
+- [Documentation] Add v1.11.3 changelog [@github-actions](https://github.com/github-actions) ([#2311](https://github.com/paperless-ngx/paperless-ngx/pull/2311))
+
+### Maintenance
+
+- Fix: Include optional socket file in release [@stumpylog](https://github.com/stumpylog) ([#2409](https://github.com/paperless-ngx/paperless-ngx/pull/2409))
+- Chore: remove helm chart code [@shamoon](https://github.com/shamoon) ([#2388](https://github.com/paperless-ngx/paperless-ngx/pull/2388))
+- Simplify json parsing in build scripts [@tribut](https://github.com/tribut) ([#2370](https://github.com/paperless-ngx/paperless-ngx/pull/2370))
+- Bugfix: Backend tests weren't using correct Python version [@stumpylog](https://github.com/stumpylog) ([#2363](https://github.com/paperless-ngx/paperless-ngx/pull/2363))
+- Bump tj-actions/changed-files from 34 to 35 [@dependabot](https://github.com/dependabot) ([#2303](https://github.com/paperless-ngx/paperless-ngx/pull/2303))
+
+### Dependencies
+
+<details>
+<summary>4 changes</summary>
+
+- Chore: Backend library updates [@stumpylog](https://github.com/stumpylog) ([#2401](https://github.com/paperless-ngx/paperless-ngx/pull/2401))
+- Bump tj-actions/changed-files from 34 to 35 [@dependabot](https://github.com/dependabot) ([#2303](https://github.com/paperless-ngx/paperless-ngx/pull/2303))
+- Bump [@<!---->typescript-eslint/parser from 5.43.0 to 5.47.1 in /src-ui @dependabot](https://github.com/<!---->typescript-eslint/parser from 5.43.0 to 5.47.1 in /src-ui @dependabot) ([#2306](https://github.com/paperless-ngx/paperless-ngx/pull/2306))
+- Bump [@<!---->typescript-eslint/eslint-plugin from 5.43.0 to 5.47.1 in /src-ui @dependabot](https://github.com/<!---->typescript-eslint/eslint-plugin from 5.43.0 to 5.47.1 in /src-ui @dependabot) ([#2308](https://github.com/paperless-ngx/paperless-ngx/pull/2308))
+</details>
+
+### All App Changes
+
+- New document_exporter options [@mhelleboid](https://github.com/mhelleboid) ([#2448](https://github.com/paperless-ngx/paperless-ngx/pull/2448))
+- Fix: limit asn integer size [@shamoon](https://github.com/shamoon) ([#2498](https://github.com/paperless-ngx/paperless-ngx/pull/2498))
+- Fix: fix downgrade migration [@shamoon](https://github.com/shamoon) ([#2494](https://github.com/paperless-ngx/paperless-ngx/pull/2494))
+- Read ASN from barcode on page [@peterkappelt](https://github.com/peterkappelt) ([#2437](https://github.com/paperless-ngx/paperless-ngx/pull/2437))
+- Fix: Allow setting mailrule order from frontend [@shamoon](https://github.com/shamoon) ([#2459](https://github.com/paperless-ngx/paperless-ngx/pull/2459))
+- Chore: Update to Angular 15 \& associated frontend deps [@shamoon](https://github.com/shamoon) ([#2411](https://github.com/paperless-ngx/paperless-ngx/pull/2411))
+- Fix: tag color ordering [@shamoon](https://github.com/shamoon) ([#2456](https://github.com/paperless-ngx/paperless-ngx/pull/2456))
+- Fix: Better Handle arbitrary ISO 8601 strings after celery serializing [@shamoon](https://github.com/shamoon) ([#2441](https://github.com/paperless-ngx/paperless-ngx/pull/2441))
+- Use correct canonical path for nltk_data [@amo13](https://github.com/amo13) ([#2429](https://github.com/paperless-ngx/paperless-ngx/pull/2429))
+- Add AppleMail color tag support [@clemensrieder](https://github.com/clemensrieder) ([#2407](https://github.com/paperless-ngx/paperless-ngx/pull/2407))
+- Chore: Convert document exporter to use pathlib [@stumpylog](https://github.com/stumpylog) ([#2416](https://github.com/paperless-ngx/paperless-ngx/pull/2416))
+- Feature: Retain original filename on upload [@stumpylog](https://github.com/stumpylog) ([#2404](https://github.com/paperless-ngx/paperless-ngx/pull/2404))
+- Feature: Control scheduled tasks via cron expressions [@stumpylog](https://github.com/stumpylog) ([#2403](https://github.com/paperless-ngx/paperless-ngx/pull/2403))
+- Fix: display rtl content in correct direction [@shamoon](https://github.com/shamoon) ([#2302](https://github.com/paperless-ngx/paperless-ngx/pull/2302))
+- Fix subpath for websockets [@tribut](https://github.com/tribut) ([#2371](https://github.com/paperless-ngx/paperless-ngx/pull/2371))
+- Bugfix: Backend tests weren't using correct Python version [@stumpylog](https://github.com/stumpylog) ([#2363](https://github.com/paperless-ngx/paperless-ngx/pull/2363))
+- Feature: include comments in advanced search [@shamoon](https://github.com/shamoon) ([#2351](https://github.com/paperless-ngx/paperless-ngx/pull/2351))
+- Chore: More frontend tests [@shamoon](https://github.com/shamoon) ([#2352](https://github.com/paperless-ngx/paperless-ngx/pull/2352))
+- Chore: Fixing up some minor annoyances [@stumpylog](https://github.com/stumpylog) ([#2348](https://github.com/paperless-ngx/paperless-ngx/pull/2348))
+- Bugfix: Removal of alpha channel truncates multipage TIFFs [@stumpylog](https://github.com/stumpylog) ([#2335](https://github.com/paperless-ngx/paperless-ngx/pull/2335))
+- Documentation: update build instructions to remove deprecated [@shamoon](https://github.com/shamoon) ([#2334](https://github.com/paperless-ngx/paperless-ngx/pull/2334))
+- Add Arabic language to frontend [@KhaledEmad7](https://github.com/KhaledEmad7) ([#2313](https://github.com/paperless-ngx/paperless-ngx/pull/2313))
+- Bump [@<!---->typescript-eslint/parser from 5.43.0 to 5.47.1 in /src-ui @dependabot](https://github.com/<!---->typescript-eslint/parser from 5.43.0 to 5.47.1 in /src-ui @dependabot) ([#2306](https://github.com/paperless-ngx/paperless-ngx/pull/2306))
+- Bump [@<!---->typescript-eslint/eslint-plugin from 5.43.0 to 5.47.1 in /src-ui @dependabot](https://github.com/<!---->typescript-eslint/eslint-plugin from 5.43.0 to 5.47.1 in /src-ui @dependabot) ([#2308](https://github.com/paperless-ngx/paperless-ngx/pull/2308))
+
+## paperless-ngx 1.11.3
+
+### Breaking Changes
+
+_Note: PR #2279 could represent a breaking change to the API which may affect third party applications that were only checking the `post_document` endpoint for e.g. result = 'OK' as opposed to e.g. HTTP status = 200_
+
+- Bugfix: Return created task ID when posting document to API [@stumpylog](https://github.com/stumpylog) ([#2279](https://github.com/paperless-ngx/paperless-ngx/pull/2279))
+
+### Bug Fixes
+
+- Bugfix: Fix no content when processing some RTL files [@stumpylog](https://github.com/stumpylog) ([#2295](https://github.com/paperless-ngx/paperless-ngx/pull/2295))
+- Bugfix: Handle email dates maybe being naive [@stumpylog](https://github.com/stumpylog) ([#2293](https://github.com/paperless-ngx/paperless-ngx/pull/2293))
+- Fix: live filterable dropdowns broken in 1.11.x [@shamoon](https://github.com/shamoon) ([#2292](https://github.com/paperless-ngx/paperless-ngx/pull/2292))
+- Bugfix: Reading environment from files didn't work for management commands [@stumpylog](https://github.com/stumpylog) ([#2261](https://github.com/paperless-ngx/paperless-ngx/pull/2261))
+- Bugfix: Return created task ID when posting document to API [@stumpylog](https://github.com/stumpylog) ([#2279](https://github.com/paperless-ngx/paperless-ngx/pull/2279))
+
+### All App Changes
+
+- Bugfix: Fix no content when processing some RTL files [@stumpylog](https://github.com/stumpylog) ([#2295](https://github.com/paperless-ngx/paperless-ngx/pull/2295))
+- Bugfix: Handle email dates maybe being naive [@stumpylog](https://github.com/stumpylog) ([#2293](https://github.com/paperless-ngx/paperless-ngx/pull/2293))
+- Fix: live filterable dropdowns broken in 1.11.x [@shamoon](https://github.com/shamoon) ([#2292](https://github.com/paperless-ngx/paperless-ngx/pull/2292))
+- Bugfix: Return created task ID when posting document to API [@stumpylog](https://github.com/stumpylog) ([#2279](https://github.com/paperless-ngx/paperless-ngx/pull/2279))
+
+## paperless-ngx 1.11.2
+
+Versions 1.11.1 and 1.11.2 contain bug fixes from v1.11.0 that prevented use of the new email consumption feature
+
+### Bug Fixes
+
+- Fix frontend mailrule missing consumption scope parameter [@shamoon](https://github.com/shamoon) ([#2280](https://github.com/paperless-ngx/paperless-ngx/pull/2280))
+- Fix: missing frontend email attachment options [@shamoon](https://github.com/shamoon) ([#2272](https://github.com/paperless-ngx/paperless-ngx/pull/2272))
+- Fix: edit dialog creation in v1.11.0 [@shamoon](https://github.com/shamoon) ([#2273](https://github.com/paperless-ngx/paperless-ngx/pull/2273))
+
+### All App Changes
+
+- Fix frontend mailrule missing consumption scope parameter [@shamoon](https://github.com/shamoon) ([#2280](https://github.com/paperless-ngx/paperless-ngx/pull/2280))
+- Fix: missing frontend email attachment options [@shamoon](https://github.com/shamoon) ([#2272](https://github.com/paperless-ngx/paperless-ngx/pull/2272))
+- Fix: edit dialog creation in v1.11.0 [@shamoon](https://github.com/shamoon) ([#2273](https://github.com/paperless-ngx/paperless-ngx/pull/2273))
+
+## paperless-ngx 1.11.0
+
+### Notable Changes
+
+- Feature: frontend paperless mail [@shamoon](https://github.com/shamoon) ([#2000](https://github.com/paperless-ngx/paperless-ngx/pull/2000))
+- Feature: Ability to consume mails and eml files [@p-h-a-i-l](https://github.com/p-h-a-i-l) ([#848](https://github.com/paperless-ngx/paperless-ngx/pull/848))
+
+### Features
+
+- Chore: Downgrade hiredis to 2.0.0 [@stumpylog](https://github.com/stumpylog) ([#2262](https://github.com/paperless-ngx/paperless-ngx/pull/2262))
+- Add ability to provide the configuration file path using an env variable [@hashworks](https://github.com/hashworks) ([#2241](https://github.com/paperless-ngx/paperless-ngx/pull/2241))
+- Feature: Adds option to allow a user to export directly to a zipfile [@stumpylog](https://github.com/stumpylog) ([#2004](https://github.com/paperless-ngx/paperless-ngx/pull/2004))
+- Feature: Adds PaperlessTask admin page interface [@stumpylog](https://github.com/stumpylog) ([#2184](https://github.com/paperless-ngx/paperless-ngx/pull/2184))
+- Feature: speed up frontend by truncating content [@shamoon](https://github.com/shamoon) ([#2028](https://github.com/paperless-ngx/paperless-ngx/pull/2028))
+- Feature: Allow bulk download API to follow file name formatting [@stumpylog](https://github.com/stumpylog) ([#2003](https://github.com/paperless-ngx/paperless-ngx/pull/2003))
+- Feature: Bake NLTK into Docker image [@stumpylog](https://github.com/stumpylog) ([#2129](https://github.com/paperless-ngx/paperless-ngx/pull/2129))
+- Feature: frontend paperless mail [@shamoon](https://github.com/shamoon) ([#2000](https://github.com/paperless-ngx/paperless-ngx/pull/2000))
+- Feature: Ability to consume mails and eml files [@p-h-a-i-l](https://github.com/p-h-a-i-l) ([#848](https://github.com/paperless-ngx/paperless-ngx/pull/848))
+
+### Bug Fixes
+
+- Bugfix: Handle RTL languages better [@stumpylog](https://github.com/stumpylog) ([#1665](https://github.com/paperless-ngx/paperless-ngx/pull/1665))
+- Fixed typo in docs [@mendelk](https://github.com/mendelk) ([#2256](https://github.com/paperless-ngx/paperless-ngx/pull/2256))
+- Fix: support in advanced search, fix tags filter badge count for excluded [@shamoon](https://github.com/shamoon) ([#2205](https://github.com/paperless-ngx/paperless-ngx/pull/2205))
+- Bugfix: Don't run system checks on migrate [@stumpylog](https://github.com/stumpylog) ([#2183](https://github.com/paperless-ngx/paperless-ngx/pull/2183))
+- Bugfix: Decoding task signals could fail on datetime type [@stumpylog](https://github.com/stumpylog) ([#2058](https://github.com/paperless-ngx/paperless-ngx/pull/2058))
+
+### Documentation
+
+- Fixed typo in docs [@mendelk](https://github.com/mendelk) ([#2256](https://github.com/paperless-ngx/paperless-ngx/pull/2256))
+- Docs: More fixes and improvements [@tooomm](https://github.com/tooomm) ([#2203](https://github.com/paperless-ngx/paperless-ngx/pull/2203))
+- Docs: Fix leftover issues from conversion [@tooomm](https://github.com/tooomm) ([#2172](https://github.com/paperless-ngx/paperless-ngx/pull/2172))
+- Docs: Fix broken internal links [@tooomm](https://github.com/tooomm) ([#2165](https://github.com/paperless-ngx/paperless-ngx/pull/2165))
+- Update setup.md [@Weltraumschaf](https://github.com/Weltraumschaf) ([#2157](https://github.com/paperless-ngx/paperless-ngx/pull/2157))
+- Chore: Cleanup of new documentation [@stumpylog](https://github.com/stumpylog) ([#2137](https://github.com/paperless-ngx/paperless-ngx/pull/2137))
+- [Documentation] Add v1.10.2 changelog [@github-actions](https://github.com/github-actions) ([#2114](https://github.com/paperless-ngx/paperless-ngx/pull/2114))
+
+### Maintenance
+
+- Chore: Adds notable label for release drafter [@stumpylog](https://github.com/stumpylog) ([#2200](https://github.com/paperless-ngx/paperless-ngx/pull/2200))
+- Chore: Prevent forks from having failing CI runs by default [@tooomm](https://github.com/tooomm) ([#2166](https://github.com/paperless-ngx/paperless-ngx/pull/2166))
+- Chore: migrate to eslint [@shamoon](https://github.com/shamoon) ([#2199](https://github.com/paperless-ngx/paperless-ngx/pull/2199))
+- Feature: Adds PaperlessTask admin page interface [@stumpylog](https://github.com/stumpylog) ([#2184](https://github.com/paperless-ngx/paperless-ngx/pull/2184))
+- Chore: Changes qpdf to be cross compiled for large speed up [@stumpylog](https://github.com/stumpylog) ([#2181](https://github.com/paperless-ngx/paperless-ngx/pull/2181))
+- Chore: Decrease time to build pikepdf [@stumpylog](https://github.com/stumpylog) ([#2178](https://github.com/paperless-ngx/paperless-ngx/pull/2178))
+- Chore: Minor CI cleanups [@stumpylog](https://github.com/stumpylog) ([#2175](https://github.com/paperless-ngx/paperless-ngx/pull/2175))
+
+### All App Changes
+
+- Add ability to provide the configuration file path using an env variable [@hashworks](https://github.com/hashworks) ([#2241](https://github.com/paperless-ngx/paperless-ngx/pull/2241))
+- Fix: support in advanced search, fix tags filter badge count for excluded [@shamoon](https://github.com/shamoon) ([#2205](https://github.com/paperless-ngx/paperless-ngx/pull/2205))
+- Chore: migrate to eslint [@shamoon](https://github.com/shamoon) ([#2199](https://github.com/paperless-ngx/paperless-ngx/pull/2199))
+- Feature: Adds option to allow a user to export directly to a zipfile [@stumpylog](https://github.com/stumpylog) ([#2004](https://github.com/paperless-ngx/paperless-ngx/pull/2004))
+- Feature: Adds PaperlessTask admin page interface [@stumpylog](https://github.com/stumpylog) ([#2184](https://github.com/paperless-ngx/paperless-ngx/pull/2184))
+- Bugfix: Decoding task signals could fail on datetime type [@stumpylog](https://github.com/stumpylog) ([#2058](https://github.com/paperless-ngx/paperless-ngx/pull/2058))
+- Feature: speed up frontend by truncating content [@shamoon](https://github.com/shamoon) ([#2028](https://github.com/paperless-ngx/paperless-ngx/pull/2028))
+- Feature: Allow bulk download API to follow file name formatting [@stumpylog](https://github.com/stumpylog) ([#2003](https://github.com/paperless-ngx/paperless-ngx/pull/2003))
+- Feature: Bake NLTK into Docker image [@stumpylog](https://github.com/stumpylog) ([#2129](https://github.com/paperless-ngx/paperless-ngx/pull/2129))
+- Chore: Apply live testing backoff logic to new mail tests [@stumpylog](https://github.com/stumpylog) ([#2134](https://github.com/paperless-ngx/paperless-ngx/pull/2134))
+- Feature: frontend paperless mail [@shamoon](https://github.com/shamoon) ([#2000](https://github.com/paperless-ngx/paperless-ngx/pull/2000))
+- Feature: Ability to consume mails and eml files [@p-h-a-i-l](https://github.com/p-h-a-i-l) ([#848](https://github.com/paperless-ngx/paperless-ngx/pull/848))
+
+## paperless-ngx 1.10.2
+
+### Features
+
+- Take ownership of k8s-at-home Helm chart [@alexander-bauer](https://github.com/alexander-bauer) ([#1947](https://github.com/paperless-ngx/paperless-ngx/pull/1947))
+
+### Bug Fixes
+
+- Bugfix: Language code checks around two part languages [@stumpylog](https://github.com/stumpylog) ([#2112](https://github.com/paperless-ngx/paperless-ngx/pull/2112))
+- Bugfix: Redis socket compatibility didn't handle URLs with ports [@stumpylog](https://github.com/stumpylog) ([#2109](https://github.com/paperless-ngx/paperless-ngx/pull/2109))
+- Bugfix: Incompatible URL schemes for socket based Redis [@stumpylog](https://github.com/stumpylog) ([#2092](https://github.com/paperless-ngx/paperless-ngx/pull/2092))
+- Fix doc links in contributing [@tooomm](https://github.com/tooomm) ([#2102](https://github.com/paperless-ngx/paperless-ngx/pull/2102))
+
+### Documentation
+
+- Docs: Some more small MkDocs updates [@tooomm](https://github.com/tooomm) ([#2106](https://github.com/paperless-ngx/paperless-ngx/pull/2106))
+- Chore: Cleans up documentation links [@stumpylog](https://github.com/stumpylog) ([#2104](https://github.com/paperless-ngx/paperless-ngx/pull/2104))
+- Feature: Move docs to material-mkdocs [@shamoon](https://github.com/shamoon) ([#2067](https://github.com/paperless-ngx/paperless-ngx/pull/2067))
+- Chore: Add v1.10.1 changelong [@shamoon](https://github.com/shamoon) ([#2082](https://github.com/paperless-ngx/paperless-ngx/pull/2082))
+
+### Maintenance
+
+- Take ownership of k8s-at-home Helm chart [@alexander-bauer](https://github.com/alexander-bauer) ([#1947](https://github.com/paperless-ngx/paperless-ngx/pull/1947))
+
+### All App Changes
+
+- Bugfix: Language code checks around two part languages [@stumpylog](https://github.com/stumpylog) ([#2112](https://github.com/paperless-ngx/paperless-ngx/pull/2112))
+- Bugfix: Redis socket compatibility didn't handle URLs with ports [@stumpylog](https://github.com/stumpylog) ([#2109](https://github.com/paperless-ngx/paperless-ngx/pull/2109))
+- Bugfix: Incompatible URL schemes for socket based Redis [@stumpylog](https://github.com/stumpylog) ([#2092](https://github.com/paperless-ngx/paperless-ngx/pull/2092))
+
 ## paperless-ngx 1.10.1
 
 ### Features
@@ -961,11 +1509,10 @@ This is a maintenance release.
 
 !!! note
 
-The changed to the full text searching require you to reindex your
-documents. _The docker image does this automatically, you don't need to
-do anything._ To do this, execute the `document_index reindex`
-management command (see `administration-index`{.interpreted-text
-role="ref"}).
+    The changed to the full text searching require you to reindex your
+    documents. _The docker image does this automatically, you don't need to
+    do anything._ To do this, execute the `document_index reindex`
+    management command (see [Managing the document search index](/administration#index)).
 
 ### paperless-ng 1.3.2
 
@@ -1004,8 +1551,7 @@ This release contains new database migrations.
 - Changes
   - The REST API is versioned from this point onwards. This will
     allow me to make changes without breaking existing clients. See
-    the documentation about `api-versioning`{.interpreted-text
-    role="ref"} for details.
+    the documentation about [API versioning](/api#api-versioning) for details.
   - Added a color picker for tag colors.
   - Added the ability to use the filter for searching the document
     content as well.
@@ -1039,7 +1585,7 @@ This release contains new database migrations.
 - Changes to the OCRmyPDF integration
   - Added support for deskewing and automatic rotation of
     incorrectly rotated pages. This is enabled by default, see
-    `configuration-ocr`{.interpreted-text role="ref"}.
+    [OCR settings](/configuration#ocr).
   - Better support for encrypted files.
   - Better support for various other PDF files: Paperless will now
     attempt to force OCR with safe options when OCR fails with the
@@ -1066,7 +1612,7 @@ This release contains new database migrations.
 
 - Added a docker-specific configuration option to adjust the number of
   worker processes of the web server. See
-  `configuration-docker`{.interpreted-text role="ref"}.
+  [Docker options](/configuration#docker).
 - Some more memory usage optimizations.
 - Don't show inbox statistics if no inbox tag is defined.
 
@@ -1075,8 +1621,7 @@ This release contains new database migrations.
 - Always show top left corner of thumbnails, even for extra wide
   documents.
 - Added a management command for executing the sanity checker
-  directly. See `utilities-sanity-checker`{.interpreted-text
-  role="ref"}.
+  directly. See [management utilities](/administration#sanity-checker).
 - The weekly sanity check now reports messages in the log files.
 - Fixed an issue with the metadata tab not reporting anything in case
   of missing files.
@@ -1110,7 +1655,7 @@ This release contains new database migrations.
   management commands, since these also ensure that they're always
   executed as the paperless user and you're less likely to run into
   permission issues. See
-  `utilities-management-commands`{.interpreted-text role="ref"}.
+  [management commands](/administration#management-commands).
 
 ### paperless-ng 1.1.0
 
@@ -1135,7 +1680,7 @@ This release contains new database migrations.
   For status notifications and live updates to work, paperless now
   requires an [ASGI](https://asgi.readthedocs.io/en/latest/)-enabled
   web server. The docker images uses `gunicorn` and an ASGI-enabled
-  worker called [uvicorn](http://www.uvicorn.org/), and there is no
+  worker called [uvicorn](https://www.uvicorn.org/), and there is no
   need to configure anything.
 
   For bare metal installations, changes are required for the
@@ -1152,7 +1697,7 @@ This release contains new database migrations.
   status notifications.
 
   Apache `mod_wsgi` users, see
-  `this note <faq-mod_wsgi>`{.interpreted-text role="ref"}.
+  [this note](/faq#how-do-i-get-websocket-support-with-apache-mod_wsgi).
 
 - Paperless now offers suggestions for tags, correspondents and types
   on the document detail page.
@@ -1197,9 +1742,7 @@ bug reports coming in, I think that this is reasonably stable.
   - The document exporter locks the media directory and the database
     during execution to ensure that the resulting export is
     consistent.
-  - See the
-    `updated documentation <utilities-exporter>`{.interpreted-text
-    role="ref"} for more details.
+  - See the [updated documentation](/administration#exporter) for more details.
 - Other changes and additions
   - Added a language selector to the settings.
   - Added date format options to the settings.
@@ -1288,11 +1831,11 @@ paperless.
 - Thanks to [Jo Vandeginste](https://github.com/jovandeginste),
   Paperless has optional support for Office documents such as .docx,
   .doc, .odt and more.
-  - See the `configuration<configuration-tika>`{.interpreted-text
-    role="ref"} on how to enable this feature. This feature requires
-    two additional services (one for parsing Office documents and
-    metadata extraction and another for converting Office documents
-    to PDF), and is therefore not enabled on default installations.
+  - See the [Tika settings](/configuration#tika) on how to enable this
+    feature. This feature requires two additional services (one for
+    parsing Office documents and metadata extraction and another for
+    converting Office documents to PDF), and is therefore not enabled
+    on default installations.
   - As with all other documents, paperless converts Office documents
     to PDF and stores both the original as well as the archived PDF.
 - Dark mode
@@ -1368,15 +1911,14 @@ paperless.
 
 !!! note
 
-The bulk delete operations did not update the search index. Therefore,
-documents that you deleted remained in the index and caused the search
-to return messages about missing documents when searching. Further bulk
-operations will properly update the index.
+    The bulk delete operations did not update the search index. Therefore,
+    documents that you deleted remained in the index and caused the search
+    to return messages about missing documents when searching. Further bulk
+    operations will properly update the index.
 
-However, this change is not retroactive: If you used the delete method
-of the bulk editor, you need to reindex your search index by
-`running the management command document_index with the argument reindex <administration-index>`{.interpreted-text
-role="ref"}.
+    However, this change is not retroactive: If you used the delete method
+    of the bulk editor, you need to reindex your search index by
+    [running the management command `document_index` with the argument `reindex`](/administration#index).
 
 ### paperless-ng 0.9.9
 
@@ -1533,19 +2075,16 @@ primarily.
     edit page. If available, a dropdown menu will appear next to the
     download button.
   - Many of the configuration options regarding OCR have changed.
-    See `configuration-ocr`{.interpreted-text role="ref"} for
-    details.
+    See [OCR settings](/configuration#ocr) for details.
   - Paperless no longer guesses the language of your documents. It
     always uses the language that you specified with
     `PAPERLESS_OCR_LANGUAGE`. Be sure to set this to the language
     the majority of your documents are in. Multiple languages can be
     specified, but that requires more CPU time.
-  - The management command
-    `document_archiver <utilities-archiver>`{.interpreted-text
-    role="ref"} can be used to create archived versions for already
-    existing documents.
+  - The management command [`document_archiver`](/administration#archiver)
+    can be used to create archived versions for already existing documents.
 - Tags from consumption folder.
-  - Thanks to [jayme-github](http://github.com/jayme-github),
+  - Thanks to [jayme-github](https://github.com/jayme-github),
     paperless now consumes files from sub folders in the consumption
     folder and is able to assign tags based on the sub folders a
     document was found in. This can be configured with
@@ -1556,7 +2095,7 @@ primarily.
   - The endpoint for uploading documents now supports specifying
     custom titles, correspondents, tags and types. This can be used
     by clients to override the default behavior of paperless. See
-    `api-file_uploads`{.interpreted-text role="ref"}.
+    [POSTing documents](/api#file-uploads).
   - The document endpoint of API now serves documents in this form:
     - correspondents, document types and tags are referenced by
       their ID in the fields `correspondent`, `document_type` and
@@ -1590,16 +2129,14 @@ primarily.
   - Paperless now supports searching by tags, types and dates and
     correspondents. In order to have this applied to your existing
     documents, you need to perform a `document_index reindex`
-    management command (see `administration-index`{.interpreted-text
-    role="ref"}) that adds the data to the search index. You only
-    need to do this once, since the schema of the search index
-    changed. Paperless keeps the index updated after that whenever
-    something changes.
+    management command (see [document search index](/administration#index))
+    that adds the data to the search index. You only need to do this
+    once, since the schema of the search index changed. Paperless
+    keeps the index updated after that whenever something changes.
   - Paperless now has spelling corrections ("Did you mean") for
     miss-typed queries.
   - The documentation contains
-    `information about the query syntax <basic-searching>`{.interpreted-text
-    role="ref"}.
+    [information about the query syntax](/usage#basic-usage_searching).
 - Front end:
   - Clickable tags, correspondents and types allow quick filtering
     for related documents.
@@ -1660,10 +2197,8 @@ primarily.
 
 ### paperless-ng 0.9.0
 
-- **Deprecated:** GnuPG.
-  `See this note on the state of GnuPG in paperless-ng. <utilities-encyption>`{.interpreted-text
-  role="ref"} This features will most likely be removed in future
-  versions.
+- **Deprecated:** GnuPG. [See this note on the state of GnuPG in paperless-ng.](/administration#encryption)
+  This features will most likely be removed in future versions.
 - **Added:** New frontend. Features:
   - Single page application: It's much more responsive than the
     django admin pages.
@@ -1720,7 +2255,7 @@ primarily.
     uses PostgreSQL instead of SQLite. Username, database and
     password all default to `paperless` if not specified.
 - **Modified \[breaking\]:** document_retagger management command
-  rework. See `utilities-retagger`{.interpreted-text role="ref"} for
+  rework. See [Document retagger](/administration#retagger) for
   details. Replaces `document_correspondents` management command.
 - **Removed \[breaking\]:** Reminders.
 - **Removed:** All customizations made to the django admin pages.
@@ -1830,7 +2365,7 @@ primarily.
 ### 2.5.0
 
 - **New dependency**: Paperless now optimises thumbnail generation
-  with [optipng](http://optipng.sourceforge.net/), so you'll need to
+  with [optipng](https://optipng.sourceforge.net/), so you'll need to
   install that somewhere in your PATH or declare its location in
   `PAPERLESS_OPTIPNG_BINARY`. The Docker image has already been
   updated on the Docker Hub, so you just need to pull the latest one

docs/configuration.md

@@ -10,15 +10,15 @@ run paperless, these settings have to be defined in different places.
 - If you are running paperless on anything else, paperless will search
   for the configuration file in these locations and use the first one
   it finds:
-
-  ```
-  /path/to/paperless/paperless.conf
-  /etc/paperless.conf
-  /usr/local/etc/paperless.conf
-  ```
+  - The environment variable `PAPERLESS_CONFIGURATION_PATH`
+  - `/path/to/paperless/paperless.conf`
+  - `/etc/paperless.conf`
+  - `/usr/local/etc/paperless.conf`
 
 ## Required services
 
+### Redis Broker
+
 `PAPERLESS_REDIS=<url>`
 
 : This is required for processing scheduled tasks such as email
@@ -33,19 +33,21 @@ matcher.
     [More information on securing your Redis
     Instance](https://redis.io/docs/getting-started/#securing-redis).
 
-    Defaults to <redis://localhost:6379>.
+    Defaults to `redis://localhost:6379`.
+
+### Database
 
 `PAPERLESS_DBENGINE=<engine_name>`
 
 : Optional, gives the ability to choose Postgres or MariaDB for
-database engine. Available options are [postgresql]{.title-ref} and
-[mariadb]{.title-ref}.
+database engine. Available options are `postgresql` and
+`mariadb`.
 
-    Default is [postgresql]{.title-ref}.
+    Default is `postgresql`.
 
     !!! warning
 
-        Using MariaDB comes with some caveats. See [MySQL Caveats](advanced_usage#mysql-caveats).
+        Using MariaDB comes with some caveats. See [MySQL Caveats](/advanced_usage#mysql-caveats).
 
 `PAPERLESS_DBHOST=<hostname>`
 
@@ -88,6 +90,36 @@ changed here.
 
     Default is `prefer`.
 
+`PAPERLESS_DBSSLROOTCERT=<ca-path>`
+
+: SSL root certificate path
+
+    See [the official documentation about
+    sslmode](https://www.postgresql.org/docs/current/libpq-ssl.html).
+    Changes path of `root.crt`.
+
+    Defaults to unset, using the documented path in the home directory.
+
+`PAPERLESS_DBSSLCERT=<client-cert-path>`
+
+: SSL client certificate path
+
+    See [the official documentation about
+    sslmode](https://www.postgresql.org/docs/current/libpq-ssl.html).
+    Changes path of `postgresql.crt`.
+
+    Defaults to unset, using the documented path in the home directory.
+
+`PAPERLESS_DBSSLKEY=<client-cert-key>`
+
+: SSL client key path
+
+    See [the official documentation about
+    sslmode](https://www.postgresql.org/docs/current/libpq-ssl.html).
+    Changes path of `postgresql.key`.
+
+    Defaults to unset, using the documented path in the home directory.
+
 `PAPERLESS_DB_TIMEOUT=<float>`
 
 : Amount of time for a database connection to wait for the database to
@@ -96,6 +128,47 @@ changing to postgresql if you need to increase this.
 
     Defaults to unset, keeping the Django defaults.
 
+## Optional Services
+
+### Tika {#tika}
+
+Paperless can make use of [Tika](https://tika.apache.org/) and
+[Gotenberg](https://gotenberg.dev/) for parsing and converting
+"Office" documents (such as ".doc", ".xlsx" and ".odt").
+Tika and Gotenberg are also needed to allow parsing of E-Mails (.eml).
+
+If you wish to use this, you must provide a Tika server and a Gotenberg server,
+configure their endpoints, and enable the feature.
+
+`PAPERLESS_TIKA_ENABLED=<bool>`
+
+: Enable (or disable) the Tika parser.
+
+    Defaults to false.
+
+`PAPERLESS_TIKA_ENDPOINT=<url>`
+
+: Set the endpoint URL were Paperless can reach your Tika server.
+
+    Defaults to "<http://localhost:9998>".
+
+`PAPERLESS_TIKA_GOTENBERG_ENDPOINT=<url>`
+
+: Set the endpoint URL were Paperless can reach your Gotenberg server.
+
+    Defaults to "<http://localhost:3000>".
+
+If you run paperless on docker, you can add those services to the
+docker-compose file (see the provided
+[`docker-compose.sqlite-tika.yml`](https://github.com/paperless-ngx/paperless-ngx/blob/main/docker/compose/docker-compose.sqlite-tika.yml)
+file for reference).
+
+Add all three configuration parameters to your configuration. If using
+Docker, this may be the `environment` key of the webserver or a
+`docker-compose.env` file. Bare metal installations may have a `.conf` file
+containing the configuration parameters. Be sure to use the correct format
+and watch out for indentation if editing the YAML file.
+
 ## Paths and folders
 
 `PAPERLESS_CONSUMPTION_DIR=<path>`
@@ -143,32 +216,46 @@ directory.
 files created using "collectstatic" manager command are stored.
 
     Unless you're doing something fancy, there is no need to override
-    this.
+    this.  If this is changed, you may need to run
+    `collectstatic` again.
 
     Defaults to "../static/", relative to the "src" directory.
 
 `PAPERLESS_FILENAME_FORMAT=<format>`
 
 : Changes the filenames paperless uses to store documents in the media
-directory. See [File name handling](advanced_usage#file_name_handling) for details.
+directory. See [File name handling](/advanced_usage#file-name-handling) for details.
 
     Default is none, which disables this feature.
 
 `PAPERLESS_FILENAME_FORMAT_REMOVE_NONE=<bool>`
 
 : Tells paperless to replace placeholders in
-[PAPERLESS_FILENAME_FORMAT]{.title-ref} that would resolve to
+`PAPERLESS_FILENAME_FORMAT` that would resolve to
 'none' to be omitted from the resulting filename. This also holds
-true for directory names. See [File name handling](advanced_usage#file_name_handling) for
+true for directory names. See [File name handling](/advanced_usage#file-name-handling) for
 details.
 
-    Defaults to [false]{.title-ref} which disables this feature.
+    Defaults to `false` which disables this feature.
 
 `PAPERLESS_LOGGING_DIR=<path>`
 
 : This is where paperless will store log files.
 
-    Defaults to "`PAPERLESS_DATA_DIR`/log/".
+    Defaults to `PAPERLESS_DATA_DIR/log/`.
+
+`PAPERLESS_NLTK_DIR=<path>`
+
+: This is where paperless will search for the data required for NLTK
+processing, if you are using it. If you are using the Docker image,
+this should not be changed, as the data is included in the image
+already.
+
+Previously, the location defaulted to `PAPERLESS_DATA_DIR/nltk`.
+Unless you are using this in a bare metal install or other setup,
+this folder is no longer needed and can be removed manually.
+
+Defaults to `/usr/share/nltk_data`
 
 ## Logging
 
@@ -206,12 +293,16 @@ not include a trailing slash. E.g. <https://paperless.domain.com>
 
     Defaults to empty string, leaving the other settings unaffected.
 
+    !!! note
+
+        This value cannot contain a path (e.g. domain.com/path), even if
+        you are installing paperless-ngx at a subpath.
+
 `PAPERLESS_CSRF_TRUSTED_ORIGINS=<comma-separated-list>`
 
 : A list of trusted origins for unsafe requests (e.g. POST). As of
 Django 4.0 this is required to access the Django admin via the web.
-See
-<https://docs.djangoproject.com/en/4.0/ref/settings/#csrf-trusted-origins>
+See the [Django project documentation on the settings](https://docs.djangoproject.com/en/4.1/ref/settings/#csrf-trusted-origins)
 
     Can also be set using PAPERLESS_URL (see above).
 
@@ -222,8 +313,8 @@ See
 
 : If you're planning on putting Paperless on the open internet, then
 you really should set this value to the domain name you're using.
-Failing to do so leaves you open to HTTP host header attacks:
-<https://docs.djangoproject.com/en/3.1/topics/security/#host-header-validation>
+Failing to do so leaves you open to HTTP host header attacks.
+You can read more about this in [the Django project's documentation](https://docs.djangoproject.com/en/4.1/topics/security/#host-header-validation)
 
     Just remember that this is a comma-separated list, so
     "example.com" is fine, as is "example.com,www.example.com", but
@@ -245,6 +336,14 @@ do CORS calls. Set this to your public domain name.
 
     Defaults to "<http://localhost:8000>".
 
+`PAPERLESS_TRUSTED_PROXIES=<comma-separated-list>`
+
+: This may be needed to prevent IP address spoofing if you are using e.g.
+fail2ban with log entries for failed authorization attempts. Value should be
+IP address(es).
+
+    Defaults to empty string.
+
 `PAPERLESS_FORCE_SCRIPT_NAME=<path>`
 
 : To host paperless under a subpath url like example.com/paperless you
@@ -283,10 +382,10 @@ login with the selected user.
 : If this environment variable is specified, Paperless automatically
 creates a superuser with the provided username at start. This is
 useful in cases where you can not run the
-[createsuperuser]{.title-ref} command separately, such as Kubernetes
+`createsuperuser` command separately, such as Kubernetes
 or AWS ECS.
 
-    Requires [PAPERLESS_ADMIN_PASSWORD]{.title-ref} to be set.
+    Requires PAPERLESS_ADMIN_PASSWORD be set.
 
     !!! note
 
@@ -297,13 +396,13 @@ or AWS ECS.
 `PAPERLESS_ADMIN_MAIL=<email>`
 
 : (Optional) Specify superuser email address. Only used when
-[PAPERLESS_ADMIN_USER]{.title-ref} is set.
+PAPERLESS_ADMIN_USER is set.
 
     Defaults to `root@localhost`.
 
 `PAPERLESS_ADMIN_PASSWORD=<password>`
 
-: Only used when [PAPERLESS_ADMIN_USER]{.title-ref} is set. This will
+: Only used when PAPERLESS_ADMIN_USER is set. This will
 be the password of the automatically created superuser.
 
 `PAPERLESS_COOKIE_PREFIX=<str>`
@@ -331,30 +430,56 @@ applications.
         If you're exposing paperless to the internet directly, do not use
         this.
 
-        Also see the warning [in the official documentation
-        <https://docs.djangoproject.com/en/3.1/howto/auth-remote-user/#configuration>]{.title-ref}.
+        Also see the warning [in the official documentation](https://docs.djangoproject.com/en/4.1/howto/auth-remote-user/#configuration).
 
-    Defaults to [false]{.title-ref} which disables this feature.
+    Defaults to "false" which disables this feature.
 
 `PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME=<str>`
 
-: If [PAPERLESS_ENABLE_HTTP_REMOTE_USER]{.title-ref} is enabled, this
+: If "PAPERLESS_ENABLE_HTTP_REMOTE_USER" is enabled, this
 property allows to customize the name of the HTTP header from which
 the authenticated username is extracted. Values are in terms of
-\[HttpRequest.META\](<https://docs.djangoproject.com/en/3.1/ref/request-response/#django.http.HttpRequest.META>).
-Thus, the configured value must start with [HTTP\_]{.title-ref}
+[HttpRequest.META](https://docs.djangoproject.com/en/4.1/ref/request-response/#django.http.HttpRequest.META).
+Thus, the configured value must start with `HTTP*`
 followed by the normalized actual header name.
 
-    Defaults to [HTTP_REMOTE_USER]{.title-ref}.
+    Defaults to "HTTP_REMOTE_USER".
 
 `PAPERLESS_LOGOUT_REDIRECT_URL=<str>`
 
 : URL to redirect the user to after a logout. This can be used
-together with [PAPERLESS_ENABLE_HTTP_REMOTE_USER]{.title-ref} to
+together with PAPERLESS_ENABLE_HTTP_REMOTE_USER to
 redirect the user back to the SSO application's logout page.
 
     Defaults to None, which disables this feature.
 
+`PAPERLESS_USE_X_FORWARD_HOST=<bool>`
+
+: Configures the Django setting [USE_X_FORWARDED_HOST](https://docs.djangoproject.com/en/4.2/ref/settings/#use-x-forwarded-host)
+which may be needed for hosting behind a proxy.
+
+    Defaults to False
+
+`PAPERLESS_USE_X_FORWARD_PORT=<bool>`
+
+: Configures the Django setting [USE_X_FORWARDED_PORT](https://docs.djangoproject.com/en/4.2/ref/settings/#use-x-forwarded-port)
+which may be needed for hosting behind a proxy.
+
+    Defaults to False
+
+`PAPERLESS_PROXY_SSL_HEADER=<json-list>`
+
+: Configures the Django setting [SECURE_PROXY_SSL_HEADER](https://docs.djangoproject.com/en/4.2/ref/settings/#secure-proxy-ssl-header)
+which may be needed for hosting behind a proxy. The two values in the list will form the tuple of
+HTTP header/value expected by Django, eg `'["HTTP_X_FORWARDED_PROTO", "https"]'`.
+
+    Defaults to None
+
+!!! warning
+
+    Settings this value has security implications.  Read the Django documentation
+    and be sure you understand its usage before setting it.
+
 ## OCR settings {#ocr}
 
 Paperless uses [OCRmyPDF](https://ocrmypdf.readthedocs.io/en/latest/)
@@ -367,21 +492,20 @@ needs.
 : Customize the language that paperless will attempt to use when
 parsing documents.
 
-    It should be a 3-letter language code consistent with ISO 639:
-    <https://www.loc.gov/standards/iso639-2/php/code_list.php>
+    It should be a 3-letter code, see the list of [languages Tesseract supports](https://tesseract-ocr.github.io/tessdoc/Data-Files-in-different-versions.html).
 
     Set this to the language most of your documents are written in.
 
     This can be a combination of multiple languages such as `deu+eng`,
-    in which case tesseract will use whatever language matches best.
-    Keep in mind that tesseract uses much more cpu time with multiple
+    in which case Tesseract will use whatever language matches best.
+    Keep in mind that Tesseract uses much more CPU time with multiple
     languages enabled.
 
     Defaults to "eng".
 
     !!! note
 
-        If your language contains a '-' such as chi-sim, you must use chi_sim
+        If your language contains a '-' such as chi-sim, you must use `chi_sim`.
 
 `PAPERLESS_OCR_MODE=<mode>`
 
@@ -391,12 +515,6 @@ modes are available:
     -   `skip`: Paperless skips all pages and will perform ocr only on
         pages where no text is present. This is the safest option.
 
-    -   `skip_noarchive`: In addition to skip, paperless won't create
-        an archived version of your documents when it finds any text in
-        them. This is useful if you don't want to have two
-        almost-identical versions of your digital documents in the media
-        folder. This is the fastest option.
-
     -   `redo`: Paperless will OCR all pages of your documents and
         attempt to replace any existing text layers with new text. This
         will be useful for documents from scanners that already
@@ -419,6 +537,19 @@ modes are available:
     Read more about this in the [OCRmyPDF
     documentation](https://ocrmypdf.readthedocs.io/en/latest/advanced.html#when-ocr-is-skipped).
 
+`PAPERLESS_OCR_SKIP_ARCHIVE_FILE=<mode>`
+
+: Specify when you would like paperless to skip creating an archived
+version of your documents. This is useful if you don't want to have two
+almost-identical versions of your documents in the media folder.
+
+    -   `never`: Never skip creating an archived version.
+    -   `with_text`: Skip creating an archived version for documents
+    that already have embedded text.
+    -   `always`: Always skip creating an archived version.
+
+    The default is `never`.
+
 `PAPERLESS_OCR_CLEAN=<mode>`
 
 : Tells paperless to use `unpaper` to clean any input document before
@@ -561,72 +692,6 @@ they use underscores instead of dashes.
     {"deskew": true, "optimize": 3, "unpaper_args": "--pre-rotate 90"}
     ```
 
-## Tika settings {#tika}
-
-Paperless can make use of [Tika](https://tika.apache.org/) and
-[Gotenberg](https://gotenberg.dev/) for parsing and converting
-"Office" documents (such as ".doc", ".xlsx" and ".odt"). If you
-wish to use this, you must provide a Tika server and a Gotenberg server,
-configure their endpoints, and enable the feature.
-
-`PAPERLESS_TIKA_ENABLED=<bool>`
-
-: Enable (or disable) the Tika parser.
-
-    Defaults to false.
-
-`PAPERLESS_TIKA_ENDPOINT=<url>`
-
-: Set the endpoint URL were Paperless can reach your Tika server.
-
-    Defaults to "<http://localhost:9998>".
-
-`PAPERLESS_TIKA_GOTENBERG_ENDPOINT=<url>`
-
-: Set the endpoint URL were Paperless can reach your Gotenberg server.
-
-    Defaults to "<http://localhost:3000>".
-
-If you run paperless on docker, you can add those services to the
-docker-compose file (see the provided `docker-compose.sqlite-tika.yml`
-file for reference). The changes requires are as follows:
-
-```yaml
-services:
-  # ...
-
-  webserver:
-    # ...
-
-    environment:
-      # ...
-
-      PAPERLESS_TIKA_ENABLED: 1
-      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
-      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
-
-  # ...
-
-  gotenberg:
-    image: gotenberg/gotenberg:7.6
-    restart: unless-stopped
-    command:
-      - 'gotenberg'
-      - '--chromium-disable-routes=true'
-
-  tika:
-    image: ghcr.io/paperless-ngx/tika:latest
-    restart: unless-stopped
-```
-
-Add the configuration variables to the environment of the webserver
-(alternatively put the configuration in the `docker-compose.env` file)
-and add the additional services below the webserver service. Watch out
-for indentation.
-
-Make sure to use the correct format [PAPERLESS_TIKA_ENABLED =
-1]{.title-ref} so python_dotenv can parse the statement correctly.
-
 ## Software tweaks {#software_tweaks}
 
 `PAPERLESS_TASK_WORKERS=<num>`
@@ -648,7 +713,7 @@ paperless will process in parallel on a single document.
 
         Ensure that the product
 
-        `PAPERLESS_TASK_WORKERS \:   PAPERLESS_THREADS_PER_WORKER`
+        `PAPERLESS_TASK_WORKERS * PAPERLESS_THREADS_PER_WORKER`
 
         does not exceed your CPU core count or else paperless will be
         extremely slow. If you want paperless to process many documents in
@@ -660,7 +725,7 @@ paperless will process in parallel on a single document.
     count, with a slight favor towards threads per worker:
 
     | CPU core count | Workers | Threads |
-    |----------------|---------|---------|
+    | -------------- | ------- | ------- |
     | > 1            | > 1     | > 1     |
     | > 2            | > 2     | > 1     |
     | > 4            | > 2     | > 2     |
@@ -678,124 +743,70 @@ paperless will process in parallel on a single document.
 on large documents within the default 1800 seconds. So extending
 this timeout may prove to be useful on weak hardware setups.
 
-`PAPERLESS_WORKER_RETRY=<num>`
-
-: If PAPERLESS_WORKER_TIMEOUT has been configured, the retry time for
-a task can also be configured. By default, this value will be set to
-10s more than the worker timeout. This value should never be set
-less than the worker timeout.
-
 `PAPERLESS_TIME_ZONE=<timezone>`
 
-: Set the time zone here. See
-<https://docs.djangoproject.com/en/3.1/ref/settings/#std:setting-TIME_ZONE>
+: Set the time zone here. See more details on
+why and how to set it [in the Django project documentation](https://docs.djangoproject.com/en/4.1/ref/settings/#std:setting-TIME_ZONE)
 for details on how to set it.
 
     Defaults to UTC.
 
-## Polling {#polling}
+`PAPERLESS_ENABLE_NLTK=<bool>`
 
-`PAPERLESS_CONSUMER_POLLING=<num>`
+: Enables or disables the advanced natural language processing
+used during automatic classification. If disabled, paperless will
+still perform some basic text pre-processing before matching.
 
-: If paperless won't find documents added to your consume folder, it
-might not be able to automatically detect filesystem changes. In
-that case, specify a polling interval in seconds here, which will
-then cause paperless to periodically check your consumption
-directory for changes. This will also disable listening for file
-system changes with `inotify`.
+: See also `PAPERLESS_NLTK_DIR`.
 
-    Defaults to 0, which disables polling and uses filesystem
-    notifications.
+    Defaults to 1.
 
-`PAPERLESS_CONSUMER_POLLING_RETRY_COUNT=<num>`
+`PAPERLESS_EMAIL_TASK_CRON=<cron expression>`
 
-: If consumer polling is enabled, sets the number of times paperless
-will check for a file to remain unmodified.
+: Configures the scheduled email fetching frequency. The value
+should be a valid crontab(5) expression describing when to run.
 
-    Defaults to 5.
+: If set to the string "disable", no emails will be fetched automatically.
 
-`PAPERLESS_CONSUMER_POLLING_DELAY=<num>`
+    Defaults to `*/10 * * * *` or every ten minutes.
 
-: If consumer polling is enabled, sets the delay in seconds between
-each check (above) paperless will do while waiting for a file to
-remain unmodified.
+`PAPERLESS_TRAIN_TASK_CRON=<cron expression>`
 
-    Defaults to 5.
+: Configures the scheduled automatic classifier training frequency. The value
+should be a valid crontab(5) expression describing when to run.
 
-## iNotify {#inotify}
+: If set to the string "disable", the classifier will not be trained automatically.
 
-`PAPERLESS_CONSUMER_INOTIFY_DELAY=<num>`
+    Defaults to `5 */1 * * *` or every hour at 5 minutes past the hour.
 
-: Sets the time in seconds the consumer will wait for additional
-events from inotify before the consumer will consider a file ready
-and begin consumption. Certain scanners or network setups may
-generate multiple events for a single file, leading to multiple
-consumers working on the same file. Configure this to prevent that.
+`PAPERLESS_INDEX_TASK_CRON=<cron expression>`
 
-    Defaults to 0.5 seconds.
+: Configures the scheduled search index update frequency. The value
+should be a valid crontab(5) expression describing when to run.
 
-`PAPERLESS_CONSUMER_DELETE_DUPLICATES=<bool>`
+: If set to the string "disable", the search index will not be automatically updated.
 
-: When the consumer detects a duplicate document, it will not touch
-the original document. This default behavior can be changed here.
+    Defaults to `0 0 * * *` or daily at midnight.
 
-    Defaults to false.
+`PAPERLESS_SANITY_TASK_CRON=<cron expression>`
 
-`PAPERLESS_CONSUMER_RECURSIVE=<bool>`
+: Configures the scheduled sanity checker frequency.
 
-: Enable recursive watching of the consumption directory. Paperless
-will then pickup files from files in subdirectories within your
-consumption directory as well.
+: If set to the string "disable", the sanity checker will not run automatically.
 
-    Defaults to false.
+    Defaults to `30 0 * * sun` or Sunday at 30 minutes past midnight.
 
-`PAPERLESS_CONSUMER_SUBDIRS_AS_TAGS=<bool>`
+`PAPERLESS_ENABLE_COMPRESSION=<bool>`
 
-: Set the names of subdirectories as tags for consumed files. E.g.
-<CONSUMPTION_DIR>/foo/bar/file.pdf will add the tags "foo" and
-"bar" to the consumed file. Paperless will create any tags that
-don't exist yet.
+: Enables compression of the responses from the webserver.
 
-    This is useful for sorting documents with certain tags such as `car`
-    or `todo` prior to consumption. These folders won't be deleted.
+: Defaults to 1, enabling compression.
 
-    PAPERLESS_CONSUMER_RECURSIVE must be enabled for this to work.
+    !!! note
 
-    Defaults to false.
-
-`PAPERLESS_CONSUMER_ENABLE_BARCODES=<bool>`
-
-: Enables the scanning and page separation based on detected barcodes.
-This allows for scanning and adding multiple documents per uploaded
-file, which are separated by one or multiple barcode pages.
-
-    For ease of use, it is suggested to use a standardized separation
-    page, e.g. [here](https://www.alliancegroup.co.uk/patch-codes.htm).
-
-    If no barcodes are detected in the uploaded file, no page separation
-    will happen.
-
-    The original document will be removed and the separated pages will
-    be saved as pdf.
-
-    Defaults to false.
-
-`PAPERLESS_CONSUMER_BARCODE_TIFF_SUPPORT=<bool>`
-
-: Whether TIFF image files should be scanned for barcodes. This will
-automatically convert any TIFF image(s) to pdfs for later
-processing. This only has an effect, if
-PAPERLESS_CONSUMER_ENABLE_BARCODES has been enabled.
-
-    Defaults to false.
-
-PAPERLESS_CONSUMER_BARCODE_STRING=PATCHT
-
-: Defines the string to be detected as a separator barcode. If
-paperless is used with the PATCH-T separator pages, users shouldn't
-change this.
-
-    Defaults to "PATCHT"
+        If you are using a proxy such as nginx, it is likely more efficient
+        to enable compression in your proxy configuration rather than
+        the webserver
 
 `PAPERLESS_CONVERT_MEMORY_LIMIT=<num>`
 
@@ -823,11 +834,82 @@ documents.
 
     Default is none, which disables the temporary directory.
 
+## Document Consumption {#consume_config}
+
+`PAPERLESS_CONSUMER_DELETE_DUPLICATES=<bool>`
+
+: When the consumer detects a duplicate document, it will not touch
+the original document. This default behavior can be changed here.
+
+    Defaults to false.
+
+`PAPERLESS_CONSUMER_RECURSIVE=<bool>`
+
+: Enable recursive watching of the consumption directory. Paperless
+will then pickup files from files in subdirectories within your
+consumption directory as well.
+
+    Defaults to false.
+
+`PAPERLESS_CONSUMER_SUBDIRS_AS_TAGS=<bool>`
+
+: Set the names of subdirectories as tags for consumed files. E.g.
+`<CONSUMPTION_DIR>/foo/bar/file.pdf` will add the tags "foo" and
+"bar" to the consumed file. Paperless will create any tags that
+don't exist yet.
+
+    This is useful for sorting documents with certain tags such as `car`
+    or `todo` prior to consumption. These folders won't be deleted.
+
+    PAPERLESS_CONSUMER_RECURSIVE must be enabled for this to work.
+
+    Defaults to false.
+
+`PAPERLESS_CONSUMER_IGNORE_PATTERNS=<json>`
+
+: By default, paperless ignores certain files and folders in the
+consumption directory, such as system files created by the Mac OS
+or hidden folders some tools use to store data.
+
+    This can be adjusted by configuring a custom json array with
+    patterns to exclude.
+
+    For example, `.DS_STORE/*` will ignore any files found in a folder
+    named `.DS_STORE`, including `.DS_STORE/bar.pdf` and `foo/.DS_STORE/bar.pdf`
+
+    A pattern like `._*` will ignore anything starting with `._`, including:
+    `._foo.pdf` and `._bar/foo.pdf`
+
+    Defaults to
+    `[".DS_STORE/*", "._*", ".stfolder/*", ".stversions/*", ".localized/*", "desktop.ini", "@eaDir/*"]`.
+
+`PAPERLESS_CONSUMER_BARCODE_SCANNER=<string>`
+
+: Sets the barcode scanner used for barcode functionality.
+
+    Currently, "PYZBAR" (the default) or "ZXING" might be selected.
+    If you have problems that your Barcodes/QR-Codes are not detected
+    (especially with bad scan quality and/or small codes), try the other one.
+
+    zxing is not available on all platforms.
+
+`PAPERLESS_PRE_CONSUME_SCRIPT=<filename>`
+
+: After some initial validation, Paperless can trigger an arbitrary
+script if you like before beginning consumption. This script will be provided
+data for it to work with via the environment.
+
+    For more information, take a look at [pre-consumption script](/advanced_usage#pre-consume-script).
+
+    The default is blank, which means nothing will be executed.
+
 `PAPERLESS_POST_CONSUME_SCRIPT=<filename>`
 
 : After a document is consumed, Paperless can trigger an arbitrary
-script if you like. This script will be passed a number of arguments
-for you to work with. For more information, take a look at [Post-consumption script](advanced_usage#post_consume_script).
+script if you like. This script will be provided
+data for it to work with via the environment.
+
+    For more information, take a look at [Post-consumption script](/advanced_usage#post-consume-script).
 
     The default is blank, which means nothing will be executed.
 
@@ -841,8 +923,7 @@ option as specified in
 The filename will be checked first, and if nothing is found, the
 document text will be checked as normal.
 
-    A date in a filename must have some separators ([.]{.title-ref},
-    [-]{.title-ref}, [/]{.title-ref}, etc) for it to be parsed.
+    A date in a filename must have some separators (`.`, `,`, `-`, `/`, etc) for it to be parsed.
 
     Defaults to none, which disables this feature.
 
@@ -895,16 +976,109 @@ within your documents.
     second, and year last order. Characters D, M, or Y can be shuffled
     to meet the required order.
 
-`PAPERLESS_CONSUMER_IGNORE_PATTERNS=<json>`
+### Polling {#polling}
 
-: By default, paperless ignores certain files and folders in the
-consumption directory, such as system files created by the Mac OS.
+`PAPERLESS_CONSUMER_POLLING=<num>`
 
-    This can be adjusted by configuring a custom json array with
-    patterns to exclude.
+: If paperless won't find documents added to your consume folder, it
+might not be able to automatically detect filesystem changes. In
+that case, specify a polling interval in seconds here, which will
+then cause paperless to periodically check your consumption
+directory for changes. This will also disable listening for file
+system changes with `inotify`.
 
-    Defaults to
-    `[".DS_STORE/*", "._*", ".stfolder/*", ".stversions/*", ".localized/*", "desktop.ini"]`.
+    Defaults to 0, which disables polling and uses filesystem
+    notifications.
+
+`PAPERLESS_CONSUMER_POLLING_RETRY_COUNT=<num>`
+
+: If consumer polling is enabled, sets the number of times paperless
+will check for a file to remain unmodified.
+
+    Defaults to 5.
+
+`PAPERLESS_CONSUMER_POLLING_DELAY=<num>`
+
+: If consumer polling is enabled, sets the delay in seconds between
+each check (above) paperless will do while waiting for a file to
+remain unmodified.
+
+    Defaults to 5.
+
+### iNotify {#inotify}
+
+`PAPERLESS_CONSUMER_INOTIFY_DELAY=<num>`
+
+: Sets the time in seconds the consumer will wait for additional
+events from inotify before the consumer will consider a file ready
+and begin consumption. Certain scanners or network setups may
+generate multiple events for a single file, leading to multiple
+consumers working on the same file. Configure this to prevent that.
+
+    Defaults to 0.5 seconds.
+
+## Barcodes {#barcodes}
+
+`PAPERLESS_CONSUMER_ENABLE_BARCODES=<bool>`
+
+: Enables the scanning and page separation based on detected barcodes.
+This allows for scanning and adding multiple documents per uploaded
+file, which are separated by one or multiple barcode pages.
+
+    For ease of use, it is suggested to use a standardized separation
+    page, e.g. [here](https://www.alliancegroup.co.uk/patch-codes.htm).
+
+    If no barcodes are detected in the uploaded file, no page separation
+    will happen.
+
+    The original document will be removed and the separated pages will
+    be saved as pdf.
+
+    See additional information in the [advanced usage documentation](/advanced_usage#barcodes)
+
+    Defaults to false.
+
+`PAPERLESS_CONSUMER_BARCODE_TIFF_SUPPORT=<bool>`
+
+: Whether TIFF image files should be scanned for barcodes. This will
+automatically convert any TIFF image(s) to pdfs for later
+processing. This only has an effect, if
+PAPERLESS_CONSUMER_ENABLE_BARCODES has been enabled.
+
+    Defaults to false.
+
+`PAPERLESS_CONSUMER_BARCODE_STRING=<string>`
+
+: Defines the string to be detected as a separator barcode. If
+paperless is used with the PATCH-T separator pages, users shouldn't
+change this.
+
+    Defaults to "PATCHT"
+
+`PAPERLESS_CONSUMER_ENABLE_ASN_BARCODE=<bool>`
+
+: Enables the detection of barcodes in the scanned document and
+setting the ASN (archive serial number) if a properly formatted
+barcode is detected.
+
+    The barcode must consist of a (configurable) prefix and the ASN
+    to be set, for instance `ASN00123`.
+
+    This option is compatible with barcode page separation, since
+    pages will be split up before reading the ASN.
+
+    If no ASN barcodes are detected in the uploaded file, no ASN will
+    be set. If a barcode with an existing ASN is detected, the
+    document will not be consumed and an error logged.
+
+    Defaults to false.
+
+`PAPERLESS_CONSUMER_ASN_BARCODE_PREFIX=<string>`
+
+: Defines the prefix that is used to identify a barcode as an ASN
+barcode.
+
+    Defaults to "ASN"
 
 ## Binaries
 
@@ -928,7 +1102,7 @@ the literal path for that program.
 
 These options don't have any effect in `paperless.conf`. These options
 adjust the behavior of the docker container. Configure these in
-[docker-compose.env]{.title-ref}.
+`docker-compose.env`.
 
 `PAPERLESS_WEBSERVER_WORKERS=<num>`
 
@@ -946,7 +1120,7 @@ increase RAM usage.
 There are special setups where you may need to configure this value
 to restrict the Ip address or interface the webserver listens on.
 
-    Defaults to \[::\], meaning all interfaces, including IPv6.
+    Defaults to `[::]`, meaning all interfaces, including IPv6.
 
 `PAPERLESS_PORT=<port>`
 
@@ -996,12 +1170,17 @@ actual group ID on the host system, which you can get by executing
 : Additional OCR languages to install. By default, paperless comes
 with English, German, Italian, Spanish and French. If your language
 is not in this list, install additional languages with this
-configuration option:
+configuration option. You will need to [find the right LangCodes](https://tesseract-ocr.github.io/tessdoc/Data-Files-in-different-versions.html)
+but note that (tesseract-ocr-\* package names)[https://packages.debian.org/bullseye/graphics/]
+do not always correspond with the language codes e.g. "chi_tra" should be
+specified as "chi-tra".
 
     ``` bash
-    PAPERLESS_OCR_LANGUAGES=tur ces
+    PAPERLESS_OCR_LANGUAGES=tur ces chi-tra
     ```
 
+    Make sure it's a space separated list when using several values.
+
     To actually use these languages, also set the default OCR language
     of paperless:
 
@@ -1017,7 +1196,7 @@ configuration option:
 [Flower](https://flower.readthedocs.io/en/latest/index.html) will be
 started by the container.
 
-    You can read more about this in the [advanced documentation](advanced#celery-monitoring).
+    You can read more about this in the [advanced documentation](/advanced_usage#celery-monitoring).
 
 ## Update Checking {#update-checking}
 

docs/development.md

@@ -1,9 +1,9 @@
 # Development
 
 This section describes the steps you need to take to start development
-on paperless-ngx.
+on Paperless-ngx.
 
-Check out the source from github. The repository is organized in the
+Check out the source from GitHub. The repository is organized in the
 following way:
 
 - `main` always represents the latest release and will only see
@@ -12,7 +12,7 @@ following way:
 - `feature-X` contain bigger changes that will be in some release, but
   not necessarily the next one.
 
-When making functional changes to paperless, _always_ make your changes
+When making functional changes to Paperless-ngx, _always_ make your changes
 on the `dev` branch.
 
 Apart from that, the folder structure is as follows:
@@ -24,9 +24,9 @@ Apart from that, the folder structure is as follows:
   development.
 - `docker/` - Files required to build the docker image.
 
-## Contributing to Paperless
+## Contributing to Paperless-ngx
 
-Maybe you've been using Paperless for a while and want to add a feature
+Maybe you've been using Paperless-ngx for a while and want to add a feature
 or two, or maybe you've come across a bug that you have some ideas how
 to solve. The beauty of open source software is that you can see what's
 wrong and help to get it fixed for everyone!
@@ -36,242 +36,232 @@ conduct](https://github.com/paperless-ngx/paperless-ngx/blob/main/CODE_OF_CONDUC
 and other important information in the [contributing
 guidelines](https://github.com/paperless-ngx/paperless-ngx/blob/main/CONTRIBUTING.md).
 
-## Code formatting with pre-commit Hooks
+## Code formatting with pre-commit hooks
 
 To ensure a consistent style and formatting across the project source,
-the project utilizes a Git [pre-commit]{.title-ref} hook to perform some
-formatting and linting before a commit is allowed. That way, everyone
-uses the same style and some common issues can be caught early on. See
-below for installation instructions.
+the project utilizes Git [`pre-commit`](https://git-scm.com/book/en/v2/Customizing-Git-Git-Hooks)
+hooks to perform some formatting and linting before a commit is allowed.
+That way, everyone uses the same style and some common issues can be caught
+early on.
 
 Once installed, hooks will run when you commit. If the formatting isn't
 quite right or a linter catches something, the commit will be rejected.
 You'll need to look at the output and fix the issue. Some hooks, such
-as the Python formatting tool [black]{.title-ref}, will format failing
-files, so all you need to do is [git add]{.title-ref} those files again
+as the Python formatting tool `black`, will format failing
+files, so all you need to do is `git add` those files again
 and retry your commit.
 
-## Initial setup and first start
+## General setup
 
-After you forked and cloned the code from github you need to perform a
-first-time setup. To do the setup you need to perform the steps from the
-following chapters in a certain order:
+After you forked and cloned the code from GitHub you need to perform a
+first-time setup.
+
+!!! note
+
+    Every command is executed directly from the root folder of the project unless specified otherwise.
 
 1.  Install prerequisites + pipenv as mentioned in
-    `[Bare metal route](/setup#bare_metal)
+    [Bare metal route](/setup#bare_metal).
 
 2.  Copy `paperless.conf.example` to `paperless.conf` and enable debug
-    mode.
+    mode within the file via `PAPERLESS_DEBUG=true`.
 
-3.  Install the Angular CLI interface:
+3.  Create `consume` and `media` directories:
 
-    ```shell-session
-    $ npm install -g @angular/cli
+    ```bash
+    $ mkdir -p consume media
     ```
 
-4.  Install pre-commit
+4.  Install the Python dependencies:
 
-    ```shell-session
-    pre-commit install
+    ```bash
+    $ pipenv install --dev
     ```
 
-5.  Create `consume` and `media` folders in the cloned root folder.
+    !!! note
 
-    ```shell-session
-    mkdir -p consume media
+        Using a virtual environment is highly recommended. You can spawn one via `pipenv shell`.
+        Make sure you're using Python 3.10.x or lower. Otherwise you might
+        get issues with building dependencies. You can use
+        [pyenv](https://github.com/pyenv/pyenv) to install a specific
+        Python version.
+
+5.  Install pre-commit hooks:
+
+    ```bash
+    $ pre-commit install
     ```
 
-6.  You can now either \...
+6.  Apply migrations and create a superuser for your development instance:
+
+    ```bash
+    # src/
+
+    $ python3 manage.py migrate
+    $ python3 manage.py createsuperuser
+    ```
+
+7.  You can now either ...
 
     - install redis or
 
-    - use the included scripts/start-services.sh to use docker to fire
+    - use the included `scripts/start_services.sh` to use docker to fire
       up a redis instance (and some other services such as tika,
       gotenberg and a database server) or
 
     - spin up a bare redis container
 
-      > ```shell-session
-      > docker run -d -p 6379:6379 --restart unless-stopped redis:latest
-      > ```
+      ```
+      $ docker run -d -p 6379:6379 --restart unless-stopped redis:latest
+      ```
 
-7.  Install the python dependencies by performing in the src/ directory.
-
-    ```shell-session
-    pipenv install --dev
-    ```
-
-> - Make sure you're using python 3.9.x or lower. Otherwise you might
->   get issues with building dependencies. You can use
->   [pyenv](https://github.com/pyenv/pyenv) to install a specific
->   python version.
-
-8.  Generate the static UI so you can perform a login to get session
-    that is required for frontend development (this needs to be done one
-    time only). From src-ui directory:
-
-    ```shell-session
-    npm install .
-    ./node_modules/.bin/ng build --configuration production
-    ```
-
-9.  Apply migrations and create a superuser for your dev instance:
-
-    ```shell-session
-    python3 manage.py migrate
-    python3 manage.py createsuperuser
-    ```
-
-10. Now spin up the dev backend. Depending on which part of paperless
-    you're developing for, you need to have some or all of them
-    running.
-
-> ```shell-session
-> python3 manage.py runserver & python3 manage.py document_consumer & celery --app paperless worker
-> ```
-
-11. Login with the superuser credentials provided in step 8 at
-    `http://localhost:8000` to create a session that enables you to use
-    the backend.
-
-Backend development environment is now ready, to start Frontend
-development go to `/src-ui` and run `ng serve`. From there you can use
-`http://localhost:4200` for a preview.
+8.  Continue with either back-end or front-end development – or both :-).
 
 ## Back end development
 
-The backend is a django application. PyCharm works well for development,
-but you can use whatever you want.
+The back end is a [Django](https://www.djangoproject.com/) application.
+[PyCharm](https://www.jetbrains.com/de-de/pycharm/) as well as [Visual Studio Code](https://code.visualstudio.com)
+work well for development, but you can use whatever you want.
 
-Configure the IDE to use the src/ folder as the base source folder.
+Configure the IDE to use the `src/`-folder as the base source folder.
 Configure the following launch configurations in your IDE:
 
-- python3 manage.py runserver
-- celery \--app paperless worker
-- python3 manage.py document_consumer
+- `python3 manage.py runserver`
+- `python3 manage.py document_consumer`
+- `celery --app paperless worker -l DEBUG` (or any other log level)
 
 To start them all:
 
-```shell-session
-python3 manage.py runserver & python3 manage.py document_consumer & celery --app paperless worker
+```bash
+# src/
+
+$ python3 manage.py runserver & \
+  python3 manage.py document_consumer & \
+  celery --app paperless worker -l DEBUG
 ```
 
-Testing and code style:
+You might need the front end to test your back end code.
+This assumes that you have AngularJS installed on your system.
+Go to the [Front end development](#front-end-development) section for further details.
+To build the front end once use this command:
 
-- Run `pytest` in the src/ directory to execute all tests. This also
-  generates a HTML coverage report. When runnings test, paperless.conf
-  is loaded as well. However: the tests rely on the default
+```bash
+# src-ui/
+
+$ npm install
+$ ng build --configuration production
+```
+
+### Testing
+
+- Run `pytest` in the `src/` directory to execute all tests. This also
+  generates a HTML coverage report. When runnings test, `paperless.conf`
+  is loaded as well. However, the tests rely on the default
   configuration. This is not ideal. But for now, make sure no settings
   except for DEBUG are overridden when testing.
 
-- Coding style is enforced by the Git pre-commit hooks. These will
-  ensure your code is formatted and do some linting when you do a [git
-  commit]{.title-ref}.
-
-- You can also run `black` manually to format your code
-
-  !!! note
+!!! note
 
       The line length rule E501 is generally useful for getting multiple
       source files next to each other on the screen. However, in some
       cases, its just not possible to make some lines fit, especially
-      complicated IF cases. Append `# NOQA: E501` to disable this check
+      complicated IF cases. Append `# noqa: E501` to disable this check
       for certain lines.
 
 ## Front end development
 
-The front end is built using Angular. In order to get started, you need
-`npm`. Install the Angular CLI interface with
+The front end is built using AngularJS. In order to get started, you need Node.js (version 14.15+) and
+`npm`.
 
-```shell-session
-$ npm install -g @angular/cli
-```
+!!! note
 
-and make sure that it's on your path. Next, in the src-ui/ directory,
-install the required dependencies of the project.
+    The following commands are all performed in the `src-ui`-directory. You will need a running back end (including an active session) to connect to the back end API. To spin it up refer to the commands under the section [above](#back-end-development).
 
-```shell-session
-$ npm install
-```
+1. Install the Angular CLI. You might need sudo privileges
+   to perform this command:
 
-You can launch a development server by running
+   ```bash
+   $ npm install -g @angular/cli
+   ```
 
-```shell-session
-$ ng serve
-```
+2. Make sure that it's on your path.
 
-This will automatically update whenever you save. However, in-place
-compilation might fail on syntax errors, in which case you need to
-restart it.
+3. Install all neccessary modules:
 
-By default, the development server is available on
-`http://localhost:4200/` and is configured to access the API at
-`http://localhost:8000/api/`, which is the default of the backend. If
-you enabled DEBUG on the back end, several security overrides for
-allowed hosts, CORS and X-Frame-Options are in place so that the front
-end behaves exactly as in production. This also relies on you being
-logged into the back end. Without a valid session, The front end will
-simply not work.
+   ```bash
+   $ npm install
+   ```
 
-Testing and code style:
+4. You can launch a development server by running:
 
-- The frontend code (.ts, .html, .scss) use `prettier` for code
+   ```bash
+   $ ng serve
+   ```
+
+   This will automatically update whenever you save. However, in-place
+   compilation might fail on syntax errors, in which case you need to
+   restart it.
+
+   By default, the development server is available on `http://localhost:4200/` and is configured to access the API at
+   `http://localhost:8000/api/`, which is the default of the backend. If you enabled `DEBUG` on the back end, several security overrides for allowed hosts, CORS and X-Frame-Options are in place so that the front end behaves exactly as in production.
+
+### Testing and code style
+
+- The front end code (.ts, .html, .scss) use `prettier` for code
   formatting via the Git `pre-commit` hooks which run automatically on
-  commit. See
-  [above](#code-formatting-with-pre-commit-hooks) for installation. You can also run this via cli with a
+  commit. See [above](#code-formatting-with-pre-commit-hooks) for installation instructions. You can also run this via the CLI with a
   command such as
 
-  ```shell-session
+  ```bash
   $ git ls-files -- '*.ts' | xargs pre-commit run prettier --files
   ```
 
-- Frontend testing uses jest and cypress. There is currently a need
-  for significantly more frontend tests. Unit tests and e2e tests,
+- Front end testing uses jest and cypress. There is currently a need
+  for significantly more front end tests. Unit tests and e2e tests,
   respectively, can be run non-interactively with:
 
-  ```shell-session
+  ```bash
   $ ng test
   $ npm run e2e:ci
   ```
 
-  Cypress also includes a UI which can be run from within the `src-ui`
-  directory with
+  - Cypress also includes a UI which can be run with:
 
-  ```shell-session
-  $ ./node_modules/.bin/cypress open
+    ```bash
+    $ ./node_modules/.bin/cypress open
+    ```
+
+- In order to build the front end and serve it as part of Django, execute:
+
+  ```bash
+  $ ng build --configuration production
   ```
 
-In order to build the front end and serve it as part of django, execute
-
-```shell-session
-$ ng build --prod
-```
-
-This will build the front end and put it in a location from which the
-Django server will serve it as static content. This way, you can verify
-that authentication is working.
+  This will build the front end and put it in a location from which the
+  Django server will serve it as static content. This way, you can verify
+  that authentication is working.
 
 ## Localization
 
-Paperless is available in many different languages. Since paperless
-consists both of a django application and an Angular front end, both
+Paperless-ngx is available in many different languages. Since Paperless-ngx
+consists both of a Django application and an AngularJS front end, both
 these parts have to be translated separately.
 
 ### Front end localization
 
-- The Angular front end does localization according to the [Angular
+- The AngularJS front end does localization according to the [Angular
   documentation](https://angular.io/guide/i18n).
 - The source language of the project is "en_US".
-- The source strings end up in the file "src-ui/messages.xlf".
+- The source strings end up in the file `src-ui/messages.xlf`.
 - The translated strings need to be placed in the
-  "src-ui/src/locale/" folder.
+  `src-ui/src/locale/` folder.
 - In order to extract added or changed strings from the source files,
-  call `ng xi18n --ivy`.
+  call `ng extract-i18n`.
 
 Adding new languages requires adding the translated files in the
-"src-ui/src/locale/" folder and adjusting a couple files.
+`src-ui/src/locale/` folder and adjusting a couple files.
 
-1.  Adjust "src-ui/angular.json":
+1.  Adjust `src-ui/angular.json`:
 
     ```json
     "i18n": {
@@ -288,7 +278,7 @@ Adding new languages requires adding the translated files in the
     ```
 
 2.  Add the language to the available options in
-    "src-ui/src/app/services/settings.service.ts":
+    `src-ui/src/app/services/settings.service.ts`:
 
     ```typescript
     getLanguageOptions(): LanguageOption[] {
@@ -309,7 +299,7 @@ Adding new languages requires adding the translated files in the
     and "yyyy".
 
 3.  Import and register the Angular data for this locale in
-    "src-ui/src/app/app.module.ts":
+    `src-ui/src/app/app.module.ts`:
 
     ```typescript
     import localeDe from '@angular/common/locales/de'
@@ -322,10 +312,10 @@ A majority of the strings that appear in the back end appear only when
 the admin is used. However, some of these are still shown on the front
 end (such as error messages).
 
-- The django application does localization according to the [django
+- The django application does localization according to the [Django
   documentation](https://docs.djangoproject.com/en/3.1/topics/i18n/translation/).
 - The source language of the project is "en_US".
-- Localization files end up in the folder "src/locale/".
+- Localization files end up in the folder `src/locale/`.
 - In order to extract strings from the application, call
   `python3 manage.py makemessages -l en_US`. This is important after
   making changes to translatable strings.
@@ -336,8 +326,8 @@ end (such as error messages).
   command.
 
 Adding new languages requires adding the translated files in the
-"src/locale/" folder and adjusting the file
-"src/paperless/settings.py" to include the new language:
+`src/locale/`-folder and adjusting the file
+`src/paperless/settings.py` to include the new language:
 
 ```python
 LANGUAGES = [
@@ -353,20 +343,30 @@ LANGUAGES = [
 
 ## Building the documentation
 
-The documentation is built using material-mkdocs, see their [documentation](https://squidfunk.github.io/mkdocs-material/reference/). If you want to build the documentation locally, this is how you do it:
+The documentation is built using material-mkdocs, see their [documentation](https://squidfunk.github.io/mkdocs-material/reference/).
+If you want to build the documentation locally, this is how you do it:
 
-1.  Install python dependencies.
+1.  Have an active pipenv shell (`pipenv shell`) and install Python dependencies:
 
-    ```shell-session
-    $ cd /path/to/paperless
+    ```bash
     $ pipenv install --dev
     ```
 
 2.  Build the documentation
 
-    ```shell-session
-    $ cd /path/to/paperless
-    $ pipenv mkdocs build
+    ```bash
+    $ mkdocs build --config-file mkdocs.yml
+    ```
+
+    _alternatively..._
+
+3.  Serve the documentation. This will spin up a
+    copy of the documentation at http://127.0.0.1:8000
+    that will automatically refresh everytime you change
+    something.
+
+    ```bash
+    $ mkdocs serve
     ```
 
 ## Building the Docker image
@@ -379,35 +379,35 @@ helper script `build-docker-image.sh`.
 
 Building the docker image from source:
 
-> ```shell-session
-> ./build-docker-image.sh Dockerfile -t <your-tag>
-> ```
+```bash
+./build-docker-image.sh Dockerfile -t <your-tag>
+```
 
-## Extending Paperless
+## Extending Paperless-ngx
 
-Paperless does not have any fancy plugin systems and will probably never
+Paperless-ngx does not have any fancy plugin systems and will probably never
 have. However, some parts of the application have been designed to allow
 easy integration of additional features without any modification to the
 base code.
 
 ### Making custom parsers
 
-Paperless uses parsers to add documents to paperless. A parser is
+Paperless-ngx uses parsers to add documents. A parser is
 responsible for:
 
-- Retrieve the content from the original
-- Create a thumbnail
-- Optional: Retrieve a created date from the original
-- Optional: Create an archived document from the original
+- Retrieving the content from the original
+- Creating a thumbnail
+- _optional:_ Retrieving a created date from the original
+- _optional:_ Creainge an archived document from the original
 
-Custom parsers can be added to paperless to support more file types. In
+Custom parsers can be added to Paperless-ngx to support more file types. In
 order to do that, you need to write the parser itself and announce its
-existence to paperless.
+existence to Paperless-ngx.
 
 The parser itself must extend `documents.parsers.DocumentParser` and
 must implement the methods `parse` and `get_thumbnail`. You can provide
 your own implementation to `get_date` if you don't want to rely on
-paperless' default date guessing mechanisms.
+Paperless-ngx' default date guessing mechanisms.
 
 ```python
 class MyCustomParser(DocumentParser):
@@ -428,7 +428,7 @@ class MyCustomParser(DocumentParser):
     def get_thumbnail(self, document_path, mime_type):
         # This should return the path to a thumbnail you created for this
         # document.
-        return os.path.join(self.tempdir, "thumb.png")
+        return os.path.join(self.tempdir, "thumb.webp")
 ```
 
 If you encounter any issues during parsing, raise a
@@ -439,7 +439,7 @@ to be empty and removed after consumption finished. You can use that
 directory to store any intermediate files and also use it to store the
 thumbnail / archived document.
 
-After that, you need to announce your parser to paperless. You need to
+After that, you need to announce your parser to Paperless-ngx. You need to
 connect a handler to the `document_consumer_declaration` signal. Have a
 look in the file `src/paperless_tesseract/apps.py` on how that's done.
 The handler is a method that returns information about your parser:
@@ -459,11 +459,11 @@ def myparser_consumer_declaration(sender, **kwargs):
 - `parser` is a reference to a class that extends `DocumentParser`.
 - `weight` is used whenever two or more parsers are able to parse a
   file: The parser with the higher weight wins. This can be used to
-  override the parsers provided by paperless.
+  override the parsers provided by Paperless-ngx.
 - `mime_types` is a dictionary. The keys are the mime types your
   parser supports and the value is the default file extension that
-  paperless should use when storing files and serving them for
+  Paperless-ngx should use when storing files and serving them for
   download. We could guess that from the file extensions, but some
-  mime types have many extensions associated with them and the python
+  mime types have many extensions associated with them and the Python
   methods responsible for guessing the extension do not always return
   the same value.

docs/faq.md

@@ -1,6 +1,6 @@
 # Frequently Asked Questions
 
-### _What's the general plan for Paperless-ngx?_
+## _What's the general plan for Paperless-ngx?_
 
 **A:** While Paperless-ngx is already considered largely
 "feature-complete" it is a community-driven project and development
@@ -9,7 +9,7 @@ discussions and "up-voted" by the community but this is not a
 guarantee the feature will be implemented. This project will always be
 open to collaboration in the form of PRs, ideas etc.
 
-### _I'm using docker. Where are my documents?_
+## _I'm using docker. Where are my documents?_
 
 **A:** Your documents are stored inside the docker volume
 `paperless_media`. Docker manages this volume automatically for you. It
@@ -27,9 +27,7 @@ system. On Linux, chances are high that this location is
     files around manually. This folder is meant to be entirely managed by
     docker and paperless.
 
-### Let's say I want to switch tools in a year. Can I easily move
-
-to other systems?\*
+## Let's say I want to switch tools in a year. Can I easily move to other systems?
 
 **A:** Your documents are stored as plain files inside the media folder.
 You can always drag those files out of that folder to use them
@@ -41,27 +39,27 @@ elsewhere. Here are a couple notes about that.
 - By default, paperless uses the internal ID of each document as its
   filename. This might not be very convenient for export. However, you
   can adjust the way files are stored in paperless by
-  [configuring the filename format](advanced_usage#file_name_handling).
-- [The exporter](administration#exporter) is
+  [configuring the filename format](/advanced_usage#file-name-handling).
+- [The exporter](/administration#exporter) is
   another easy way to get your files out of paperless with reasonable
   file names.
 
-### _What file types does paperless-ngx support?_
+## _What file types does paperless-ngx support?_
 
 **A:** Currently, the following files are supported:
 
-- PDF documents, PNG images, JPEG images, TIFF images and GIF images
-  are processed with OCR and converted into PDF documents.
+- PDF documents, PNG images, JPEG images, TIFF images, GIF images and
+  WebP images are processed with OCR and converted into PDF documents.
 - Plain text documents are supported as well and are added verbatim to
   paperless.
-- With the optional Tika integration enabled (see [Tika configuration](configuration#tika),
+- With the optional Tika integration enabled (see [Tika configuration](/configuration#tika),
   Paperless also supports various Office documents (.docx, .doc, odt,
   .ppt, .pptx, .odp, .xls, .xlsx, .ods).
 
 Paperless-ngx determines the type of a file by inspecting its content.
 The file extensions do not matter.
 
-### _Will paperless-ngx run on Raspberry Pi?_
+## _Will paperless-ngx run on Raspberry Pi?_
 
 **A:** The short answer is yes. I've tested it on a Raspberry Pi 3 B.
 The long answer is that certain parts of Paperless will run very slow,
@@ -73,11 +71,11 @@ has to do much less work to serve the data.
 !!! note
 
     You can adjust some of the settings so that paperless uses less
-    processing power. See [setup](setup#less_powerful_devices) for details.
+    processing power. See [setup](/setup#less-powerful-devices) for details.
 
-### _How do I install paperless-ngx on Raspberry Pi?_
+## _How do I install paperless-ngx on Raspberry Pi?_
 
-**A:** Docker images are available for arm and arm64 hardware, so just
+**A:** Docker images are available for armv7 and arm64 hardware, so just
 follow the docker-compose instructions. Apart from more required disk
 space compared to a bare metal installation, docker comes with close to
 zero overhead, even on Raspberry Pi.
@@ -87,13 +85,13 @@ the python requirements do not have precompiled packages for ARM /
 ARM64. Installation of these will require additional development
 libraries and compilation will take a long time.
 
-### _How do I run this on Unraid?_
+## _How do I run this on Unraid?_
 
 **A:** Paperless-ngx is available as [community
 app](https://unraid.net/community/apps?q=paperless-ngx) in Unraid. [Uli
 Fahrer](https://github.com/Tooa) created a container template for that.
 
-### _How do I run this on my toaster?_
+## _How do I run this on my toaster?_
 
 **A:** I honestly don't know! As for all other devices that might be
 able to run paperless, you're a bit on your own. If you can't run the
@@ -103,11 +101,11 @@ This is also what I use to test new releases with. Apart from that, I
 also have a Raspberry Pi, which I occasionally build the image on and
 see if it works.
 
-### _How do I proxy this with NGINX?_
+## _How do I proxy this with NGINX?_
 
-**A:** See [here](setup#nginx).
+**A:** See [here](/setup#nginx).
 
-### _How do I get WebSocket support with Apache mod_wsgi_?
+## _How do I get WebSocket support with Apache mod_wsgi_?
 
 **A:** `mod_wsgi` by itself does not support ASGI. Paperless will
 continue to work with WSGI, but certain features such as status

docs/index.md

@@ -5,7 +5,7 @@
 **Paperless-ngx** is a _community-supported_ open-source document management system that transforms your
 physical documents into a searchable online archive so you can keep, well, _less paper_.
 
-[Get started](/setup/){ .md-button .md-button--primary .index-callout }
+[Get started](/setup){ .md-button .md-button--primary .index-callout }
 [Demo](https://demo.paperless-ngx.com){ .md-button .md-button--secondary target=\_blank }
 
 </div>
@@ -50,12 +50,12 @@ If you want to learn about what's different in paperless-ngx from
 Paperless, check out these resources in the documentation:
 
 - [Some screenshots](#screenshots) of the new UI are available.
-- Read [this section](/advanced_usage/#advanced-automatic_matching) if you want to learn about how paperless automates all
+- Read [this section](/advanced_usage#automatic-matching) if you want to learn about how paperless automates all
   tagging using machine learning.
-- Paperless now comes with a [proper email consumer](/usage/#usage-email) that's fully tested and production ready.
+- Paperless now comes with a [proper email consumer](/usage#usage-email) that's fully tested and production ready.
 - Paperless creates searchable PDF/A documents from whatever you put into the consumption directory. This means
   that you can select text in image-only documents coming from your scanner.
-- See [this note](/administration/#utilities-encyption) about GnuPG encryption in paperless-ngx.
+- See [this note](/administration#encryption) about GnuPG encryption in paperless-ngx.
 - Paperless is now integrated with a
   [task processing queue](/setup#task_processor) that tells you at a glance when and why something is not working.
 - The [changelog](/changelog) contains a detailed list of all changes in paperless-ngx.

docs/setup.md

@@ -2,10 +2,10 @@
 
 You can go multiple routes to setup and run Paperless:
 
-- [Use the easy install docker script](/setup#docker_script)
-- [Pull the image from Docker Hub](/setup#docker_hub)
-- [Build the Docker image yourself](/setup#docker_build)
-- [Install Paperless directly on your system manually (bare metal)](/setup#bare_metal)
+- [Use the easy install docker script](#docker_script)
+- [Pull the image from Docker Hub](#docker_hub)
+- [Build the Docker image yourself](#docker_build)
+- [Install Paperless directly on your system manually (bare metal)](#bare_metal)
 
 The Docker routes are quick & easy. These are the recommended routes.
 This configures all the stuff from the above automatically so that it
@@ -33,6 +33,11 @@ steps described in [Docker setup](#docker_hub) automatically.
     $ bash -c "$(curl -L https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/install-paperless-ngx.sh)"
     ```
 
+    !!! note
+
+        macOS users will need to install e.g. [gnu-sed](https://formulae.brew.sh/formula/gnu-sed) with support
+        for running as `sed`.
+
 ### From GHCR / Docker Hub {#docker_hub}
 
 1.  Login with your user and create a folder in your home-directory to have a place for your
@@ -43,10 +48,10 @@ steps described in [Docker setup](#docker_hub) automatically.
     ```
 
 2.  Go to the [/docker/compose directory on the project
-    page](https://github.com/paperless-ngx/paperless-ngx/tree/master/docker/compose)
+    page](https://github.com/paperless-ngx/paperless-ngx/tree/main/docker/compose)
     and download one of the `docker-compose.*.yml` files,
     depending on which database backend you want to use. Rename this
-    file to `docker-compose.*.yml`. If you want to enable
+    file to `docker-compose.yml`. If you want to enable
     optional support for Office documents, download a file with
     `-tika` in the file name. Download the
     `docker-compose.env` file and the `.env` file as well and store them
@@ -64,8 +69,7 @@ steps described in [Docker setup](#docker_hub) automatically.
 
         If you want to use the included `docker-compose.*.yml` file, you
         need to have at least Docker version **17.09.0** and docker-compose
-        version **1.17.0**. To check do: `docker-compose -v` or
-        `docker -v`
+        version **1.17.0**. To check do: `docker-compose -v` or `docker -v`
 
         See the [Docker installation guide](https://docs.docker.com/engine/install/) on how to install the current
         version of Docker for your operating system or Linux distribution of
@@ -144,21 +148,13 @@ steps described in [Docker setup](#docker_hub) automatically.
     !!! note
 
         You can copy any setting from the file `paperless.conf.example` and
-        paste it here. Have a look at [configuration](/configuration] to see what's available.
+        paste it here. Have a look at [configuration](/configuration) to see what's available.
 
     !!! note
 
-        You can utilize Docker secrets for some configuration settings by
-        appending `_FILE` to some configuration values. This is
-        supported currently only by:
-
-        - PAPERLESS_DBUSER
-        - PAPERLESS_DBPASS
-        - PAPERLESS_SECRET_KEY
-        - PAPERLESS_AUTO_LOGIN_USERNAME
-        - PAPERLESS_ADMIN_USER
-        - PAPERLESS_ADMIN_MAIL
-        - PAPERLESS_ADMIN_PASSWORD
+        You can utilize Docker secrets for configuration settings by
+        appending `_FILE` to configuration values. For example `PAPERLESS_DBUSER`
+        can be set using `PAPERLESS_DBUSER_FILE=/var/run/secrets/password.txt`.
 
     !!! warning
 
@@ -169,8 +165,7 @@ steps described in [Docker setup](#docker_hub) automatically.
         `PAPERLESS_CONSUMER_POLLING`, which will disable inotify. See
         [here](/configuration#polling).
 
-6.  Run `docker-compose pull`, followed by `docker-compose up -d`. This
-    will pull the image, create and start the necessary containers.
+6.  Run `docker-compose pull`. This will pull the image.
 
 7.  To be able to login, you will need a super user. To create it,
     execute the following command:
@@ -179,10 +174,18 @@ steps described in [Docker setup](#docker_hub) automatically.
     $ docker-compose run --rm webserver createsuperuser
     ```
 
+    or using docker exec from within the container:
+
+    ```shell-session
+    $ python3 manage.py createsuperuser
+    ```
+
     This will prompt you to set a username, an optional e-mail address
     and finally a password (at least 8 characters).
 
-8.  The default `docker-compose.yml` exports the webserver on your local
+8.  Run `docker-compose up -d`. This will create and start the necessary containers.
+
+9.  The default `docker-compose.yml` exports the webserver on your local
     port
 
     8000\. If you did not change this, you should now be able to visit
@@ -198,7 +201,7 @@ steps described in [Docker setup](#docker_hub) automatically.
     git clone https://github.com/paperless-ngx/paperless-ngx
     ```
 
-    The master branch always reflects the latest stable version.
+    The main branch always reflects the latest stable version.
 
 2.  Copy one of the `docker/compose/docker-compose.*.yml` to
     `docker-compose.yml` in the root folder, depending on which database
@@ -234,9 +237,8 @@ steps described in [Docker setup](#docker_hub) automatically.
         certain, more updated software. If you want to build these images
         your self, that is possible, but beyond the scope of these steps.
 
-4.  Follow steps 3 to 8 of [Docker Setup](setup#docker_hub)
-    role="ref"}. When asked to run `docker-compose pull` to pull the
-    image, do
+4.  Follow steps 3 to 8 of [Docker Setup](#docker_hub). When asked to run
+    `docker-compose pull` to pull the image, do
 
     ```shell-session
     $ docker-compose build
@@ -315,21 +317,42 @@ supported.
         extension](https://code.djangoproject.com/wiki/JSON1Extension) is
         enabled. This is usually the case, but not always.
 
-4.  Get the release archive from
-    <https://github.com/paperless-ngx/paperless-ngx/releases>. If you
-    clone the git repo as it is, you also have to compile the front end
-    by yourself. Extract the archive to a place from where you wish to
-    execute it, such as `/opt/paperless`.
+4.  Create a system user with a new home folder under which you wish
+    to run paperless.
 
-5.  Configure paperless. See [configuration](configuration) for details.
+    ```shell-session
+    adduser paperless --system --home /opt/paperless --group
+    ```
+
+5.  Get the release archive from
+    <https://github.com/paperless-ngx/paperless-ngx/releases> for example with
+
+    ```shell-session
+    curl -O -L https://github.com/paperless-ngx/paperless-ngx/releases/download/v1.10.2/paperless-ngx-v1.10.2.tar.xz
+    ```
+
+    Extract the archive with
+
+    ```shell-session
+    tar -xf paperless-ngx-v1.10.2.tar.xz
+    ```
+
+    and copy the contents to the
+    home folder of the user you created before (`/opt/paperless`).
+
+    Optional: If you cloned the git repo, you will have to
+    compile the frontend yourself, see [here](/development#front-end-development)
+    and use the `build` step, not `serve`.
+
+6.  Configure paperless. See [configuration](/configuration) for details.
     Edit the included `paperless.conf` and adjust the settings to your
     needs. Required settings for getting
     paperless running are:
 
     - `PAPERLESS_REDIS` should point to your redis server, such as
       <redis://localhost:6379>.
-    - `PAPERLESS_DBENGINE` optional, and should be one of [postgres,
-      mariadb, or sqlite]{.title-ref}
+    - `PAPERLESS_DBENGINE` optional, and should be one of `postgres`,
+      `mariadb`, or `sqlite`
     - `PAPERLESS_DBHOST` should be the hostname on which your
       PostgreSQL server is running. Do not configure this to use
       SQLite instead. Also configure port, database name, user and
@@ -344,7 +367,7 @@ supported.
       allows third parties to forge authentication credentials.
     - `PAPERLESS_URL` if you are behind a reverse proxy. This should
       point to your domain. Please see
-      [configuration](configuration) for more
+      [configuration](/configuration) for more
       information.
 
     Many more adjustments can be made to paperless, especially the OCR
@@ -354,29 +377,35 @@ supported.
       documents are written in.
     - Set `PAPERLESS_TIME_ZONE` to your local time zone.
 
-6.  Create a system user under which you wish to run paperless.
+    !!! warning
 
-    ```shell-session
-    adduser paperless --system --home /opt/paperless --group
-    ```
+        Ensure your Redis instance [is secured](https://redis.io/docs/getting-started/#securing-redis).
 
-7.  Ensure that these directories exist and that the paperless user has
-    write permissions to the following directories:
+7.  Create the following directories if they are missing:
 
     - `/opt/paperless/media`
     - `/opt/paperless/data`
     - `/opt/paperless/consume`
 
     Adjust as necessary if you configured different folders.
-
-8.  Install python requirements from the `requirements.txt` file. It is
-    up to you if you wish to use a virtual environment or not. First you
-    should update your pip, so it gets the actual packages.
+    Ensure that the paperless user has write permissions for every one
+    of these folders with
 
     ```shell-session
-    sudo -Hu paperless pip3 install --upgrade pip
+    ls -l -d /opt/paperless/media
     ```
 
+    If needed, change the owner with
+
+    ```shell-session
+    sudo chown paperless:paperless /opt/paperless/media
+    sudo chown paperless:paperless /opt/paperless/data
+    sudo chown paperless:paperless /opt/paperless/consume
+    ```
+
+8.  Install python requirements from the `requirements.txt` file. It is
+    up to you if you wish to use a virtual environment or not. First you should update your pip, so it gets the actual packages.
+
     ```shell-session
     sudo -Hu paperless pip3 install -r requirements.txt
     ```
@@ -387,21 +416,25 @@ supported.
 9.  Go to `/opt/paperless/src`, and execute the following commands:
 
     ```bash
-    \# This creates the database schema.
+    # This creates the database schema.
     sudo -Hu paperless python3 manage.py migrate
 
-    \# This creates your first paperless user
+    # This creates your first paperless user
     sudo -Hu paperless python3 manage.py createsuperuser
     ```
 
 10. Optional: Test that paperless is working by executing
 
     ```bash
-    \# This collects static files from paperless and django.
+    # Manually starts the webserver
     sudo -Hu paperless python3 manage.py runserver
     ```
 
-    and pointing your browser to <http://localhost:8000/>.
+    and pointing your browser to http://localhost:8000 if
+    accessing from the same devices on which paperless is installed.
+    If accessing from another machine, set up systemd services. You may need
+    to set `PAPERLESS_DEBUG=true` in order for the development server to work
+    normally in your browser.
 
     !!! warning
 
@@ -452,6 +485,14 @@ supported.
         For instructions on how to use nginx for that,
         [see the instructions below](/setup#nginx).
 
+    !!! warning
+
+        If celery won't start (check with
+        `sudo systemctl status paperless-task-queue.service` for
+        paperless-task-queue.service and paperless-scheduler.service
+        ) you need to change the path in the files. Example:
+        `ExecStart=/opt/paperless/.local/bin/celery --app paperless worker --loglevel INFO`
+
 12. Optional: Install a samba server and make the consumption folder
     available as a network share.
 
@@ -480,7 +521,7 @@ supported.
     not available for most distributions.
 
 15. Optional: If using the NLTK machine learning processing (see
-    `PAPERLESS_ENABLE_NLTK` in [configuration](configuration#software_tweaks) for details),
+    `PAPERLESS_ENABLE_NLTK` in [configuration](/configuration#software_tweaks) for details),
     download the NLTK data for the Snowball
     Stemmer, Stopwords and Punkt tokenizer to your
     `PAPERLESS_DATA_DIR/nltk`. Refer to the [NLTK
@@ -560,9 +601,9 @@ Migration to paperless-ngx is then performed in a few simple steps:
 
 3.  Download the latest release of paperless-ngx. You can either go with
     the docker-compose files from
-    [here](https://github.com/paperless-ngx/paperless-ngx/tree/master/docker/compose)
+    [here](https://github.com/paperless-ngx/paperless-ngx/tree/main/docker/compose)
     or clone the repository to build the image yourself (see
-    [above](/setup#docker_build)). You can
+    [above](#docker_build)). You can
     either replace your current paperless folder or put paperless-ngx in
     a different location.
 
@@ -586,7 +627,7 @@ Migration to paperless-ngx is then performed in a few simple steps:
     after you migrated your existing SQLite database.
 
 5.  Adjust `docker-compose.yml` and `docker-compose.env` to your needs.
-    See [Docker setup](setup#docker_hub) details on
+    See [Docker setup](#docker_hub) details on
     which edits are advised.
 
 6.  [Update paperless.](/administration#updating)
@@ -676,13 +717,19 @@ below use PostgreSQL, but are applicable to MySQL/MariaDB with the
 !!! warning
 
     MySQL is case insensitive by default, treating values like "Name" and
-    "NAME" as identical. See [MySQL caveats](advanced##mysql-caveats) for details.
+    "NAME" as identical. See [MySQL caveats](/advanced_usage#mysql-caveats) for details.
 
 !!! warning
 
     MySQL also enforces limits on maximum lengths, but does so differently than
     PostgreSQL.  It may not be possible to migrate to MySQL due to this.
 
+!!! warning
+
+    Using mariadb version 10.4+ is recommended. Using the `utf8mb3` character set on
+    an older system may fix issues that can arise while setting up Paperless-ngx but
+    `utf8mb3` can cause issues with consumption (where `utf8mb4` does not).
+
 1.  Stop paperless, if it is running.
 
 2.  Tell paperless to use PostgreSQL:
@@ -691,7 +738,7 @@ below use PostgreSQL, but are applicable to MySQL/MariaDB with the
     file to `docker-compose.yml`. Remember to adjust the consumption
     directory, if necessary.
     b) Without docker, configure the database in your `paperless.conf`
-    file. See [configuration](configuration) for
+    file. See [configuration](/configuration) for
     details.
 
 3.  Open a shell and initialize the database:
@@ -746,7 +793,9 @@ with a few simple steps.
 
 Paperless-ngx modified the database schema slightly, however, these
 changes can be reverted while keeping your current data, so that your
-current data will be compatible with original Paperless.
+current data will be compatible with original Paperless. Thumbnails
+were also changed from PNG to WEBP format and will need to be
+re-generated.
 
 Execute this:
 
@@ -762,11 +811,11 @@ $ cd /path/to/paperless/src
 $ python3 manage.py migrate documents 0023
 ```
 
-After that, you need to clear your cookies (Paperless-ngx comes with
-updated dependencies that do cookie-processing differently) and probably
-your cache as well.
+After regenerating thumbnails, you'll need to clear your cookies
+(Paperless-ngx comes with updated dependencies that do cookie-processing
+differently) and probably your cache as well.
 
-# Considerations for less powerful devices {#less_powerful_devices}
+# Considerations for less powerful devices {#less-powerful-devices}
 
 Paperless runs on Raspberry Pi. However, some things are rather slow on
 the Pi and configuring some options in paperless can help improve
@@ -785,24 +834,24 @@ performance immensely:
   other tasks).
 - Keep `PAPERLESS_OCR_MODE` at its default value `skip` and consider
   OCR'ing your documents before feeding them into paperless. Some
-  scanners are able to do this! You might want to even specify
-  `skip_noarchive` to skip archive file generation for already ocr'ed
-  documents entirely.
+  scanners are able to do this!
+- Set `PAPERLESS_OCR_SKIP_ARCHIVE_FILE` to `with_text` to skip archive
+  file generation for already ocr'ed documents, or `always` to skip it
+  for all documents.
 - If you want to perform OCR on the device, consider using
   `PAPERLESS_OCR_CLEAN=none`. This will speed up OCR times and use
   less memory at the expense of slightly worse OCR results.
-- If using docker, consider setting `PAPERLESS_WEBSERVER_WORKERS` to
-  1.  This will save some memory.
+- If using docker, consider setting `PAPERLESS_WEBSERVER_WORKERS` to 1. This will save some memory.
 - Consider setting `PAPERLESS_ENABLE_NLTK` to false, to disable the
   more advanced language processing, which can take more memory and
   processing time.
 
-For details, refer to [configuration](configuration).
+For details, refer to [configuration](/configuration).
 
 !!! note
 
     Updating the
-    [automatic matching algorithm](/advanced_usage#automatic_matching) takes quite a bit of time. However, the update mechanism
+    [automatic matching algorithm](/advanced_usage#automatic-matching) takes quite a bit of time. However, the update mechanism
     checks if your data has changed before doing the heavy lifting. If you
     experience the algorithm taking too much cpu time, consider changing the
     schedule in the admin interface to daily. You can also manually invoke
@@ -843,13 +892,14 @@ http {
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Host $server_name;
+            add_header P3P 'CP=""'; # may not be required in all setups
         }
     }
 }
 ```
 
 The `PAPERLESS_URL` configuration variable is also required when using a
-reverse proxy. Please refer to the [hosting and security](configuration#hosting-and-security) docs.
+reverse proxy. Please refer to the [hosting and security](/configuration#hosting-and-security) docs.
 
 Also read
 [this](https://channels.readthedocs.io/en/stable/deploying.html#nginx-supervisor-ubuntu),

docs/troubleshooting.md

@@ -32,7 +32,7 @@ If you find the OCR accuracy to be too low, and/or the document consumer
 warns that
 `OCR for XX failed, but we're going to stick with what we've got since FORGIVING_OCR is enabled`,
 then you might need to install the [Tesseract language
-files](http://packages.ubuntu.com/search?keywords=tesseract-ocr)
+files](https://packages.ubuntu.com/search?keywords=tesseract-ocr)
 marching your document's languages.
 
 As an example, if you are running Paperless-ngx from any Ubuntu or
@@ -125,13 +125,13 @@ using docker-compose, this is achieved by the following configuration
 change in the `docker-compose.yml` file:
 
 ```yaml
-gotenberg:
-  image: gotenberg/gotenberg:7.6
-  restart: unless-stopped
-  command:
-    - 'gotenberg'
-    - '--chromium-disable-routes=true'
-    - '--api-timeout=60'
+# The gotenberg chromium route is used to convert .eml files. We do not
+# want to allow external content like tracking pixels or even javascript.
+command:
+  - 'gotenberg'
+  - '--chromium-disable-javascript=true'
+  - '--chromium-allow-list=file:///tmp/.*'
+  - '--api-timeout=60'
 ```
 
 ## Permission denied errors in the consumption directory
@@ -145,7 +145,7 @@ The following error occured while consuming document.pdf: [Errno 13] Permission
 This happens when paperless does not have permission to delete files
 inside the consumption directory. Ensure that `USERMAP_UID` and
 `USERMAP_GID` are set to the user id and group id you use on the host
-operating system, if these are different from `1000`. See [Docker setup](setup#docker_hub).
+operating system, if these are different from `1000`. See [Docker setup](/setup#docker_hub).
 
 Also ensure that you are able to read and write to the consumption
 directory on the host.
@@ -222,7 +222,7 @@ This might have multiple reasons.
     SENDFILE=0
     ```
 
-    to your [docker-compose.env]{.title-ref} file.
+    to your `docker-compose.env` file.
 
 ## Error while reading metadata
 
@@ -326,9 +326,22 @@ unlock. This may have minor performance implications.
 ## gunicorn fails to start with "is not a valid port number"
 
 You are likely running using Kubernetes, which automatically creates an
-environment variable named [\${serviceName}\_PORT]{.title-ref}. This is
+environment variable named `${serviceName}_PORT`. This is
 the same environment variable which is used by Paperless to optionally
 change the port gunicorn listens on.
 
-To fix this, set [PAPERLESS_PORT]{.title-ref} again to your desired
-port, or the default of 8000.
+To fix this, set `PAPERLESS_PORT` again to your desired port, or the
+default of 8000.
+
+## Database Warns about unique constraint "documents_tag_name_uniq
+
+You may see database log lines like:
+
+```
+ERROR:  duplicate key value violates unique constraint "documents_tag_name_uniq"
+DETAIL:  Key (name)=(NameF) already exists.
+STATEMENT:  INSERT INTO "documents_tag" ("owner_id", "name", "match", "matching_algorithm", "is_insensitive", "color", "is_inbox_tag") VALUES (NULL, 'NameF', '', 1, true, '#a6cee3', false) RETURNING "documents_tag"."id"
+```
+
+This can happen during heavy consumption when using polling. Paperless will handle it correctly and the file
+will still be consumed

docs/usage.md

@@ -1,9 +1,9 @@
 # Usage Overview
 
 Paperless is an application that manages your personal documents. With
-the help of a document scanner (see [the scanners wiki](https://github.com/paperless-ngx/paperless-ngx/wiki/Scanner-&-Software-Recommendations)), paperless transforms your wieldy physical document binders
-into a searchable archive and provides many utilities for finding and
-managing your documents.
+the help of a document scanner (see [the scanners wiki](https://github.com/paperless-ngx/paperless-ngx/wiki/Scanner-&-Software-Recommendations)),
+paperless transforms your unwieldy physical document binders into a searchable archive
+and provides many utilities for finding and managing your documents.
 
 ## Terms and definitions
 
@@ -37,7 +37,7 @@ Each document has a couple of fields that you can assign to them:
   date you signed a contract, or the date a letter was sent to you.
 - The _archive serial number_ (short: ASN) of a document is the
   identifier of the document in your physical document binders. See
-  [recommended workflow](#usage-reccomended_workflow) below.
+  [recommended workflow](#usage-recommended-workflow) below.
 - The _content_ of a document is the text that was OCR'ed from the
   document. This text is fed into the search engine and is used for
   matching tags, correspondents and document types.
@@ -60,8 +60,8 @@ following operations on your documents:
 
     This process can be configured to fit your needs. If you don't want
     paperless to create archived versions for digital documents, you can
-    configure that by configuring `PAPERLESS_OCR_MODE=skip_noarchive`.
-    Please read the
+    configure that by configuring
+    `PAPERLESS_OCR_SKIP_ARCHIVE_FILE=with_text`. Please read the
     [relevant section in the documentation](/configuration#ocr).
 
 !!! note
@@ -74,8 +74,8 @@ following operations on your documents:
 ### The consumption directory
 
 The primary method of getting documents into your database is by putting
-them in the consumption directory. The consumer runs in an infinite
-loop, looking for new additions to this directory. When it finds them,
+them in the consumption directory. The consumer waits patiently, looking
+for new additions to this directory. When it finds them,
 the consumer goes about the process of parsing them with the OCR,
 indexing what it finds, and storing it in the media directory.
 
@@ -86,7 +86,7 @@ scanner to automatically push files to this directory, you'll need to
 setup some sort of service to accept the files from the scanner.
 Typically, you're looking at an FTP server like
 [Proftpd](http://www.proftpd.org/) or a Windows folder share with
-[Samba](http://www.samba.org/).
+[Samba](https://www.samba.org/).
 
 ### Web UI Upload
 
@@ -99,7 +99,7 @@ dragging-and-dropping files into your browser window.
 
 ### Mobile upload {#usage-mobile_upload}
 
-The mobile app over at <https://github.com/qcasey/paperless_share>
+The mobile app over at [https://github.com/qcasey/paperless_share](https://github.com/qcasey/paperless_share)
 allows Android users to share any documents with paperless. This can be
 combined with any of the mobile scanning apps out there, such as Office
 Lens.
@@ -108,6 +108,8 @@ Furthermore, there is the [Paperless
 App](https://github.com/bauerj/paperless_app) as well, which not only
 has document upload, but also document browsing and download features.
 
+Another option is [Paperless Mobile](https://github.com/astubenbord/paperless-mobile), an Android app that supports document upload, scanning, management of labels and more.
+
 ### IMAP (Email) {#usage-email}
 
 You can tell paperless-ngx to consume documents from your email
@@ -151,6 +153,8 @@ different means. These are as follows:
   will not consume mails already tagged. Not all mail servers support
   this feature!
 
+  - **Apple Mail support:** Apple Mail clients allow differently colored tags. For this to work use `apple:<color>` (e.g. _apple:green_) as a custom tag. Available colors are _red_, _orange_, _yellow_, _blue_, _green_, _violet_ and _grey_.
+
 !!! warning
 
     The mail consumer will perform these actions on all mails it has
@@ -191,13 +195,46 @@ different means. These are as follows:
     them further.
 
 Paperless is set up to check your mails every 10 minutes. This can be
-configured on the 'Scheduled tasks' page in the admin.
+configured via `PAPERLESS_EMAIL_TASK_CRON` (see [software tweaks](/configuration#software_tweaks))
 
 ### REST API
 
-You can also submit a document using the REST API, see [docs][api#file-uploads]
+You can also submit a document using the REST API, see [POSTing documents](/api#file-uploads)
 for details.
 
+## Permissions
+
+As of version 1.14.0 Paperless-ngx added core support for user / group permissions. Permissions is
+based around an object 'owner' and 'view' and 'edit' permissions can be granted to other users
+or groups.
+
+Permissions uses the built-in user model of the backend framework, Django.
+
+!!! note
+
+    After migration to version 1.14.0 all existing documents, tags etc. will have no explicit owner
+    set which means they will be visible / editable by all users. Once an object has an owner set,
+    only the owner can explicitly grant / revoke permissions.
+
+!!! note
+
+    When first migrating to permissions it is recommended to use a 'superuser' account (which
+    would usually have been setup during installation) to ensure you have full permissions.
+
+    Note that superusers have access to all objects.
+
+Permissions can be set using the new "Permissions" tab when editing documents, or bulk-applied
+in the UI by selecting documents and choosing the "Permissions" button. Owner can also optionally
+be set for documents uploaded via the API. Documents consumed via the consumption dir currently
+do not have an owner set.
+
+### Users and Groups
+
+Paperless-ngx versions after 1.14.0 allow creating and editing users and groups via the 'frontend' UI.
+These can be found under Settings > Users & Groups, assuming the user has access. If a user is designated
+as a member of a group those permissions will be inherited and this is reflected in the UI. Explicit
+permissions can be granted to limit access to certain parts of the UI (and corresponding API endpoints).
+
 ## Best practices {#basic-searching}
 
 Paperless offers a couple tools that help you organize your document
@@ -325,7 +362,7 @@ language](https://whoosh.readthedocs.io/en/latest/querylang.html). For
 details on what date parsing utilities are available, see [Date
 parsing](https://whoosh.readthedocs.io/en/latest/dates.html#parsing-date-queries).
 
-## The recommended workflow {#usage-recommended_workflow}
+## The recommended workflow {#usage-recommended-workflow}
 
 Once you have familiarized yourself with paperless and are ready to use
 it for all your documents, the recommended workflow for managing your
@@ -359,6 +396,14 @@ documents in your inbox:
     sorted by ASN. Don't order this binder in any other way.
 5.  If the document has no ASN, throw it away. Yay!
 
+!!! tip
+
+    Instead of writing a number on the document by hand, you may also prepare
+    a spool of labels with barcodes with an ascending serial number, that are
+    formatted like `ASN00001`.
+    This also enables Paperless to automatically parse and process the ASN
+    (if enabled in the config), so that you don't need to manually assign it.
+
 Over time, you will notice that your physical binder will fill up. If it
 is full, label the binder with the range of ASNs in this binder (i.e.,
 "Documents 1 to 343"), store the binder in your cellar or elsewhere,
@@ -398,7 +443,7 @@ Once you have scanned in a document, proceed in paperless as follows.
     paperless will assign them automatically. After consuming a couple
     documents, you can even ask paperless to *learn* when to assign tags and
     correspondents by itself. For details on this feature, see
-    [advanced matching](advanced_usage#matching).
+    [advanced matching](/advanced_usage#matching).
 
 ### Task management
 
@@ -416,7 +461,7 @@ how regularly you intend to scan documents and use paperless.
   performed the task associated with the document, move it to the
   inbox.
 
-## Architectue
+## Architecture
 
 Paperless-ngx consists of the following components:
 

gunicorn.conf.py

@@ -30,7 +30,9 @@ def worker_int(worker):
     worker.log.info("worker received INT or QUIT signal")
 
     ## get traceback info
-    import threading, sys, traceback
+    import sys
+    import threading
+    import traceback
 
     id2name = {th.ident: th.name for th in threading.enumerate()}
     code = []

install-paperless-ngx.sh

@@ -321,7 +321,7 @@ fi
 wget "https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/docker/compose/docker-compose.$DOCKER_COMPOSE_VERSION.yml" -O docker-compose.yml
 wget "https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/docker/compose/.env" -O .env
 
-SECRET_KEY=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 64 | head -n 1)
+SECRET_KEY=$(tr --delete --complement 'a-zA-Z0-9' < /dev/urandom 2>/dev/null | head --bytes 64)
 
 DEFAULT_LANGUAGES=("deu eng fra ita spa")
 
@@ -346,7 +346,7 @@ read -r -a OCR_LANGUAGES_ARRAY <<< "${_split_langs}"
 	fi
 } > docker-compose.env
 
-sed -i "s/- 8000:8000/- $PORT:8000/g" docker-compose.yml
+sed -i "s/- \"8000:8000\"/- \"$PORT:8000\"/g" docker-compose.yml
 
 sed -i "s#- \./consume:/usr/src/paperless/consume#- $CONSUME_FOLDER:/usr/src/paperless/consume#g" docker-compose.yml
 

mkdocs.yml

@@ -23,6 +23,7 @@ theme:
     - navigation.tabs
     - navigation.top
     - toc.integrate
+    - content.code.annotate
   icon:
     repo: fontawesome/brands/github
   favicon: assets/favicon.png
@@ -39,6 +40,9 @@ markdown_extensions:
   - pymdownx.highlight:
       anchor_linenums: true
   - pymdownx.superfences
+  - pymdownx.inlinehilite
+  - pymdownx.snippets
+strict: true
 nav:
     - index.md
     - setup.md
@@ -51,7 +55,7 @@ nav:
     - 'FAQs': faq.md
     - troubleshooting.md
     - changelog.md
-copyright: Copyright © 2016 - 2022 Daniel Quinn, Jonas Winkler, and the Paperless-ngx team
+copyright: Copyright © 2016 - 2023 Daniel Quinn, Jonas Winkler, and the Paperless-ngx team
 extra:
   social:
     - icon: fontawesome/brands/github

paperless.conf.example

@@ -42,6 +42,7 @@
 
 #PAPERLESS_OCR_LANGUAGE=eng
 #PAPERLESS_OCR_MODE=skip
+#PAPERLESS_OCR_SKIP_ARCHIVE_FILE=never
 #PAPERLESS_OCR_OUTPUT_TYPE=pdfa
 #PAPERLESS_OCR_PAGES=1
 #PAPERLESS_OCR_IMAGE_DPI=300

scripts/start_services.sh

@@ -2,5 +2,5 @@
 
 docker run -p 5432:5432 -e POSTGRES_PASSWORD=password -v paperless_pgdata:/var/lib/postgresql/data -d postgres:13
 docker run -d -p 6379:6379 redis:latest
-docker run -p 3000:3000 -d gotenberg/gotenberg:7.6
+docker run -p 3000:3000 -d gotenberg/gotenberg:7.8 gotenberg --chromium-disable-javascript=true --chromium-allow-list="file:///tmp/.*"
 docker run -p 9998:9998 -d ghcr.io/paperless-ngx/tika:latest

src-ui/.browserslistrc

@@ -1,18 +0,0 @@
-# This file is used by the build system to adjust CSS and JS output to support the specified browsers below.
-# For additional information regarding the format and rule options, please see:
-# https://github.com/browserslist/browserslist#queries
-
-# For the full list of supported browsers by the Angular framework, please see:
-# https://angular.io/guide/browser-support
-
-# You can see what browsers were selected by your queries by running:
-#   npx browserslist
-
-last 1 Chrome version
-last 1 Firefox version
-last 2 Edge major versions
-last 2 Safari major versions
-last 2 iOS major versions
-Firefox ESR
-not IE 9-10 # Angular support for IE 9-10 has been deprecated and will be removed as of Angular v11. To opt-in, remove the 'not' prefix on this line.
-not IE 11 # Angular supports IE 11 only as an opt-in. To opt-in, remove the 'not' prefix on this line.

src-ui/.eslintrc.json

@@ -0,0 +1,51 @@
+{
+  "root": true,
+  "ignorePatterns": [
+    "projects/**/*"
+  ],
+  "overrides": [
+    {
+      "files": [
+        "*.ts"
+      ],
+      "parserOptions": {
+        "project": [
+          "tsconfig.json",
+          "e2e/tsconfig.json"
+        ],
+        "createDefaultProgram": true
+      },
+      "extends": [
+        "plugin:@angular-eslint/recommended",
+        "plugin:@angular-eslint/template/process-inline-templates"
+      ],
+      "rules": {
+        "@angular-eslint/directive-selector": [
+          "error",
+          {
+            "type": "attribute",
+            "prefix": "app",
+            "style": "camelCase"
+          }
+        ],
+        "@angular-eslint/component-selector": [
+          "error",
+          {
+            "type": "element",
+            "prefix": "app",
+            "style": "kebab-case"
+          }
+        ]
+      }
+    },
+    {
+      "files": [
+        "*.html"
+      ],
+      "extends": [
+        "plugin:@angular-eslint/template/recommended"
+      ],
+      "rules": {}
+    }
+  ]
+}

src-ui/README.md

@@ -12,7 +12,7 @@ Run `ng generate component component-name` to generate a new component. You can
 
 ## Build
 
-Run `ng build` to build the project. The build artifacts will be stored in the `dist/` directory. Use the `--prod` flag for a production build.
+Run `ng build` to build the project. The build artifacts will be stored in the `dist/` directory. Use the `--configuration production` flag for a production build.
 
 ## Running unit tests
 

src-ui/angular.json

@@ -1,179 +1,208 @@
 {
-	"$schema": "./node_modules/@angular/cli/lib/config/schema.json",
-	"version": 1,
-	"newProjectRoot": "projects",
-	"projects": {
-		"paperless-ui": {
-			"projectType": "application",
-			"schematics": {
-				"@schematics/angular:component": {
-					"style": "scss"
-				}
-			},
-			"root": "",
-			"sourceRoot": "src",
-			"prefix": "app",
-			"i18n": {
-				"sourceLocale": "en-US",
-				"locales": {
-					"be-BY": "src/locale/messages.be_BY.xlf",
-					"cs-CZ": "src/locale/messages.cs_CZ.xlf",
-					"da-DK": "src/locale/messages.da_DK.xlf",
-					"de-DE": "src/locale/messages.de_DE.xlf",
-					"en-GB": "src/locale/messages.en_GB.xlf",
-					"es-ES": "src/locale/messages.es_ES.xlf",
-					"fr-FR": "src/locale/messages.fr_FR.xlf",
-					"it-IT": "src/locale/messages.it_IT.xlf",
-					"lb-LU": "src/locale/messages.lb_LU.xlf",
-					"nl-NL": "src/locale/messages.nl_NL.xlf",
-					"pl-PL": "src/locale/messages.pl_PL.xlf",
-					"pt-BR": "src/locale/messages.pt_BR.xlf",
-					"pt-PT": "src/locale/messages.pt_PT.xlf",
-					"ro-RO": "src/locale/messages.ro_RO.xlf",
-					"ru-RU": "src/locale/messages.ru_RU.xlf",
-					"sl-SI": "src/locale/messages.sl_SI.xlf",
-					"sr-CS": "src/locale/messages.sr_CS.xlf",
-					"sv-SE": "src/locale/messages.sv_SE.xlf",
-					"tr-TR": "src/locale/messages.tr_TR.xlf",
-					"zh-CN": "src/locale/messages.zh_CN.xlf"
-				}
-			},
-			"architect": {
-				"build": {
-					"builder": "@angular-devkit/build-angular:browser",
-					"options": {
-						"outputPath": "dist/paperless-ui",
-						"outputHashing": "none",
-						"index": "src/index.html",
-						"main": "src/main.ts",
-						"polyfills": "src/polyfills.ts",
-						"tsConfig": "tsconfig.app.json",
-						"localize": true,
-						"assets": [
-							"src/favicon.ico",
-							"src/apple-touch-icon.png",
-							"src/assets",
-							"src/manifest.webmanifest", {
-								"glob": "pdf.worker.min.js",
-								"input": "node_modules/pdfjs-dist/build/",
-								"output": "/assets/js/"
-							}
-						],
-						"styles": [
-							"src/styles.scss"
-						],
-						"scripts": [],
-						"allowedCommonJsDependencies": [
-							"ng2-pdf-viewer"
-						],
-						"vendorChunk": true,
-						"extractLicenses": false,
-						"buildOptimizer": false,
-						"sourceMap": true,
-						"optimization": false,
-						"namedChunks": true
-					},
-					"configurations": {
-						"production": {
-							"fileReplacements": [
-								{
-									"replace": "src/environments/environment.ts",
-									"with": "src/environments/environment.prod.ts"
-								}
-							],
-							"outputPath": "../src/documents/static/frontend/",
-							"optimization": true,
-							"outputHashing": "none",
-							"sourceMap": false,
-							"namedChunks": false,
-							"extractLicenses": true,
-							"vendorChunk": false,
-							"buildOptimizer": true,
-							"budgets": [
-								{
-									"type": "initial",
-									"maximumWarning": "2mb",
-									"maximumError": "5mb"
-								},
-								{
-									"type": "anyComponentStyle",
-									"maximumWarning": "6kb",
-									"maximumError": "10kb"
-								}
-							]
-						},
-						"en-US": {
-							"localize": ["en-US"]
-						}
-					},
-					"defaultConfiguration": ""
-				},
-				"serve": {
-					"builder": "@angular-devkit/build-angular:dev-server",
-					"options": {
-						"browserTarget": "paperless-ui:build:en-US"
-					},
-					"configurations": {
-						"production": {
-							"browserTarget": "paperless-ui:build:production"
-						}
-					}
-				},
-				"extract-i18n": {
-					"builder": "@angular-devkit/build-angular:extract-i18n",
-					"options": {
-						"browserTarget": "paperless-ui:build"
-					}
-				},
-				"test": {
-					"builder": "@angular-builders/jest:run",
-					"options": {
-						"tsConfig": "tsconfig.spec.json",
-						"assets": [
-							"src/favicon.ico",
-							"src/apple-touch-icon.png",
-							"src/assets",
-							"src/manifest.webmanifest"
-						],
-						"styles": [
-							"src/styles.scss"
-						],
-						"scripts": []
-					}
-				},
-				"e2e": {
-					"builder": "@cypress/schematic:cypress",
-					"options": {
-						"devServerTarget": "paperless-ui:serve",
-						"watch": true,
-						"headless": false
-					},
-					"configurations": {
-						"production": {
-							"devServerTarget": "paperless-ui:serve:production"
-						}
-					}
-				},
-				"cypress-run": {
-					"builder": "@cypress/schematic:cypress",
-					"options": {
-						"devServerTarget": "paperless-ui:serve"
-					},
-					"configurations": {
-						"production": {
-							"devServerTarget": "paperless-ui:serve:production"
-						}
-					}
-				},
-				"cypress-open": {
-					"builder": "@cypress/schematic:cypress",
-					"options": {
-						"watch": true,
-						"headless": false
-					}
-				}
-			}
-		}
-	},
-	"defaultProject": "paperless-ui"
+  "$schema": "./node_modules/@angular/cli/lib/config/schema.json",
+  "version": 1,
+  "newProjectRoot": "projects",
+  "projects": {
+    "paperless-ui": {
+      "projectType": "application",
+      "schematics": {
+        "@schematics/angular:component": {
+          "style": "scss"
+        }
+      },
+      "root": "",
+      "sourceRoot": "src",
+      "prefix": "app",
+      "i18n": {
+        "sourceLocale": "en-US",
+        "locales": {
+          "ar-AR": "src/locale/messages.ar_AR.xlf",
+          "be-BY": "src/locale/messages.be_BY.xlf",
+          "ca-ES": "src/locale/messages.ca_ES.xlf",
+          "cs-CZ": "src/locale/messages.cs_CZ.xlf",
+          "da-DK": "src/locale/messages.da_DK.xlf",
+          "de-DE": "src/locale/messages.de_DE.xlf",
+          "en-GB": "src/locale/messages.en_GB.xlf",
+          "es-ES": "src/locale/messages.es_ES.xlf",
+          "fi-FI": "src/locale/messages.fi_FI.xlf",
+          "fr-FR": "src/locale/messages.fr_FR.xlf",
+          "it-IT": "src/locale/messages.it_IT.xlf",
+          "lb-LU": "src/locale/messages.lb_LU.xlf",
+          "nl-NL": "src/locale/messages.nl_NL.xlf",
+          "pl-PL": "src/locale/messages.pl_PL.xlf",
+          "pt-BR": "src/locale/messages.pt_BR.xlf",
+          "pt-PT": "src/locale/messages.pt_PT.xlf",
+          "ro-RO": "src/locale/messages.ro_RO.xlf",
+          "ru-RU": "src/locale/messages.ru_RU.xlf",
+          "sl-SI": "src/locale/messages.sl_SI.xlf",
+          "sr-CS": "src/locale/messages.sr_CS.xlf",
+          "sv-SE": "src/locale/messages.sv_SE.xlf",
+          "tr-TR": "src/locale/messages.tr_TR.xlf",
+          "zh-CN": "src/locale/messages.zh_CN.xlf"
+        }
+      },
+      "architect": {
+        "build": {
+          "builder": "@angular-devkit/build-angular:browser",
+          "options": {
+            "outputPath": "dist/paperless-ui",
+            "outputHashing": "none",
+            "index": "src/index.html",
+            "main": "src/main.ts",
+            "polyfills": "src/polyfills.ts",
+            "tsConfig": "tsconfig.app.json",
+            "localize": true,
+            "assets": [
+              "src/favicon.ico",
+              "src/apple-touch-icon.png",
+              "src/assets",
+              "src/manifest.webmanifest",
+              {
+                "glob": "pdf.worker.min.js",
+                "input": "node_modules/pdfjs-dist/build/",
+                "output": "/assets/js/"
+              }
+            ],
+            "styles": [
+              "src/styles.scss"
+            ],
+            "scripts": [],
+            "allowedCommonJsDependencies": [
+              "ng2-pdf-viewer"
+            ],
+            "vendorChunk": true,
+            "extractLicenses": false,
+            "buildOptimizer": false,
+            "sourceMap": true,
+            "optimization": false,
+            "namedChunks": true
+          },
+          "configurations": {
+            "production": {
+              "fileReplacements": [
+                {
+                  "replace": "src/environments/environment.ts",
+                  "with": "src/environments/environment.prod.ts"
+                }
+              ],
+              "outputPath": "../src/documents/static/frontend/",
+              "optimization": true,
+              "outputHashing": "none",
+              "sourceMap": false,
+              "namedChunks": false,
+              "extractLicenses": true,
+              "vendorChunk": false,
+              "buildOptimizer": true,
+              "budgets": [
+                {
+                  "type": "initial",
+                  "maximumWarning": "2mb",
+                  "maximumError": "5mb"
+                },
+                {
+                  "type": "anyComponentStyle",
+                  "maximumWarning": "6kb",
+                  "maximumError": "10kb"
+                }
+              ]
+            },
+            "en-US": {
+              "localize": [
+                "en-US"
+              ]
+            }
+          },
+          "defaultConfiguration": ""
+        },
+        "serve": {
+          "builder": "@angular-devkit/build-angular:dev-server",
+          "options": {
+            "browserTarget": "paperless-ui:build:en-US"
+          },
+          "configurations": {
+            "production": {
+              "browserTarget": "paperless-ui:build:production"
+            }
+          }
+        },
+        "extract-i18n": {
+          "builder": "@angular-devkit/build-angular:extract-i18n",
+          "options": {
+            "browserTarget": "paperless-ui:build"
+          }
+        },
+        "test": {
+          "builder": "@angular-builders/jest:run",
+          "options": {
+            "tsConfig": "tsconfig.spec.json",
+            "assets": [
+              "src/favicon.ico",
+              "src/apple-touch-icon.png",
+              "src/assets",
+              "src/manifest.webmanifest"
+            ],
+            "styles": [
+              "src/styles.scss"
+            ],
+            "scripts": []
+          }
+        },
+        "e2e": {
+          "builder": "@cypress/schematic:cypress",
+          "options": {
+            "devServerTarget": "paperless-ui:serve",
+            "watch": true,
+            "headless": false
+          },
+          "configurations": {
+            "production": {
+              "devServerTarget": "paperless-ui:serve:production"
+            }
+          }
+        },
+        "cypress-run": {
+          "builder": "@cypress/schematic:cypress",
+          "options": {
+            "devServerTarget": "paperless-ui:serve"
+          },
+          "configurations": {
+            "production": {
+              "devServerTarget": "paperless-ui:serve:production"
+            }
+          }
+        },
+        "cypress-open": {
+          "builder": "@cypress/schematic:cypress",
+          "options": {
+            "watch": true,
+            "headless": false
+          }
+        },
+        "lint": {
+          "builder": "@angular-eslint/builder:lint",
+          "options": {
+            "lintFilePatterns": [
+              "src/**/*.ts",
+              "src/**/*.html"
+            ]
+          }
+        }
+      }
+    }
+  },
+  "defaultProject": "paperless-ui",
+  "cli": {
+    "schematicCollections": [
+      "@angular-eslint/schematics"
+    ],
+    "analytics": false
+  },
+  "schematics": {
+    "@angular-eslint/schematics:application": {
+      "setParserOptionsProject": true
+    },
+    "@angular-eslint/schematics:library": {
+      "setParserOptionsProject": true
+    }
+  }
 }

src-ui/cypress.config.ts

@@ -2,6 +2,7 @@ import { defineConfig } from 'cypress'
 
 export default defineConfig({
   videosFolder: 'cypress/videos',
+  video: false,
   screenshotsFolder: 'cypress/screenshots',
   fixturesFolder: 'cypress/fixtures',
   e2e: {

src-ui/cypress/e2e/auth/auth.cy.ts

@@ -0,0 +1,68 @@
+describe('settings', () => {
+  beforeEach(() => {
+    // also uses global fixtures from cypress/support/e2e.ts
+
+    // mock restricted permissions
+    cy.intercept('http://localhost:8000/api/ui_settings/', {
+      fixture: 'ui_settings/settings_restricted.json',
+    })
+  })
+
+  it('should not allow user to edit settings', () => {
+    cy.visit('/dashboard')
+    cy.contains('Settings').should('not.exist')
+    cy.visit('/settings').wait(2000)
+    cy.contains("You don't have permissions to do that").should('exist')
+  })
+
+  it('should not allow user to view documents', () => {
+    cy.visit('/dashboard')
+    cy.contains('Documents').should('not.exist')
+    cy.visit('/documents').wait(2000)
+    cy.contains("You don't have permissions to do that").should('exist')
+    cy.visit('/documents/1').wait(2000)
+    cy.contains("You don't have permissions to do that").should('exist')
+  })
+
+  it('should not allow user to view correspondents', () => {
+    cy.visit('/dashboard')
+    cy.contains('Correspondents').should('not.exist')
+    cy.visit('/correspondents').wait(2000)
+    cy.contains("You don't have permissions to do that").should('exist')
+  })
+
+  it('should not allow user to view tags', () => {
+    cy.visit('/dashboard')
+    cy.contains('Tags').should('not.exist')
+    cy.visit('/tags').wait(2000)
+    cy.contains("You don't have permissions to do that").should('exist')
+  })
+
+  it('should not allow user to view document types', () => {
+    cy.visit('/dashboard')
+    cy.contains('Document Types').should('not.exist')
+    cy.visit('/documenttypes').wait(2000)
+    cy.contains("You don't have permissions to do that").should('exist')
+  })
+
+  it('should not allow user to view storage paths', () => {
+    cy.visit('/dashboard')
+    cy.contains('Storage Paths').should('not.exist')
+    cy.visit('/storagepaths').wait(2000)
+    cy.contains("You don't have permissions to do that").should('exist')
+  })
+
+  it('should not allow user to view logs', () => {
+    cy.visit('/dashboard')
+    cy.contains('Logs').should('not.exist')
+    cy.visit('/logs').wait(2000)
+    cy.contains("You don't have permissions to do that").should('exist')
+  })
+
+  it('should not allow user to view tasks', () => {
+    cy.visit('/dashboard')
+    cy.contains('Tasks').should('not.exist')
+    cy.visit('/tasks').wait(2000)
+    cy.contains("You don't have permissions to do that").should('exist')
+  })
+})

src-ui/cypress/e2e/documents/document-detail.cy.ts

@@ -5,11 +5,15 @@ describe('document-detail', () => {
     this.modifiedDocuments = []
 
     cy.fixture('documents/documents.json').then((documentsJson) => {
-      cy.intercept('GET', 'http://localhost:8000/api/documents/1/', (req) => {
-        let response = { ...documentsJson }
-        response = response.results.find((d) => d.id == 1)
-        req.reply(response)
-      })
+      cy.intercept(
+        'GET',
+        'http://localhost:8000/api/documents/1/?full_perms=true',
+        (req) => {
+          let response = { ...documentsJson }
+          response = response.results.find((d) => d.id == 1)
+          req.reply(response)
+        }
+      )
     })
 
     cy.intercept('PUT', 'http://localhost:8000/api/documents/1/', (req) => {
@@ -17,34 +21,34 @@ describe('document-detail', () => {
       req.reply({ result: 'OK' })
     }).as('saveDoc')
 
-    cy.fixture('documents/1/comments.json').then((commentsJson) => {
+    cy.fixture('documents/1/notes.json').then((notesJson) => {
       cy.intercept(
         'GET',
-        'http://localhost:8000/api/documents/1/comments/',
+        'http://localhost:8000/api/documents/1/notes/',
         (req) => {
-          req.reply(commentsJson.filter((c) => c.id != 10)) // 3
+          req.reply(notesJson.filter((c) => c.id != 10)) // 3
         }
       )
 
       cy.intercept(
         'DELETE',
-        'http://localhost:8000/api/documents/1/comments/?id=9',
+        'http://localhost:8000/api/documents/1/notes/?id=9',
         (req) => {
-          req.reply(commentsJson.filter((c) => c.id != 9 && c.id != 10)) // 2
+          req.reply(notesJson.filter((c) => c.id != 9 && c.id != 10)) // 2
         }
       )
 
       cy.intercept(
         'POST',
-        'http://localhost:8000/api/documents/1/comments/',
+        'http://localhost:8000/api/documents/1/notes/',
         (req) => {
-          req.reply(commentsJson) // 4
+          req.reply(notesJson) // 4
         }
       )
     })
 
     cy.viewport(1024, 1024)
-    cy.visit('/documents/1/')
+    cy.visit('/documents/1/').wait('@ui-settings')
   })
 
   it('should activate / deactivate save button when changes are saved', () => {
@@ -66,29 +70,49 @@ describe('document-detail', () => {
     cy.contains('You have unsaved changes').should('not.exist')
   })
 
-  it('should show a list of comments', () => {
-    cy.wait(1000).get('a').contains('Comments').click().wait(1000)
-    cy.get('app-document-comments').find('.card').its('length').should('eq', 3)
+  it('should show a mobile preview', () => {
+    cy.viewport(440, 1000)
+    cy.get('a')
+      .contains('Preview')
+      .scrollIntoView({ offset: { top: 150, left: 0 } })
+      .click()
+    cy.get('pdf-viewer').should('be.visible')
   })
 
-  it('should support comment deletion', () => {
-    cy.wait(1000).get('a').contains('Comments').click().wait(1000)
-    cy.get('app-document-comments')
+  it('should show a list of notes', () => {
+    cy.wait(1000).get('a').contains('Notes').click({ force: true }).wait(1000)
+    cy.get('app-document-notes').find('.card').its('length').should('eq', 3)
+  })
+
+  it('should support note deletion', () => {
+    cy.wait(1000).get('a').contains('Notes').click().wait(1000)
+    cy.get('app-document-notes')
       .find('.card')
       .first()
       .find('button')
       .click({ force: true })
       .wait(500)
-    cy.get('app-document-comments').find('.card').its('length').should('eq', 2)
+    cy.get('app-document-notes').find('.card').its('length').should('eq', 2)
   })
 
-  it('should support comment insertion', () => {
-    cy.wait(1000).get('a').contains('Comments').click().wait(1000)
-    cy.get('app-document-comments')
+  it('should support note insertion', () => {
+    cy.wait(1000).get('a').contains('Notes').click().wait(1000)
+    cy.get('app-document-notes')
       .find('form textarea')
-      .type('Testing new comment')
+      .type('Testing new note')
       .wait(500)
-    cy.get('app-document-comments').find('form button').click().wait(1500)
-    cy.get('app-document-comments').find('.card').its('length').should('eq', 4)
+    cy.get('app-document-notes').find('form button').click().wait(1500)
+    cy.get('app-document-notes').find('.card').its('length').should('eq', 4)
+  })
+
+  it('should support navigation to notes tab by url', () => {
+    cy.visit('/documents/1/notes')
+    cy.get('app-document-notes').should('exist')
+  })
+
+  it('should dynamically update note counts', () => {
+    cy.visit('/documents/1/notes')
+    cy.get('app-document-notes').within(() => cy.contains('Delete').click())
+    cy.get('ul.nav').find('li').contains('Notes').find('.badge').contains('2')
   })
 })

src-ui/cypress/e2e/documents/documents-list.cy.ts

@@ -48,10 +48,34 @@ describe('documents-list', () => {
             (d.tags as Array<number>).includes(tag_id)
           )
           response.count = response.results.length
+        } else if (req.query.hasOwnProperty('correspondent__id__in')) {
+          // filtering e.g. http://localhost:8000/api/documents/?page=1&page_size=50&ordering=-created&correspondent__id__in=9,14
+          const correspondent_ids = req.query['correspondent__id__in']
+            .toString()
+            .split(',')
+            .map((c) => +c)
+          response.results = (documentsJson.results as Array<any>).filter((d) =>
+            correspondent_ids.includes(d.correspondent)
+          )
+          response.count = response.results.length
+        } else if (req.query.hasOwnProperty('correspondent__id__none')) {
+          // filtering e.g. http://localhost:8000/api/documents/?page=1&page_size=50&ordering=-created&correspondent__id__none=9,14
+          const correspondent_ids = req.query['correspondent__id__none']
+            .toString()
+            .split(',')
+            .map((c) => +c)
+          response.results = (documentsJson.results as Array<any>).filter(
+            (d) => !correspondent_ids.includes(d.correspondent)
+          )
+          response.count = response.results.length
         }
 
         req.reply(response)
       })
+
+      cy.intercept('http://localhost:8000/api/documents/selection_data/', {
+        fixture: 'documents/selection_data.json',
+      }).as('selection-data')
     })
 
     cy.viewport(1280, 1024)
@@ -76,6 +100,28 @@ describe('documents-list', () => {
     cy.get('app-document-card-large')
   })
 
+  it('should show partial tag selection', () => {
+    cy.get('app-document-card-small:nth-child(1)').click()
+    cy.get('app-document-card-small:nth-child(4)').click()
+    cy.get('app-bulk-editor button')
+      .contains('Tags')
+      .click()
+      .wait('@selection-data')
+    cy.get('svg.bi-dash').should('be.visible')
+    cy.get('svg.bi-check').should('be.visible')
+  })
+
+  it('should allow bulk removal', () => {
+    cy.get('app-document-card-small:nth-child(1)').click()
+    cy.get('app-document-card-small:nth-child(4)').click()
+    cy.get('app-bulk-editor').within(() => {
+      cy.get('button').contains('Tags').click().wait('@selection-data')
+      cy.get('button').contains('Another Sample Tag').click()
+      cy.get('button').contains('Apply').click()
+    })
+    cy.contains('operation will remove the tag')
+  })
+
   it('should filter tags', () => {
     cy.get('app-filter-editor app-filterable-dropdown[title="Tags"]').within(
       () => {
@@ -86,6 +132,27 @@ describe('documents-list', () => {
     cy.contains('One document')
   })
 
+  it('should filter including multiple correspondents', () => {
+    cy.get('app-filter-editor app-filterable-dropdown[title="Correspondent"]')
+      .click()
+      .within(() => {
+        cy.contains('button', 'ABC Test Correspondent').click()
+        cy.contains('button', 'Corresp 11').click()
+      })
+    cy.contains('3 documents')
+  })
+
+  it('should filter excluding multiple correspondents', () => {
+    cy.get('app-filter-editor app-filterable-dropdown[title="Correspondent"]')
+      .click()
+      .within(() => {
+        cy.contains('button', 'ABC Test Correspondent').click()
+        cy.contains('button', 'Corresp 11').click()
+        cy.contains('label', 'Exclude').click()
+      })
+    cy.contains('One document')
+  })
+
   it('should apply tags', () => {
     cy.get('app-document-card-small:first-of-type').click()
     cy.get('app-bulk-editor app-filterable-dropdown[title="Tags"]').within(

src-ui/cypress/e2e/documents/query-params.cy.ts

@@ -232,6 +232,11 @@ describe('documents query params', () => {
 
   it('should show a list of documents filtered by document type', () => {
     cy.visit('/documents?sort=created&reverse=true&document_type__id=1')
+    cy.contains('2 documents')
+  })
+
+  it('should show a list of documents filtered by multiple correspondents', () => {
+    cy.visit('/documents?sort=created&reverse=true&document_type__id__in=1,2')
     cy.contains('3 documents')
   })
 
@@ -245,9 +250,14 @@ describe('documents query params', () => {
     cy.contains('2 documents')
   })
 
+  it('should show a list of documents filtered by multiple correspondents', () => {
+    cy.visit('/documents?sort=created&reverse=true&correspondent__id__in=9,14')
+    cy.contains('3 documents')
+  })
+
   it('should show a list of documents filtered by no correspondent', () => {
     cy.visit('/documents?sort=created&reverse=true&correspondent__isnull=1')
-    cy.contains('2 documents')
+    cy.contains('One document')
   })
 
   it('should show a list of documents filtered by storage path', () => {

src-ui/cypress/e2e/settings/settings.cy.ts

@@ -37,6 +37,56 @@ describe('settings', () => {
         ).as('savedViews')
       })
 
+      this.newMailAccounts = []
+
+      cy.intercept(
+        'POST',
+        'http://localhost:8000/api/mail_accounts/',
+        (req) => {
+          const newRule = req.body
+          newRule.id = 3
+          this.newMailAccounts.push(newRule) // store this for later
+          req.reply({ result: 'OK' })
+        }
+      ).as('saveAccount')
+
+      cy.fixture('mail_accounts/mail_accounts.json').then(
+        (mailAccountsJson) => {
+          cy.intercept(
+            'GET',
+            'http://localhost:8000/api/mail_accounts/*',
+            (req) => {
+              let response = { ...mailAccountsJson }
+              if (this.newMailAccounts.length) {
+                response.results = response.results.concat(this.newMailAccounts)
+              }
+
+              req.reply(response)
+            }
+          ).as('getAccounts')
+        }
+      )
+
+      this.newMailRules = []
+
+      cy.intercept('POST', 'http://localhost:8000/api/mail_rules/', (req) => {
+        const newRule = req.body
+        newRule.id = 2
+        this.newMailRules.push(newRule) // store this for later
+        req.reply({ result: 'OK' })
+      }).as('saveRule')
+
+      cy.fixture('mail_rules/mail_rules.json').then((mailRulesJson) => {
+        cy.intercept('GET', 'http://localhost:8000/api/mail_rules/*', (req) => {
+          let response = { ...mailRulesJson }
+          if (this.newMailRules.length) {
+            response.results = response.results.concat(this.newMailRules)
+          }
+
+          req.reply(response)
+        }).as('getRules')
+      })
+
       cy.fixture('documents/documents.json').then((documentsJson) => {
         cy.intercept('GET', 'http://localhost:8000/api/documents/1/', (req) => {
           let response = { ...documentsJson }
@@ -48,7 +98,6 @@ describe('settings', () => {
 
     cy.viewport(1024, 1600)
     cy.visit('/settings')
-    cy.wait('@savedViews')
   })
 
   it('should activate / deactivate save button when settings change and are saved', () => {
@@ -64,7 +113,7 @@ describe('settings', () => {
     cy.contains('a', 'Dashboard').click()
     cy.contains('You have unsaved changes')
     cy.contains('button', 'Cancel').click()
-    cy.contains('button', 'Save').click().wait('@savedViews')
+    cy.contains('button', 'Save').click().wait(2000)
     cy.contains('a', 'Dashboard').click()
     cy.contains('You have unsaved changes').should('not.exist')
   })
@@ -77,17 +126,62 @@ describe('settings', () => {
   })
 
   it('should remove saved view from sidebar when unset', () => {
-    cy.contains('a', 'Saved views').click()
+    cy.contains('a', 'Saved views').click().wait(2000)
     cy.get('#show_in_sidebar_1').click()
-    cy.contains('button', 'Save').click().wait('@savedViews')
+    cy.contains('button', 'Save').click().wait('@savedViews').wait(2000)
     cy.contains('li', 'Inbox').should('not.exist')
   })
 
   it('should remove saved view from dashboard when unset', () => {
     cy.contains('a', 'Saved views').click()
     cy.get('#show_on_dashboard_1').click()
-    cy.contains('button', 'Save').click().wait('@savedViews')
+    cy.contains('button', 'Save').click().wait('@savedViews').wait(2000)
     cy.visit('/dashboard')
     cy.get('app-saved-view-widget').contains('Inbox').should('not.exist')
   })
+
+  it('should show a list of mail accounts & support creation', () => {
+    cy.contains('a', 'Mail').click()
+    cy.get('app-settings .tab-content ul li').its('length').should('eq', 5) // 2 headers, 2 accounts, 1 rule
+    cy.contains('button', 'Add Account').click()
+    cy.contains('Create new mail account')
+    cy.get('app-input-text[formcontrolname="name"]').type(
+      'Example Mail Account'
+    )
+    cy.get('app-input-text[formcontrolname="imap_server"]').type(
+      'mail.example.com'
+    )
+    cy.get('app-input-text[formcontrolname="imap_port"]').type('993')
+    cy.get('app-input-text[formcontrolname="username"]').type('username')
+    cy.get('app-input-password[formcontrolname="password"]').type('pass')
+    cy.contains('app-mail-account-edit-dialog button', 'Save')
+      .click()
+      .wait('@saveAccount')
+      .wait('@getAccounts')
+    cy.contains('Saved account')
+
+    cy.get('app-settings .tab-content ul li').its('length').should('eq', 6)
+  })
+
+  it('should show a list of mail rules & support creation', () => {
+    cy.contains('a', 'Mail').click()
+    cy.get('app-settings .tab-content ul li').its('length').should('eq', 5) // 2 headers, 2 accounts, 1 rule
+
+    cy.wait(1000)
+    cy.contains('button', 'Add Rule').click()
+    cy.contains('Create new mail rule')
+    cy.get('app-input-text[formcontrolname="name"]').type('Example Rule')
+    cy.get('app-input-select[formcontrolname="account"]').type('Example{enter}')
+    cy.get('app-input-number[formcontrolname="maximum_age"]').type('30')
+    cy.get('app-input-text[formcontrolname="filter_subject"]').type(
+      '[paperless]'
+    )
+    cy.contains('app-mail-rule-edit-dialog button', 'Save')
+      .click()
+      .wait('@saveRule')
+      .wait('@getRules')
+    cy.contains('Saved rule').wait(1000)
+
+    cy.get('app-settings .tab-content ul li').its('length').should('eq', 6)
+  })
 })

src-ui/cypress/fixtures/correspondents/correspondents.json

@@ -1 +1,257 @@
-{"count":27,"next":"http://localhost:8000/api/correspondents/?page=2","previous":null,"results":[{"id":9,"slug":"abc-test-correspondent","name":"ABC Test Correspondent","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":13,"slug":"corresp-10","name":"Corresp 10","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":14,"slug":"corresp-11","name":"Corresp 11","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":15,"slug":"corresp-12","name":"Corresp 12","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":16,"slug":"corresp-13","name":"Corresp 13","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":18,"slug":"corresp-15","name":"Corresp 15","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":19,"slug":"corresp-16","name":"Corresp 16","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":20,"slug":"corresp-17","name":"Corresp 17","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":21,"slug":"corresp-18","name":"Corresp 18","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":22,"slug":"corresp-19","name":"Corresp 19","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":23,"slug":"corresp-20","name":"Corresp 20","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":24,"slug":"corresp-21","name":"Corresp 21","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":25,"slug":"corresp-22","name":"Corresp 22","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":26,"slug":"corresp-23","name":"Corresp 23","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":5,"slug":"corresp-3","name":"Corresp 3","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":6,"slug":"corresp-4","name":"Corresp 4","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":7,"slug":"corresp-5","name":"Corresp 5","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":8,"slug":"corresp-6","name":"Corresp 6","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":10,"slug":"corresp-7","name":"Corresp 7","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":11,"slug":"corresp-8","name":"Corresp 8","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":12,"slug":"corresp-9","name":"Corresp 9","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":17,"slug":"correspondent-14","name":"Correspondent 14","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0,"last_correspondence":null},{"id":2,"slug":"correspondent-2","name":"Correspondent 2","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":7,"last_correspondence":"2021-01-20T23:37:58.204614Z"},{"id":27,"slug":"michael-shamoon","name":"Michael Shamoon","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":1,"last_correspondence":"2022-03-16T03:48:50.089624Z"},{"id":4,"slug":"newest-correspondent","name":"Newest Correspondent","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":1,"last_correspondence":"2021-02-07T08:00:00Z"}]}
+{
+    "count": 27,
+    "next": "http://localhost:8000/api/correspondents/?page=2",
+    "previous": null,
+    "results": [
+        {
+            "id": 9,
+            "slug": "abc-test-correspondent",
+            "name": "ABC Test Correspondent",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 13,
+            "slug": "corresp-10",
+            "name": "Corresp 10",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 14,
+            "slug": "corresp-11",
+            "name": "Corresp 11",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 15,
+            "slug": "corresp-12",
+            "name": "Corresp 12",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 16,
+            "slug": "corresp-13",
+            "name": "Corresp 13",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 18,
+            "slug": "corresp-15",
+            "name": "Corresp 15",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 19,
+            "slug": "corresp-16",
+            "name": "Corresp 16",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 20,
+            "slug": "corresp-17",
+            "name": "Corresp 17",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 21,
+            "slug": "corresp-18",
+            "name": "Corresp 18",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 22,
+            "slug": "corresp-19",
+            "name": "Corresp 19",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 23,
+            "slug": "corresp-20",
+            "name": "Corresp 20",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 24,
+            "slug": "corresp-21",
+            "name": "Corresp 21",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 25,
+            "slug": "corresp-22",
+            "name": "Corresp 22",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 26,
+            "slug": "corresp-23",
+            "name": "Corresp 23",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 5,
+            "slug": "corresp-3",
+            "name": "Corresp 3",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 6,
+            "slug": "corresp-4",
+            "name": "Corresp 4",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 7,
+            "slug": "corresp-5",
+            "name": "Corresp 5",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 8,
+            "slug": "corresp-6",
+            "name": "Corresp 6",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 10,
+            "slug": "corresp-7",
+            "name": "Corresp 7",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 11,
+            "slug": "corresp-8",
+            "name": "Corresp 8",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 12,
+            "slug": "corresp-9",
+            "name": "Corresp 9",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 17,
+            "slug": "correspondent-14",
+            "name": "Correspondent 14",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 0,
+            "last_correspondence": null
+        },
+        {
+            "id": 2,
+            "slug": "correspondent-2",
+            "name": "Correspondent 2",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 7,
+            "last_correspondence": "2021-01-20T23:37:58.204614Z"
+        },
+        {
+            "id": 27,
+            "slug": "correspondent-slug",
+            "name": "Correspondent Slug",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 1,
+            "last_correspondence": "2022-03-16T03:48:50.089624Z"
+        },
+        {
+            "id": 4,
+            "slug": "newest-correspondent",
+            "name": "Newest Correspondent",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 1,
+            "last_correspondence": "2021-02-07T08:00:00Z"
+        }
+    ]
+}

src-ui/cypress/fixtures/document_types/doctypes.json

@@ -1 +1,25 @@
-{"count":1,"next":null,"previous":null,"results":[{"id":1,"slug":"test","name":"Test Doc Type","match":"","matching_algorithm":1,"is_insensitive":true,"document_count":0}]}
+{
+    "count": 2,
+    "next": null,
+    "previous": null,
+    "results": [
+        {
+            "id": 1,
+            "slug": "test",
+            "name": "Test Doc Type",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 1
+        },
+        {
+            "id": 2,
+            "slug": "test2",
+            "name": "Test Doc Type 2",
+            "match": "",
+            "matching_algorithm": 1,
+            "is_insensitive": true,
+            "document_count": 1
+        }
+    ]
+}

src-ui/cypress/fixtures/documents/1/comments.json

@@ -1,46 +0,0 @@
-[
-    {
-        "id": 10,
-        "comment": "Testing new comment",
-        "created": "2022-08-08T04:24:55.176008Z",
-        "user": {
-            "id": 1,
-            "username": "user2",
-            "firstname": "",
-            "lastname": ""
-        }
-    },
-    {
-        "id": 9,
-        "comment": "Testing one more time",
-        "created": "2022-02-18T04:24:55.176008Z",
-        "user": {
-            "id": 2,
-            "username": "user1",
-            "firstname": "",
-            "lastname": ""
-        }
-    },
-    {
-        "id": 8,
-        "comment": "Another comment",
-        "created": "2021-11-08T04:24:47.925042Z",
-        "user": {
-            "id": 2,
-            "username": "user33",
-            "firstname": "",
-            "lastname": ""
-        }
-    },
-    {
-        "id": 7,
-        "comment": "Cupcake ipsum dolor sit amet cheesecake candy cookie tiramisu. Donut chocolate chupa chups macaroon brownie halvah pie cheesecake gummies. Sweet chocolate bar candy donut gummi bears bear claw liquorice bonbon shortbread.\n\nDonut chocolate bar candy wafer wafer tiramisu. Gummies chocolate cake muffin toffee carrot cake macaroon. Toffee toffee jelly beans danish lollipop cake.",
-        "created": "2021-02-08T02:37:49.724132Z",
-        "user": {
-            "id": 3,
-            "username": "admin",
-            "firstname": "",
-            "lastname": ""
-        }
-    }
-]

src-ui/cypress/fixtures/documents/1/notes.json

@@ -0,0 +1,26 @@
+[
+    {
+        "id": 10,
+        "note": "Testing new note",
+        "created": "2022-08-08T04:24:55.176008Z",
+        "user": 3
+    },
+    {
+        "id": 9,
+        "note": "Testing one more time",
+        "created": "2022-02-18T04:24:55.176008Z",
+        "user": 15
+    },
+    {
+        "id": 8,
+        "note": "Another note",
+        "created": "2021-11-08T04:24:47.925042Z",
+        "user": 3
+    },
+    {
+        "id": 7,
+        "note": "Cupcake ipsum dolor sit amet cheesecake candy cookie tiramisu. Donut chocolate chupa chups macaroon brownie halvah pie cheesecake gummies. Sweet chocolate bar candy donut gummi bears bear claw liquorice bonbon shortbread.\n\nDonut chocolate bar candy wafer wafer tiramisu. Gummies chocolate cake muffin toffee carrot cake macaroon. Toffee toffee jelly beans danish lollipop cake.",
+        "created": "2021-02-08T02:37:49.724132Z",
+        "user": 3
+    }
+]