Delete unused docker/docker-entrypoint.sh

---------

Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: shamoon <4887959+shamoon@users.noreply.github.com>

.codecov.yml

@@ -1,19 +1,22 @@
 codecov:
   require_ci_to_pass: true
-# https://docs.codecov.com/docs/flags#recommended-automatic-flag-management
-# Require each flag to have 1 upload before notification
-flag_management:
-  individual_flags:
-    - name: backend
+  # https://docs.codecov.com/docs/components
+component_management:
+  individual_components:
+    - component_id: backend
       paths:
-        - src/
-    - name: frontend
+        - src/**
+    - component_id: frontend
       paths:
-        - src-ui/
+        - src-ui/**
 # https://docs.codecov.com/docs/pull-request-comments
 # codecov will only comment if coverage changes
 comment:
+  layout: "header, diff, components, flags, files"
   require_changes: true
+  # https://docs.codecov.com/docs/javascript-bundle-analysis
+  require_bundle_changes: true
+  bundle_change_threshold: "50Kb"
 coverage:
   status:
     project:
@@ -22,7 +25,12 @@ coverage:
         threshold: 1%
     patch:
       default:
-        # For the changed lines only, target 75% covered, but
-        # allow as low as 50%
-        target: 75%
+        # For the changed lines only, target 100% covered, but
+        # allow as low as 75%
+        target: 100%
         threshold: 25%
+# https://docs.codecov.com/docs/javascript-bundle-analysis
+bundle_analysis:
+  # Fail if the bundle size increases by more than 1MB
+  warning_threshold: "1MB"
+  status: true

.codespellrc

@@ -0,0 +1,3 @@
+[codespell]
+write-changes = True
+ignore-words-list = criterias,afterall,valeu,ureue,equest,ure,assertIn

.devcontainer/Dockerfile

@@ -0,0 +1,175 @@
+# syntax=docker/dockerfile:1
+
+FROM --platform=$BUILDPLATFORM docker.io/node:20-bookworm-slim as main-app
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+# Buildx provided, must be defined to use though
+ARG TARGETARCH
+
+# Can be workflow provided, defaults set for manual building
+ARG JBIG2ENC_VERSION=0.29
+ARG QPDF_VERSION=11.9.0
+ARG GS_VERSION=10.03.1
+
+# Set Python environment variables
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    # Ignore warning from Whitenoise
+    PYTHONWARNINGS="ignore:::django.http.response:517" \
+    PNGX_CONTAINERIZED=1
+
+#
+# Begin installation and configuration
+# Order the steps below from least often changed to most
+#
+
+# Packages need for running
+ARG RUNTIME_PACKAGES="\
+  # General utils
+  curl \
+  # Docker specific
+  gosu \
+  # Timezones support
+  tzdata \
+  # fonts for text file thumbnail generation
+  fonts-liberation \
+  gettext \
+  ghostscript \
+  gnupg \
+  icc-profiles-free \
+  imagemagick \
+  # PostgreSQL
+  postgresql-client \
+  # MySQL / MariaDB
+  mariadb-client \
+  # OCRmyPDF dependencies
+  tesseract-ocr \
+  tesseract-ocr-eng \
+  tesseract-ocr-deu \
+  tesseract-ocr-fra \
+  tesseract-ocr-ita \
+  tesseract-ocr-spa \
+  unpaper \
+  pngquant \
+  jbig2dec \
+  # lxml
+  libxml2 \
+  libxslt1.1 \
+  # itself
+  qpdf \
+  # Mime type detection
+  file \
+  libmagic1 \
+  media-types \
+  zlib1g \
+  # Barcode splitter
+  libzbar0 \
+  poppler-utils \
+  htop \
+  sudo"
+
+# Install basic runtime packages.
+# These change very infrequently
+RUN set -eux \
+  echo "Installing system packages" \
+    && apt-get update \
+    && apt-get install --yes --quiet --no-install-recommends ${RUNTIME_PACKAGES}
+
+ARG PYTHON_PACKAGES="ca-certificates"
+
+RUN set -eux \
+  echo "Installing python packages" \
+    && apt-get update \
+    && apt-get install --yes --quiet ${PYTHON_PACKAGES}
+
+COPY --from=ghcr.io/astral-sh/uv:0.6 /uv /bin/uv
+
+RUN set -eux \
+  && echo "Installing pre-built updates" \
+    && echo "Installing qpdf ${QPDF_VERSION}" \
+      && curl --fail --silent --show-error --location \
+        --output libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+      && curl --fail --silent --show-error --location \
+        --output qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+      && dpkg --install ./libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+      && dpkg --install ./qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+    && echo "Installing Ghostscript ${GS_VERSION}" \
+      && curl --fail --silent --show-error --location \
+          --output libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+          https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+      && curl --fail --silent --show-error --location \
+          --output ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+          https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+      && curl --fail --silent --show-error --location \
+          --output libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
+          https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
+        && dpkg --install ./libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
+        && dpkg --install ./libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+        && dpkg --install ./ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+    && echo "Installing jbig2enc" \
+      && curl --fail --silent --show-error --location \
+        --output jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/jbig2enc-${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
+      && dpkg --install ./jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb
+
+# setup docker-specific things
+# These change sometimes, but rarely
+WORKDIR /usr/src/paperless/src/docker/
+
+COPY [ \
+  "docker/rootfs/etc/ImageMagick-6/paperless-policy.xml", \
+  "./" \
+]
+
+RUN set -eux \
+  && echo "Configuring ImageMagick" \
+    && mv paperless-policy.xml /etc/ImageMagick-6/policy.xml
+
+COPY --from=ghcr.io/astral-sh/uv:0.6 /uv /bin/uv
+
+# Packages needed only for building a few quick Python
+# dependencies
+ARG BUILD_PACKAGES="\
+  build-essential \
+  git \
+  # https://www.psycopg.org/docs/install.html#prerequisites
+  libpq-dev \
+  # https://github.com/PyMySQL/mysqlclient#linux
+  default-libmysqlclient-dev \
+  pkg-config"
+
+# hadolint ignore=DL3042
+RUN --mount=type=cache,target=/root/.cache/uv,id=pip-cache \
+  set -eux \
+  && echo "Installing build system packages" \
+    && apt-get update \
+    && apt-get install --yes --quiet ${BUILD_PACKAGES}
+
+RUN set -eux \
+  && npm update -g pnpm
+
+# add users, setup scripts
+# Mount the compiled frontend to expected location
+RUN set -eux \
+  && echo "Setting up user/group" \
+    && groupmod --new-name paperless node \
+    && usermod --login paperless --home /usr/src/paperless node \
+    && usermod -s /bin/bash paperless \
+    && echo "paperless ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers \
+  && echo "Creating volume directories" \
+    && mkdir --parents --verbose /usr/src/paperless/paperless-ngx/data \
+    && mkdir --parents --verbose /usr/src/paperless/paperless-ngx/media \
+    && mkdir --parents --verbose /usr/src/paperless/paperless-ngx/consume \
+    && mkdir --parents --verbose /usr/src/paperless/paperless-ngx/export \
+    && mkdir --parents --verbose /usr/src/paperless/paperless-ngx/.venv \
+  && echo "Adjusting all permissions" \
+    && chown --from root:root --changes --recursive paperless:paperless /usr/src/paperless
+
+VOLUME ["/usr/src/paperless/paperless-ngx/data", \
+        "/usr/src/paperless/paperless-ngx/media", \
+        "/usr/src/paperless/paperless-ngx/consume", \
+        "/usr/src/paperless/paperless-ngx/export", \
+        "/usr/src/paperless/paperless-ngx/.venv"]

.devcontainer/README.md

@@ -0,0 +1,117 @@
+# Paperless-ngx Development Environment
+
+## Overview
+
+Welcome to the Paperless-ngx development environment! This setup uses VSCode DevContainers to provide a consistent and seamless development experience.
+
+### What are DevContainers?
+
+DevContainers are a feature in VSCode that allows you to develop within a Docker container. This ensures that your development environment is consistent across different machines and setups. By defining a containerized environment, you can eliminate the "works on my machine" problem.
+
+### Advantages of DevContainers
+
+- **Consistency**: Same environment for all developers.
+- **Isolation**: Separate development environment from your local machine.
+- **Reproducibility**: Easily recreate the environment on any machine.
+- **Pre-configured Tools**: Include all necessary tools and dependencies in the container.
+
+## DevContainer Setup
+
+The DevContainer configuration provides up all the necessary services for Paperless-ngx, including:
+
+- Redis
+- Gotenberg
+- Tika
+
+Data is stored using Docker volumes to ensure persistence across container restarts.
+
+## Configuration Files
+
+The setup includes debugging configurations (`launch.json`) and tasks (`tasks.json`) to help you manage and debug various parts of the project:
+
+- **Backend Debugging:**
+  - `manage.py runserver`
+  - `manage.py document-consumer`
+  - `celery`
+- **Maintenance Tasks:**
+  - Create superuser
+  - Run migrations
+  - Recreate virtual environment (`.venv` with `uv`)
+  - Compile frontend assets
+
+## Getting Started
+
+### Step 1: Running the DevContainer
+
+To start the DevContainer:
+
+1. Open VSCode.
+2. Open the project folder.
+3. Open the command palette:
+   - **Windows/Linux**: `Ctrl+Shift+P`
+   - **Mac**: `Cmd+Shift+P`
+4. Type and select `Dev Containers: Rebuild and Reopen in Container`.
+
+VSCode will build and start the DevContainer environment.
+
+### Step 2: Initial Setup
+
+Once the DevContainer is up and running, perform the following steps:
+
+1. **Compile Frontend Assets**:
+
+   - Open the command palette:
+     - **Windows/Linux**: `Ctrl+Shift+P`
+     - **Mac**: `Cmd+Shift+P`
+   - Select `Tasks: Run Task`.
+   - Choose `Frontend Compile`.
+
+2. **Run Database Migrations**:
+
+   - Open the command palette:
+     - **Windows/Linux**: `Ctrl+Shift+P`
+     - **Mac**: `Cmd+Shift+P`
+   - Select `Tasks: Run Task`.
+   - Choose `Migrate Database`.
+
+3. **Create Superuser**:
+   - Open the command palette:
+     - **Windows/Linux**: `Ctrl+Shift+P`
+     - **Mac**: `Cmd+Shift+P`
+   - Select `Tasks: Run Task`.
+   - Choose `Create Superuser`.
+
+### Debugging and Running Services
+
+You can start and debug backend services either as debugging sessions via `launch.json` or as tasks.
+
+#### Using `launch.json`
+
+1. Press `F5` or go to the **Run and Debug** view in VSCode.
+2. Select the desired configuration:
+   - `Runserver`
+   - `Document Consumer`
+   - `Celery`
+
+#### Using Tasks
+
+1. Open the command palette:
+   - **Windows/Linux**: `Ctrl+Shift+P`
+   - **Mac**: `Cmd+Shift+P`
+2. Select `Tasks: Run Task`.
+3. Choose the desired task:
+   - `Runserver`
+   - `Document Consumer`
+   - `Celery`
+
+### Additional Maintenance Tasks
+
+Additional tasks are available for common maintenance operations:
+
+- **Recreate .venv**: For setting up the virtual environment using `uv`.
+- **Migrate Database**: To apply database migrations.
+- **Create Superuser**: To create an admin user for the application.
+
+## Let's Get Started!
+
+Follow the steps above to get your development environment up and running. Happy coding!

.devcontainer/devcontainer.json

@@ -0,0 +1,28 @@
+{
+    "name": "Paperless Development",
+    "dockerComposeFile": "docker-compose.devcontainer.sqlite-tika.yml",
+    "service": "paperless-development",
+    "workspaceFolder": "/usr/src/paperless/paperless-ngx",
+    "postCreateCommand": "/bin/bash -c 'uv sync --group dev && uv run pre-commit install'",
+    "customizations": {
+        "vscode": {
+          "extensions": [
+            "mhutchie.git-graph",
+            "ms-python.python",
+            "ms-vscode.js-debug-nightly",
+            "eamodio.gitlens",
+            "yzhang.markdown-all-in-one"
+          ],
+          "settings": {
+            "python.defaultInterpreterPath": "/usr/src/paperless/paperless-ngx/.venv/bin/python",
+            "python.pythonPath": "/usr/src/paperless/paperless-ngx/.venv/bin/python",
+            "python.terminal.activateEnvInCurrentTerminal": true,
+            "editor.formatOnPaste": false,
+            "editor.formatOnSave": true,
+            "editor.formatOnType": true,
+            "files.trimTrailingWhitespace": true
+          }
+        }
+      },
+      "remoteUser": "paperless"
+    }

.devcontainer/docker-compose.devcontainer.sqlite-tika.yml

@@ -0,0 +1,86 @@
+# Docker Compose file for developing Paperless NGX in VSCode DevContainers.
+# This file contains everything Paperless NGX needs to run.
+# Paperless supports amd64, arm, and arm64 hardware.
+# All compose files of Paperless configure it in the following way:
+#
+# - Paperless is (re)started on system boot if it was running before shutdown.
+# - Docker volumes for storing data are managed by Docker.
+# - Folders for importing and exporting files are created in the same directory
+#   as this file and mounted to the correct folders inside the container.
+# - Paperless listens on port 8000.
+#
+# SQLite is used as the database. The SQLite file is stored in the data volume.
+#
+# In addition, this Docker Compose file adds the following optional
+# configurations:
+#
+# - Apache Tika and Gotenberg servers are started with Paperless NGX and Paperless
+#   is configured to use these services. These provide support for consuming
+#   Office documents (Word, Excel, PowerPoint, and their LibreOffice counterparts).
+#
+# This file is intended only to be used through VSCOde devcontainers. See README.md
+# in the folder .devcontainer.
+
+
+services:
+  broker:
+    image: docker.io/library/redis:7
+    restart: unless-stopped
+    volumes:
+      - ./redisdata:/data
+
+  # No ports need to be exposed; the VSCode DevContainer plugin manages them.
+  paperless-development:
+    image: paperless-ngx
+    build:
+      context: ../    # Dockerfile cannot access files from parent directories if context is not set.
+      dockerfile: ./.devcontainer/Dockerfile
+    restart: unless-stopped
+    depends_on:
+      - broker
+      - gotenberg
+      - tika
+    volumes:
+      - ..:/usr/src/paperless/paperless-ngx:delegated
+      - ../.devcontainer/vscode:/usr/src/paperless/paperless-ngx/.vscode:delegated # VSCode config files
+      - virtualenv:/usr/src/paperless/paperless-ngx/.venv # Virtual environment persisted in volume
+      - /usr/src/paperless/paperless-ngx/src/documents/static/frontend # Static frontend files exist only in container
+      - /usr/src/paperless/paperless-ngx/src/.pytest_cache
+      - /usr/src/paperless/paperless-ngx/.ruff_cache
+      - /usr/src/paperless/paperless-ngx/htmlcov
+      - /usr/src/paperless/paperless-ngx/.coverage
+      - ./data:/usr/src/paperless/paperless-ngx/data
+      - ./media:/usr/src/paperless/paperless-ngx/media
+      - ./consume:/usr/src/paperless/paperless-ngx/consume
+      - ~/.gitconfig:/usr/src/paperless/.gitconfig:ro
+    environment:
+      PAPERLESS_REDIS: redis://broker:6379
+      PAPERLESS_TIKA_ENABLED: 1
+      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
+      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
+      PAPERLESS_STATICDIR: ./src/documents/static
+      PAPERLESS_DEBUG: true
+
+    # Overrides default command so things don't shut down after the process ends.
+    command: /bin/sh -c "chown -R paperless:paperless /usr/src/paperless/paperless-ngx/src/documents/static/frontend && chown -R paperless:paperless /usr/src/paperless/paperless-ngx/.ruff_cache && while sleep 1000; do :; done"
+
+  gotenberg:
+    image: docker.io/gotenberg/gotenberg:8.17
+    restart: unless-stopped
+
+    # The Gotenberg Chromium route is used to convert .eml files. We do not
+    # want to allow external content like tracking pixels or even JavaScript.
+    command:
+      - "gotenberg"
+      - "--chromium-disable-javascript=true"
+      - "--chromium-allow-list=file:///tmp/.*"
+
+  tika:
+    image: docker.io/apache/tika:latest
+    restart: unless-stopped
+
+volumes:
+  data:
+  media:
+  redisdata:
+  virtualenv:

.devcontainer/vscode/launch.json

@@ -0,0 +1,58 @@
+{
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "name": "Chrome: Debug Angular Frontend",
+						"description": "Debug the Angular Dev Frontend in Chrome",
+            "type": "chrome",
+            "request": "launch",
+            "url": "http://localhost:4200",
+            "webRoot": "${workspaceFolder}/src-ui",
+            "preLaunchTask": "Start: Frontend Angular"
+        },
+        {
+            "name": "Debug: Backend Server (manage.py runserver)",
+						"description": "Debug the Django Backend Server",
+            "type": "python",
+            "request": "launch",
+            "program": "${workspaceFolder}/src/manage.py",
+            "args": [
+                "runserver"
+            ],
+            "django": true,
+            "console": "integratedTerminal",
+            "env": {
+                "PYTHONPATH": "${workspaceFolder}/src"
+            },
+            "python": "${workspaceFolder}/.venv/bin/python"
+        },
+        {
+            "name": "Debug: Consumer Service (manage.py document_consumer)",
+						"description": "Debug the Consumer Service which processes files from a directory",
+            "type": "python",
+            "request": "launch",
+            "program": "${workspaceFolder}/src/manage.py",
+            "args": [
+                "document_consumer"
+            ],
+            "django": true,
+            "console": "integratedTerminal",
+            "env": {
+                "PYTHONPATH": "${workspaceFolder}/src"
+            },
+            "python": "${workspaceFolder}/.venv/bin/python"
+        }
+    ],
+    "compounds": [
+        {
+            "name": "Debug: FullStack",
+						"description": "Debug run the Angular dev frontend, Django backend, and consumer service",
+            "configurations": [
+                "Chrome: Debug Angular Frontend",
+                "Debug: Backend Server (manage.py runserver)",
+                "Debug: Consumer Service (manage.py document_consumer)"
+            ],
+            "preLaunchTask": "Start: Celery Worker"
+        }
+    ]
+}

.devcontainer/vscode/settings.json

@@ -0,0 +1,11 @@
+{
+    "python.testing.pytestArgs": [
+        "src"
+    ],
+    "python.testing.unittestEnabled": false,
+    "python.testing.pytestEnabled": true,
+    "files.watcherExclude": {
+        "**/.venv/**": true,
+        "**/pytest_cache/**": true
+    }
+}

.devcontainer/vscode/tasks.json

@@ -0,0 +1,223 @@
+{
+	"version": "2.0.0",
+	"tasks": [
+		{
+			"label": "Start: Celery Worker",
+			"description": "Start the Celery Worker which processes background and consume tasks",
+			"type": "shell",
+			"command": "uv run celery --app paperless worker -l DEBUG",
+			"isBackground": true,
+			"options": {
+				"cwd": "${workspaceFolder}/src"
+			},
+			"problemMatcher": [
+				{
+					"owner": "custom",
+					"pattern": [
+						{
+							"regexp": ".",
+							"file": 1,
+							"location": 2,
+							"message": 3
+						}
+					],
+					"background": {
+						"activeOnStart": true,
+						"beginsPattern": "celery.*",
+						"endsPattern": "ready"
+					}
+				}
+			]
+		},
+		{
+			"label": "Start: Frontend Angular",
+			"description": "Start the Frontend Angular Dev Server",
+			"type": "shell",
+			"command": "pnpm start",
+			"isBackground": true,
+			"options": {
+				"cwd": "${workspaceFolder}/src-ui"
+			},
+			"problemMatcher": [
+				{
+					"owner": "custom",
+					"pattern": [
+						{
+							"regexp": ".",
+							"file": 1,
+							"location": 2,
+							"message": 3
+						}
+					],
+					"background": {
+						"activeOnStart": true,
+						"beginsPattern": ".*",
+						"endsPattern": "Compiled successfully"
+					}
+				}
+			]
+		},
+		{
+			"label": "Start: Consumer Service (manage.py document_consumer)",
+			"description": "Start the Consumer Service which processes files from a directory",
+			"type": "shell",
+			"command": "uv run python manage.py document_consumer",
+			"group": "build",
+			"presentation": {
+				"echo": true,
+				"reveal": "always",
+				"focus": false,
+				"panel": "shared",
+				"showReuseMessage": false,
+				"clear": true,
+				"revealProblems": "onProblem"
+			},
+			"options": {
+				"cwd": "${workspaceFolder}/src"
+			}
+		},
+		{
+			"label": "Start: Backend Server (manage.py runserver)",
+			"description": "Start the Backend Server which serves the Django API and the compiled Angular frontend",
+			"type": "shell",
+			"command": "uv run python manage.py runserver",
+			"group": "build",
+			"presentation": {
+				"echo": true,
+				"reveal": "always",
+				"focus": false,
+				"panel": "shared",
+				"showReuseMessage": false,
+				"clear": true,
+				"revealProblems": "onProblem"
+			},
+			"options": {
+				"cwd": "${workspaceFolder}/src"
+			}
+		},
+		{
+			"label": "Maintenance: manage.py migrate",
+			"description": "Apply database migrations",
+			"type": "shell",
+			"command": "uv run python manage.py migrate",
+			"group": "none",
+			"presentation": {
+				"echo": true,
+				"reveal": "always",
+				"focus": true,
+				"panel": "shared",
+				"showReuseMessage": false,
+				"clear": true,
+				"revealProblems": "onProblem"
+			},
+			"options": {
+				"cwd": "${workspaceFolder}/src"
+			}
+		},
+		{
+			"label": "Maintenance: Build Documentation",
+			"description": "Build the documentation with MkDocs",
+			"type": "shell",
+			"command": "uv run mkdocs build --config-file mkdocs.yml && uv run mkdocs serve",
+			"group": "none",
+			"presentation": {
+				"echo": true,
+				"reveal": "always",
+				"focus": true,
+				"panel": "shared",
+				"showReuseMessage": false,
+				"clear": true,
+				"revealProblems": "onProblem"
+			},
+			"options": {
+				"cwd": "${workspaceFolder}"
+			}
+		},
+		{
+			"label": "Maintenance: manage.py createsuperuser",
+			"description": "Create a superuser",
+			"type": "shell",
+			"command": "uv run python manage.py createsuperuser",
+			"group": "none",
+			"presentation": {
+				"echo": true,
+				"reveal": "always",
+				"focus": true,
+				"panel": "shared",
+				"showReuseMessage": false,
+				"clear": true,
+				"revealProblems": "onProblem"
+			},
+			"options": {
+				"cwd": "${workspaceFolder}/src"
+			}
+		},
+		{
+			"label": "Maintenance: recreate .venv",
+			"description": "Recreate the python virtual environment and install python dependencies",
+			"type": "shell",
+			"command": "rm -R -v .venv/* || uv install --dev",
+			"group": "none",
+			"presentation": {
+				"echo": true,
+				"reveal": "always",
+				"focus": true,
+				"panel": "shared",
+				"showReuseMessage": false,
+				"clear": true,
+				"revealProblems": "onProblem"
+			},
+			"options": {
+				"cwd": "${workspaceFolder}"
+			}
+		},
+		{
+			"label": "Maintenance: Install Frontend Dependencies",
+			"description": "Install frontend (pnpm) dependencies",
+			"type": "pnpm",
+			"script": "install",
+			"path": "src-ui",
+			"group": "clean",
+			"problemMatcher": [],
+			"detail": "install dependencies from package"
+		},
+		{
+			"description": "Clean install frontend dependencies and build the frontend for production",
+			"label": "Maintenance: Compile frontend for production",
+			"type": "shell",
+			"command": "pnpm install && ./node_modules/.bin/ng build --configuration production",
+			"group": "none",
+			"presentation": {
+				"echo": true,
+				"reveal": "always",
+				"focus": true,
+				"panel": "shared",
+				"showReuseMessage": false,
+				"clear": true,
+				"revealProblems": "onProblem"
+			},
+			"options": {
+				"cwd": "${workspaceFolder}/src-ui"
+			}
+		},
+		{
+			"label": "Project Setup: Run all Init Tasks",
+			"description": "Runs all init tasks to setup the project including migrate the database, create a superuser and compile the frontend for production",
+			"dependsOrder": "sequence",
+			"dependsOn": [
+				"Maintenance: manage.py migrate",
+				"Maintenance: manage.py createsuperuser",
+				"Maintenance: Compile frontend for production"
+			]
+		},
+		{
+			"label": "Project Start: Run all Services",
+			"description": "Runs all services required to start the project including the Celery Worker, the Consumer Service and the Backend Server",
+			"dependsOn": [
+				"Start: Celery Worker",
+				"Start: Consumer Service (manage.py document_consumer)",
+				"Start: Backend Server (manage.py runserver)"
+			]
+		}
+	]
+}

.dockerignore

@@ -26,3 +26,5 @@
 ./dist
 ./scripts
 ./resources
+# Other stuff
+**/*.drawio.png

.editorconfig

@@ -27,9 +27,6 @@ indent_style = space
 [*.md]
 indent_style = space
 
-[Pipfile.lock]
-indent_style = space
-
 # Tests don't get a line width restriction.  It's still a good idea to follow
 # the 79 character rule, but in the interests of clarity, tests often need to
 # violate it.

.env

@@ -1,2 +1 @@
 COMPOSE_PROJECT_NAME=paperless
-export PROMPT="(pipenv-projectname)$P$G"

.github/FUNDING.yml

@@ -0,0 +1 @@
+github: [shamoon, stumpylog]

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -9,7 +9,7 @@ body:
         ### ⚠️ Please remember: issues are for *bugs*
         That is, something you believe affects every single user of Paperless-ngx, not just you. If you're not sure, start with one of the other options below.
 
-        Also, note that **Paperless-ngx does not perform OCR itself**, that is handled by other tools. Problems with OCR of specific files should likely be raised 'upstream', see https://github.com/ocrmypdf/OCRmyPDF/issues or https://github.com/tesseract-ocr/tesseract/issues
+        Also, note that **Paperless-ngx does not perform OCR or archive file creation itself**, those are handled by other tools. Problems with OCR or archive versions of specific files should likely be raised 'upstream', see https://github.com/ocrmypdf/OCRmyPDF/issues or https://github.com/tesseract-ocr/tesseract/issues
   - type: markdown
     attributes:
       value: |
@@ -20,7 +20,7 @@ body:
         - [The troubleshooting documentation](https://docs.paperless-ngx.com/troubleshooting/).
         - [The installation instructions](https://docs.paperless-ngx.com/setup/#installation).
         - [Existing issues and discussions](https://github.com/paperless-ngx/paperless-ngx/search?q=&type=issues).
-        - Disable any customer container initialization scripts, if using
+        - Disable any custom container initialization scripts, if using
 
         If you encounter issues while installing or configuring Paperless-ngx, please post in the ["Support" section of the discussions](https://github.com/paperless-ngx/paperless-ngx/discussions/new?category=support).
   - type: textarea
@@ -86,19 +86,33 @@ body:
       description: Note there are significant differences from the official image and linuxserver.io, please check if your issue is specific to the third-party image.
     validations:
       required: true
+  - type: textarea
+    id: system-status
+    attributes:
+      label: System status
+      description: If available, copy & paste the system status output from Settings > System Status > Copy
+      render: json
   - type: input
     id: browser
     attributes:
       label: Browser
       description: Which browser you are using, if relevant.
       placeholder: e.g. Chrome, Safari
-  - type: input
+  - type: textarea
     id: config-changes
     attributes:
       label: Configuration changes
       description: Any configuration changes you made in `docker-compose.yml`, `docker-compose.env` or `paperless.conf`.
-  - type: input
-    id: other
+  - type: checkboxes
+    id: required-checks
     attributes:
-      label: Other
-      description: Any other relevant details.
+      label: Please confirm the following
+      options:
+        - label: I believe this issue is a bug that affects all users of Paperless-ngx, not something specific to my installation.
+          required: true
+        - label: This issue is not about the OCR or archive creation of a specific file(s). Otherwise, please see above regarding OCR tools.
+          required: true
+        - label: I have already searched for relevant existing issues and discussions before opening this report.
+          required: true
+        - label: I have updated the title field above with a concise description.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -2,10 +2,10 @@ blank_issues_enabled: false
 contact_links:
   - name: 🤔 Questions and Help
     url: https://github.com/paperless-ngx/paperless-ngx/discussions
-    about: This issue tracker is not for support questions. Please refer to our Discussions.
+    about: General questions or support for using Paperless-ngx.
   - name: 💬 Chat
     url: https://matrix.to/#/#paperlessngx:matrix.org
     about: Want to discuss Paperless-ngx with others? Check out our chat.
   - name: 🚀 Feature Request
     url: https://github.com/paperless-ngx/paperless-ngx/discussions/new?category=feature-requests
-    about: Remember to search for existing feature requests and "up-vote" any you like
+    about: Remember to search for existing feature requests and "up-vote" those that you like.

.github/PULL_REQUEST_TEMPLATE.md

@@ -8,7 +8,11 @@ Note: All PRs with code changes should be targeted to the `dev` branch, pure doc
 Please include a summary of the change and which issue is fixed (if any) and any relevant motivation / context. List any dependencies that are required for this change. If appropriate, please include an explanation of how your proposed change can be tested. Screenshots and / or videos can also be helpful if appropriate.
 -->
 
-Fixes # (issue)
+<!--
+⚠️ Important: Pull requests that implement a new feature or enhancement *should almost always target an existing feature request* with evidence of community interest and discussion. This is in order to balance the work of implementing and maintaining new features / enhancements. If that is not currently the case, please open a feature request instead of this PR to gather feedback from both users and the project maintainers.
+-->
+
+Closes #(issue or discussion)
 
 ## Type of change
 
@@ -17,10 +21,11 @@ What type of change does your PR introduce to Paperless-ngx?
 NOTE: Please check only one box!
 -->
 
-- [ ] Bug fix (non-breaking change which fixes an issue)
-- [ ] New feature (non-breaking change which adds functionality)
-- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
-- [ ] Other (please explain):
+- [ ] Bug fix: non-breaking change which fixes an issue.
+- [ ] New feature / Enhancement: non-breaking change which adds functionality. _Please read the important note above._
+- [ ] Breaking change: fix or feature that would cause existing functionality to not work as expected.
+- [ ] Documentation only.
+- [ ] Other. Please explain:
 
 ## Checklist:
 

.github/dependabot.yml

@@ -1,12 +1,15 @@
-# https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates#package-ecosystem
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
 
 version: 2
+# Required for uv support for now
+enable-beta-ecosystems: true
 updates:
 
-  # Enable version updates for npm
+  # Enable version updates for pnpm
   - package-ecosystem: "npm"
     target-branch: "dev"
-    # Look for `package.json` and `lock` files in the `/src-ui` directory
+    # Look for `pnpm-lock.yaml` file in the `/src-ui` directory
     directory: "/src-ui"
     open-pull-requests-limit: 10
     schedule:
@@ -34,9 +37,8 @@ updates:
           - "eslint"
 
   # Enable version updates for Python
-  - package-ecosystem: "pip"
+  - package-ecosystem: "uv"
     target-branch: "dev"
-    # Look for a `Pipfile` in the `root` directory
     directory: "/"
     # Check for updates once a week
     schedule:
@@ -51,9 +53,9 @@ updates:
       development:
         patterns:
           - "*pytest*"
-          - "black"
           - "ruff"
           - "mkdocs-material"
+          - "pre-commit*"
       django:
         patterns:
           - "*django*"
@@ -64,6 +66,10 @@ updates:
         update-types:
           - "minor"
           - "patch"
+      pre-built:
+        patterns:
+          - psycopg*
+          - zxing-cpp
 
   # Enable updates for GitHub Actions
   - package-ecosystem: "github-actions"
@@ -84,3 +90,50 @@ updates:
           - "major"
           - "minor"
           - "patch"
+
+  # Update Dockerfile in root directory
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    reviewers:
+      - "paperless-ngx/ci-cd"
+    labels:
+      - "ci-cd"
+      - "dependencies"
+    commit-message:
+      prefix: "docker"
+      include: "scope"
+
+  # Update Docker Compose files in docker/compose directory
+  - package-ecosystem: "docker-compose"
+    directory: "/docker/compose/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    reviewers:
+      - "paperless-ngx/ci-cd"
+    labels:
+      - "ci-cd"
+      - "dependencies"
+    commit-message:
+      prefix: "docker-compose"
+      include: "scope"
+    groups:
+      # Individual groups for each image
+      gotenberg:
+        patterns:
+          - "docker.io/gotenberg/gotenberg*"
+      tika:
+        patterns:
+          - "docker.io/apache/tika*"
+      redis:
+        patterns:
+          - "docker.io/library/redis*"
+      mariadb:
+        patterns:
+          - "docker.io/library/mariadb*"
+      postgres:
+        patterns:
+          - "docker.io/library/postgres*"

.github/workflows/ci.yml

@@ -14,11 +14,9 @@ on:
       - 'translations**'
 
 env:
-  # This is the version of pipenv all the steps will use
-  # If changing this, change Dockerfile
-  DEFAULT_PIP_ENV_VERSION: "2023.10.24"
+  DEFAULT_UV_VERSION: "0.6.x"
   # This is the default version of Python to use in most steps which aren't specific
-  DEFAULT_PYTHON_VERSION: "3.10"
+  DEFAULT_PYTHON_VERSION: "3.11"
 
 jobs:
   pre-commit:
@@ -30,23 +28,23 @@ jobs:
       github.repository
 
     name: Linting Checks
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       -
         name: Checkout repository
         uses: actions/checkout@v4
       -
         name: Install python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
       -
         name: Check files
-        uses: pre-commit/action@v3.0.0
+        uses: pre-commit/action@v3.0.1
 
   documentation:
-    name: "Build Documentation"
-    runs-on: ubuntu-22.04
+    name: "Build & Deploy Documentation"
+    runs-on: ubuntu-24.04
     needs:
       - pre-commit
     steps:
@@ -56,62 +54,56 @@ jobs:
       -
         name: Set up Python
         id: setup-python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-          cache: "pipenv"
-          cache-dependency-path: 'Pipfile.lock'
       -
-        name: Install pipenv
-        run: |
-          pip install --user pipenv==${{ env.DEFAULT_PIP_ENV_VERSION }}
+        name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          version: ${{ env.DEFAULT_UV_VERSION }}
+          enable-cache: true
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
       -
-        name: Install dependencies
+        name: Install Python dependencies
         run: |
-          pipenv --python ${{ steps.setup-python.outputs.python-version }} sync --dev
-      -
-        name: List installed Python dependencies
-        run: |
-          pipenv --python ${{ steps.setup-python.outputs.python-version }} run pip list
+          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
       -
         name: Make documentation
         run: |
-          pipenv --python ${{ steps.setup-python.outputs.python-version }} run mkdocs build --config-file ./mkdocs.yml
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            --dev \
+            --frozen \
+            mkdocs build --config-file ./mkdocs.yml
+      -
+        name: Deploy documentation
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: |
+          echo "docs.paperless-ngx.com" > "${{ github.workspace }}/docs/CNAME"
+          git config --global user.name "${{ github.actor }}"
+          git config --global user.email "${{ github.actor }}@users.noreply.github.com"
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            --dev \
+            --frozen \
+            mkdocs gh-deploy --force --no-history
       -
         name: Upload artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: documentation
           path: site/
           retention-days: 7
 
-  documentation-deploy:
-    name: "Deploy Documentation"
-    runs-on: ubuntu-22.04
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    needs:
-      - documentation
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-      -
-        name: Deploy docs
-        uses: mhausenblas/mkdocs-deploy-gh-pages@master
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CUSTOM_DOMAIN: docs.paperless-ngx.com
-          CONFIG_FILE: mkdocs.yml
-          EXTRA_PACKAGES: build-base
-
   tests-backend:
     name: "Backend Tests (Python ${{ matrix.python-version }})"
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     needs:
       - pre-commit
     strategy:
       matrix:
-        python-version: ['3.9', '3.10', '3.11']
+        python-version: ['3.10', '3.11', '3.12']
       fail-fast: false
     steps:
       -
@@ -120,20 +112,21 @@ jobs:
       -
         name: Start containers
         run: |
-          docker compose --file ${GITHUB_WORKSPACE}/docker/compose/docker-compose.ci-test.yml pull --quiet
-          docker compose --file ${GITHUB_WORKSPACE}/docker/compose/docker-compose.ci-test.yml up --detach
+          docker compose --file ${{ github.workspace }}/docker/compose/docker-compose.ci-test.yml pull --quiet
+          docker compose --file ${{ github.workspace }}/docker/compose/docker-compose.ci-test.yml up --detach
       -
         name: Set up Python
         id: setup-python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: "${{ matrix.python-version }}"
-          cache: "pipenv"
-          cache-dependency-path: 'Pipfile.lock'
       -
-        name: Install pipenv
-        run: |
-          pip install --user pipenv==${{ env.DEFAULT_PIP_ENV_VERSION }}
+        name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          version: ${{ env.DEFAULT_UV_VERSION }}
+          enable-cache: true
+          python-version: ${{ steps.setup-python.outputs.python-version }}
       -
         name: Install system dependencies
         run: |
@@ -142,16 +135,18 @@ jobs:
       -
         name: Configure ImageMagick
         run: |
-          sudo cp docker/imagemagick-policy.xml /etc/ImageMagick-6/policy.xml
+          sudo cp docker/rootfs/etc/ImageMagick-6/paperless-policy.xml /etc/ImageMagick-6/policy.xml
       -
         name: Install Python dependencies
         run: |
-          pipenv --python ${{ steps.setup-python.outputs.python-version }} run python --version
-          pipenv --python ${{ steps.setup-python.outputs.python-version }} sync --dev
+          uv sync \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            --group testing \
+            --frozen
       -
         name: List installed Python dependencies
         run: |
-          pipenv --python ${{ steps.setup-python.outputs.python-version }} run pip list
+          uv pip list
       -
         name: Tests
         env:
@@ -161,60 +156,73 @@ jobs:
           PAPERLESS_MAIL_TEST_USER: ${{ secrets.TEST_MAIL_USER }}
           PAPERLESS_MAIL_TEST_PASSWD: ${{ secrets.TEST_MAIL_PASSWD }}
         run: |
-          cd src/
-          pipenv --python ${{ steps.setup-python.outputs.python-version }} run pytest -ra
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            --dev \
+            --frozen \
+            pytest
       -
-        name: Upload coverage
-        if: ${{ matrix.python-version == env.DEFAULT_PYTHON_VERSION }}
-        uses: actions/upload-artifact@v3
+        name: Upload backend test results to Codecov
+        if: always()
+        uses: codecov/test-results-action@v1
         with:
-          name: backend-coverage-report
-          path: src/coverage.xml
-          retention-days: 7
-          if-no-files-found: warn
+          token: ${{ secrets.CODECOV_TOKEN }}
+          flags: backend-python-${{ matrix.python-version }}
+          files: junit.xml
+      -
+        name: Upload backend coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          flags: backend-python-${{ matrix.python-version }}
+          files: coverage.xml
       -
         name: Stop containers
         if: always()
         run: |
-          docker compose --file ${GITHUB_WORKSPACE}/docker/compose/docker-compose.ci-test.yml logs
-          docker compose --file ${GITHUB_WORKSPACE}/docker/compose/docker-compose.ci-test.yml down
+          docker compose --file ${{ github.workspace }}/docker/compose/docker-compose.ci-test.yml logs
+          docker compose --file ${{ github.workspace }}/docker/compose/docker-compose.ci-test.yml down
 
-  install-frontend-depedendencies:
-    name: "Install Frontend Dependendencies"
-    runs-on: ubuntu-22.04
+  install-frontend-dependencies:
+    name: "Install Frontend Dependencies"
+    runs-on: ubuntu-24.04
     needs:
       - pre-commit
     steps:
       - uses: actions/checkout@v4
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
       -
         name: Use Node.js 20
         uses: actions/setup-node@v4
         with:
           node-version: 20.x
-          cache: 'npm'
-          cache-dependency-path: 'src-ui/package-lock.json'
-      - name: Cache frontend depdendencies
+          cache: 'pnpm'
+          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
+      - name: Cache frontend dependencies
         id: cache-frontend-deps
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
-            ~/.npm
+            ~/.pnpm-store
             ~/.cache
-          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/package-lock.json') }}
+          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
       -
         name: Install dependencies
         if: steps.cache-frontend-deps.outputs.cache-hit != 'true'
-        run: cd src-ui && npm ci
+        run: cd src-ui && pnpm install
       -
         name: Install Playwright
         if: steps.cache-frontend-deps.outputs.cache-hit != 'true'
-        run: cd src-ui && npx playwright install --with-deps
+        run: cd src-ui && pnpm playwright install --with-deps
 
   tests-frontend:
     name: "Frontend Tests (Node ${{ matrix.node-version }} - ${{ matrix.shard-index }}/${{ matrix.shard-count }})"
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     needs:
-      - install-frontend-depedendencies
+      - install-frontend-dependencies
     strategy:
       fail-fast: false
       matrix:
@@ -223,97 +231,93 @@ jobs:
         shard-count: [4]
     steps:
       - uses: actions/checkout@v4
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
       -
         name: Use Node.js 20
         uses: actions/setup-node@v4
         with:
           node-version: 20.x
-          cache: 'npm'
-          cache-dependency-path: 'src-ui/package-lock.json'
-      - name: Cache frontend depdendencies
+          cache: 'pnpm'
+          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
+      - name: Cache frontend dependencies
         id: cache-frontend-deps
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
-            ~/.npm
+            ~/.pnpm-store
             ~/.cache
-          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/package-lock.json') }}
+          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
       - name: Re-link Angular cli
-        run: cd src-ui && npm link @angular/cli
+        run: cd src-ui && pnpm link @angular/cli
       -
         name: Linting checks
-        run: cd src-ui && npm run lint
+        run: cd src-ui && pnpm run lint
       -
         name: Run Jest unit tests
-        run: cd src-ui && npm run test -- --max-workers=2 --shard=${{ matrix.shard-index }}/${{ matrix.shard-count }}
-      -
-        name: Upload Jest coverage
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: jest-coverage-report-${{ matrix.shard-index }}
-          path: |
-            src-ui/coverage/coverage-final.json
-            src-ui/coverage/lcov.info
-            src-ui/coverage/clover.xml
-          retention-days: 7
-          if-no-files-found: warn
+        run: cd src-ui && pnpm run test --max-workers=2 --shard=${{ matrix.shard-index }}/${{ matrix.shard-count }}
       -
         name: Run Playwright e2e tests
-        run: cd src-ui && npx playwright test --shard ${{ matrix.shard-index }}/${{ matrix.shard-count }}
+        run: cd src-ui && pnpm exec playwright test --shard ${{ matrix.shard-index }}/${{ matrix.shard-count }}
       -
-        name: Upload Playwright test results
+        name: Upload frontend test results to Codecov
+        uses: codecov/test-results-action@v1
         if: always()
-        uses: actions/upload-artifact@v3
         with:
-          name: playwright-report
-          path: src-ui/playwright-report
-          retention-days: 7
-
-  tests-coverage-upload:
-    name: "Upload Coverage"
-    runs-on: ubuntu-22.04
-    needs:
-      - tests-backend
-      - tests-frontend
-    steps:
-      -
-        uses: actions/checkout@v4
-      -
-        name: Download frontend coverage
-        uses: actions/download-artifact@v3
-        with:
-          path: src-ui/coverage/
+          token: ${{ secrets.CODECOV_TOKEN }}
+          flags: frontend-node-${{ matrix.node-version }}
+          directory: src-ui/
       -
         name: Upload frontend coverage to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v5
         with:
-          # not required for public repos, but intermittently fails otherwise
           token: ${{ secrets.CODECOV_TOKEN }}
-          flags: frontend
+          flags: frontend-node-${{ matrix.node-version }}
           directory: src-ui/coverage/
-          # dont include backend coverage files here
-          files: '!coverage.xml'
+
+  frontend-bundle-analysis:
+    name: "Frontend Bundle Analysis"
+    runs-on: ubuntu-24.04
+    needs:
+      - tests-frontend
+    steps:
+      - uses: actions/checkout@v4
       -
-        name: Download backend coverage
-        uses: actions/download-artifact@v3
+        name: Install pnpm
+        uses: pnpm/action-setup@v4
         with:
-          name: backend-coverage-report
-          path: src/
+          version: 10
       -
-        name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3
+        name: Use Node.js 20
+        uses: actions/setup-node@v4
         with:
-          # not required for public repos, but intermittently fails otherwise
-          token: ${{ secrets.CODECOV_TOKEN }}
-          # future expansion
-          flags: backend
-          directory: src/
+          node-version: 20.x
+          cache: 'pnpm'
+          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
+      -
+        name: Cache frontend dependencies
+        id: cache-frontend-deps
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.pnpm-store
+            ~/.cache
+          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/package-lock.json') }}
+      -
+        name: Re-link Angular cli
+        run: cd src-ui && pnpm link @angular/cli
+      -
+        name: Build frontend and upload analysis
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+        run: cd src-ui && pnpm run build --configuration=production
 
   build-docker-image:
     name: Build Docker image for ${{ github.ref_name }}
-    runs-on: ubuntu-22.04
-    if: github.event_name == 'push' && (startsWith(github.ref, 'refs/heads/feature-') || github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/beta' || contains(github.ref, 'beta.rc') || startsWith(github.ref, 'refs/tags/v'))
+    runs-on: ubuntu-24.04
+    if: github.event_name == 'push' && (startsWith(github.ref, 'refs/heads/feature-') || startsWith(github.ref, 'refs/heads/fix-') || github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/beta' || contains(github.ref, 'beta.rc') || startsWith(github.ref, 'refs/tags/v'))
     concurrency:
       group: ${{ github.workflow }}-build-docker-image-${{ github.ref_name }}
       cancel-in-progress: true
@@ -385,7 +389,7 @@ jobs:
       -
         name: Login to Docker Hub
         uses: docker/login-action@v3
-        # Don't attempt to login is not pushing to Docker Hub
+        # Don't attempt to login if not pushing to Docker Hub
         if: steps.push-other-places.outputs.enable == 'true'
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -393,7 +397,7 @@ jobs:
       -
         name: Login to Quay.io
         uses: docker/login-action@v3
-        # Don't attempt to login is not pushing to Quay.io
+        # Don't attempt to login if not pushing to Quay.io
         if: steps.push-other-places.outputs.enable == 'true'
         with:
           registry: quay.io
@@ -401,7 +405,7 @@ jobs:
           password: ${{ secrets.QUAY_ROBOT_TOKEN }}
       -
         name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile
@@ -409,6 +413,8 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.docker-meta.outputs.tags }}
           labels: ${{ steps.docker-meta.outputs.labels }}
+          build-args: |
+            PNGX_TAG_VERSION=${{ steps.docker-meta.outputs.version }}
           # Get cache layers from this branch, then dev
           # This allows new branches to get at least some cache benefits, generally from dev
           cache-from: |
@@ -427,7 +433,7 @@ jobs:
           docker cp frontend-extract:/usr/src/paperless/src/documents/static/frontend src/documents/static/frontend/
       -
         name: Upload frontend artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: frontend-compiled
           path: src/documents/static/frontend/
@@ -437,7 +443,8 @@ jobs:
     name: "Build Release"
     needs:
       - build-docker-image
-    runs-on: ubuntu-22.04
+      - documentation
+    runs-on: ubuntu-24.04
     steps:
       -
         name: Checkout
@@ -445,25 +452,20 @@ jobs:
       -
         name: Set up Python
         id: setup-python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-          cache: "pipenv"
-          cache-dependency-path: 'Pipfile.lock'
       -
-        name: Install pipenv + tools
-        run: |
-          pip install --upgrade --user pipenv==${{ env.DEFAULT_PIP_ENV_VERSION }} setuptools wheel
+        name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          version: ${{ env.DEFAULT_UV_VERSION }}
+          enable-cache: true
+          python-version: ${{ steps.setup-python.outputs.python-version }}
       -
         name: Install Python dependencies
         run: |
-          pipenv --python ${{ steps.setup-python.outputs.python-version }} sync --dev
-      -
-        name: Patch whitenoise
-        run: |
-          curl --fail --silent --show-error --location --output 484.patch https://github.com/evansd/whitenoise/pull/484.patch
-          patch -d $(pipenv --venv)/lib/python3.10/site-packages --verbose -p2 < 484.patch
-          rm 484.patch
+          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
       -
         name: Install system dependencies
         run: |
@@ -471,30 +473,34 @@ jobs:
           sudo apt-get install -qq --no-install-recommends gettext liblept5
       -
         name: Download frontend artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: frontend-compiled
           path: src/documents/static/frontend/
       -
         name: Download documentation artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: documentation
           path: docs/_build/html/
       -
         name: Generate requirements file
         run: |
-          pipenv --python ${{ steps.setup-python.outputs.python-version }} requirements > requirements.txt
+           uv export --quiet --no-dev --all-extras --format requirements-txt --output-file requirements.txt
       -
         name: Compile messages
         run: |
           cd src/
-          pipenv --python ${{ steps.setup-python.outputs.python-version }} run python3 manage.py compilemessages
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            manage.py compilemessages
       -
         name: Collect static files
         run: |
           cd src/
-          pipenv --python ${{ steps.setup-python.outputs.python-version }} run python3 manage.py collectstatic --no-input
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            manage.py collectstatic --no-input
       -
         name: Move files
         run: |
@@ -510,13 +516,12 @@ jobs:
           for file_name in .dockerignore \
                           .env \
                           Dockerfile \
-                          Pipfile \
-                          Pipfile.lock \
+                          pyproject.toml \
+                          uv.lock \
                           requirements.txt \
                           LICENSE \
                           README.md \
-                          paperless.conf.example \
-                          gunicorn.conf.py
+                          paperless.conf.example
           do
             cp --verbose ${file_name} dist/paperless-ngx/
           done
@@ -543,7 +548,7 @@ jobs:
           tar -cJf paperless-ngx.tar.xz paperless-ngx/
       -
         name: Upload release artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: release
           path: dist/paperless-ngx.tar.xz
@@ -551,7 +556,7 @@ jobs:
 
   publish-release:
     name: "Publish Release"
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     outputs:
       prerelease: ${{ steps.get_version.outputs.prerelease }}
       changelog: ${{ steps.create-release.outputs.body }}
@@ -562,7 +567,7 @@ jobs:
     steps:
       -
         name: Download release artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: release
           path: ./
@@ -579,7 +584,7 @@ jobs:
       -
         name: Create Release and Changelog
         id: create-release
-        uses: release-drafter/release-drafter@v5
+        uses: release-drafter/release-drafter@v6
         with:
           name: Paperless-ngx ${{ steps.get_version.outputs.version }}
           tag: ${{ steps.get_version.outputs.version }}
@@ -601,7 +606,7 @@ jobs:
 
   append-changelog:
     name: "Append Changelog"
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     needs:
       - publish-release
     if: needs.publish-release.outputs.prerelease == 'false'
@@ -613,15 +618,17 @@ jobs:
           ref: main
       -
         name: Set up Python
-        uses: actions/setup-python@v4
+        id: setup-python
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-          cache: "pipenv"
-          cache-dependency-path: 'Pipfile.lock'
       -
-        name: Install pipenv + tools
-        run: |
-          pip install --upgrade --user pipenv==${{ env.DEFAULT_PIP_ENV_VERSION }} setuptools wheel
+        name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          version: ${{ env.DEFAULT_UV_VERSION }}
+          enable-cache: true
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
       -
         name: Append Changelog to docs
         id: append-Changelog
@@ -631,23 +638,28 @@ jobs:
           git checkout ${{ needs.publish-release.outputs.version }}-changelog
           echo -e "# Changelog\n\n${{ needs.publish-release.outputs.changelog }}\n" > changelog-new.md
           echo "Manually linking usernames"
-          sed -i -r 's|@(.+?) \(\[#|[@\1](https://github.com/\1) ([#|ig' changelog-new.md
+          sed -i -r 's|@([a-zA-Z0-9_]+) \(\[#|[@\1](https://github.com/\1) ([#|g' changelog-new.md
+          echo "Removing unneeded comment tags"
+          sed -i -r 's|@<!---->|@|g' changelog-new.md
           CURRENT_CHANGELOG=`tail --lines +2 changelog.md`
           echo -e "$CURRENT_CHANGELOG" >> changelog-new.md
           mv changelog-new.md changelog.md
-          pipenv run pre-commit run --files changelog.md || true
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            --dev \
+            pre-commit run --files changelog.md || true
           git config --global user.name "github-actions"
           git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git commit -am "Changelog ${{ needs.publish-release.outputs.version }} - GHA"
           git push origin ${{ needs.publish-release.outputs.version }}-changelog
       -
         name: Create Pull Request
-        uses: actions/github-script@v6
+        uses: actions/github-script@v7
         with:
           script: |
             const { repo, owner } = context.repo;
             const result = await github.rest.pulls.create({
-              title: '[Documentation] Add ${{ needs.publish-release.outputs.version }} changelog',
+              title: 'Documentation: Add ${{ needs.publish-release.outputs.version }} changelog',
               owner,
               repo,
               head: '${{ needs.publish-release.outputs.version }}-changelog',

.github/workflows/cleanup-tags.yml

@@ -19,9 +19,13 @@ concurrency:
 
 jobs:
   cleanup-images:
-    name: Cleanup Image Tags for paperless-ngx
+    name: Cleanup Image Tags for ${{ matrix.primary-name }}
     if: github.repository_owner == 'paperless-ngx'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        primary-name: ["paperless-ngx", "paperless-ngx/builder/cache/app"]
     env:
       # Requires a personal access token with the OAuth scope delete:packages
       TOKEN: ${{ secrets.GHA_CONTAINER_DELETE_TOKEN }}
@@ -29,38 +33,27 @@ jobs:
       -
         name: Clean temporary images
         if: "${{ env.TOKEN != '' }}"
-        uses: stumpylog/image-cleaner-action/ephemeral@v0.3.0
+        uses: stumpylog/image-cleaner-action/ephemeral@v0.10.0
         with:
           token: "${{ env.TOKEN }}"
           owner: "${{ github.repository_owner }}"
           is_org: "true"
-          package_name: "paperless-ngx"
+          package_name: "${{ matrix.primary-name }}"
           scheme: "branch"
           repo_name: "paperless-ngx"
-          match_regex: "feature-"
+          match_regex: "(feature|fix)"
           do_delete: "true"
 
   cleanup-untagged-images:
     name: Cleanup Untagged Images Tags for ${{ matrix.primary-name }}
     if: github.repository_owner == 'paperless-ngx'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     needs:
       - cleanup-images
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - primary-name: "paperless-ngx"
-          - primary-name: "paperless-ngx/builder/cache/app"
-          # TODO: Remove the above and replace with the below
-          # - primary-name: "builder/qpdf"
-          # - primary-name: "builder/cache/qpdf"
-          # - primary-name: "builder/pikepdf"
-          # - primary-name: "builder/cache/pikepdf"
-          # - primary-name: "builder/jbig2enc"
-          # - primary-name: "builder/cache/jbig2enc"
-          # - primary-name: "builder/psycopg2"
-          # - primary-name: "builder/cache/psycopg2"
+        primary-name: ["paperless-ngx", "paperless-ngx/builder/cache/app"]
     env:
       # Requires a personal access token with the OAuth scope delete:packages
       TOKEN: ${{ secrets.GHA_CONTAINER_DELETE_TOKEN }}
@@ -68,7 +61,7 @@ jobs:
       -
         name: Clean untagged images
         if: "${{ env.TOKEN != '' }}"
-        uses: stumpylog/image-cleaner-action/untagged@v0.3.0
+        uses: stumpylog/image-cleaner-action/untagged@v0.10.0
         with:
           token: "${{ env.TOKEN }}"
           owner: "${{ github.repository_owner }}"

.github/workflows/codeql-analysis.yml

@@ -23,7 +23,7 @@ on:
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
       actions: read
       contents: read
@@ -42,7 +42,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -51,4 +51,4 @@ jobs:
         # queries: ./path/to/local/query, your-org/your-repo/queries@main
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3

.github/workflows/crowdin.yml

@@ -0,0 +1,35 @@
+name: Crowdin Action
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '2 */12 * * *'
+  push:
+    paths: [
+      'src/locale/**',
+      'src-ui/messages.xlf',
+      'src-ui/src/locale/**'
+    ]
+    branches: [ dev ]
+
+jobs:
+  synchronize-with-crowdin:
+    name: Crowdin Sync
+    if: github.repository_owner == 'paperless-ngx'
+    runs-on: ubuntu-24.04
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+    - name: crowdin action
+      uses: crowdin/github-action@v2
+      with:
+        upload_translations: false
+        download_translations: true
+        crowdin_branch_name: 'dev'
+        localization_branch_name: l10n_dev
+        pull_request_labels: 'skip-changelog, translation'
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
+        CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}

.github/workflows/project-actions.yml

@@ -1,10 +1,6 @@
 name: Project Automations
 
 on:
-  issues:
-    types:
-      - opened
-      - reopened
   pull_request_target: #_target allows access to secrets
     types:
       - opened
@@ -16,42 +12,16 @@ on:
 permissions:
   contents: read
 
-env:
-  todo: Todo
-  done: Done
-  in_progress: In Progress
-
 jobs:
-  issue_opened_or_reopened:
-    name: issue_opened_or_reopened
-    runs-on: ubuntu-22.04
-    if: github.event_name == 'issues' && (github.event.action == 'opened' || github.event.action == 'reopened')
-    steps:
-      - name: Add issue to project and set status to ${{ env.todo }}
-        uses: leonsteinhaeuser/project-beta-automations@v2.2.1
-        with:
-          gh_token: ${{ secrets.GH_TOKEN }}
-          organization: paperless-ngx
-          project_id: 2
-          resource_node_id: ${{ github.event.issue.node_id }}
-          status_value: ${{ env.todo }} # Target status
   pr_opened_or_reopened:
     name: pr_opened_or_reopened
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
       # write permission is required for autolabeler
       pull-requests: write
     if: github.event_name == 'pull_request_target' && (github.event.action == 'opened' || github.event.action == 'reopened') && github.event.pull_request.user.login != 'dependabot'
     steps:
-      - name: Add PR to project and set status to "Needs Review"
-        uses: leonsteinhaeuser/project-beta-automations@v2.2.1
-        with:
-          gh_token: ${{ secrets.GH_TOKEN }}
-          organization: paperless-ngx
-          project_id: 2
-          resource_node_id: ${{ github.event.pull_request.node_id }}
-          status_value: "Needs Review" # Target status
       - name: Label PR with release-drafter
-        uses: release-drafter/release-drafter@v5
+        uses: release-drafter/release-drafter@v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/repo-maintenance.yml

@@ -16,43 +16,58 @@ concurrency:
 jobs:
   stale:
     name: 'Stale'
-    runs-on: ubuntu-latest
+    if: github.repository_owner == 'paperless-ngx'
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/stale@v8
+      - uses: actions/stale@v9
         with:
           days-before-stale: 7
           days-before-close: 14
-          any-of-labels: 'cant-reproduce,not a bug'
+          any-of-labels: 'stale,cant-reproduce,not a bug'
           stale-issue-label: stale
           stale-pr-label: stale
           stale-issue-message: >
             This issue has been automatically marked as stale because it has not had
             recent activity. It will be closed if no further activity occurs. Thank you
-            for your contributions.
+            for your contributions. See our [contributing guidelines](https://github.com/paperless-ngx/paperless-ngx/blob/dev/CONTRIBUTING.md#automatic-repository-maintenance) for more details.
   lock-threads:
     name: 'Lock Old Threads'
-    runs-on: ubuntu-latest
+    if: github.repository_owner == 'paperless-ngx'
+    runs-on: ubuntu-24.04
     steps:
-      - uses: dessant/lock-threads@v4
+      - uses: dessant/lock-threads@v5
         with:
           issue-inactive-days: '30'
           pr-inactive-days: '30'
+          discussion-inactive-days: '30'
           log-output: true
           issue-comment: >
             This issue has been automatically locked since there
             has not been any recent activity after it was closed.
             Please open a new discussion or issue for related concerns.
+            See our [contributing guidelines](https://github.com/paperless-ngx/paperless-ngx/blob/dev/CONTRIBUTING.md#automatic-repository-maintenance) for more details.
           pr-comment: >
             This pull request has been automatically locked since there
             has not been any recent activity after it was closed.
             Please open a new discussion or issue for related concerns.
+            See our [contributing guidelines](https://github.com/paperless-ngx/paperless-ngx/blob/dev/CONTRIBUTING.md#automatic-repository-maintenance) for more details.
+          discussion-comment: >
+            This discussion has been automatically locked since there
+            has not been any recent activity after it was closed.
+            Please open a new discussion for related concerns.
+            See our [contributing guidelines](https://github.com/paperless-ngx/paperless-ngx/blob/dev/CONTRIBUTING.md#automatic-repository-maintenance) for more details.
   close-answered-discussions:
     name: 'Close Answered Discussions'
-    runs-on: ubuntu-latest
+    if: github.repository_owner == 'paperless-ngx'
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/github-script@v6
+      - uses: actions/github-script@v7
         with:
           script: |
+            function sleep(ms) {
+              return new Promise(resolve => setTimeout(resolve, ms));
+            }
+
             const query = `query($owner:String!, $name:String!) {
               repository(owner:$owner, name:$name){
                 discussions(first:100, answered:true, states:[OPEN]) {
@@ -72,7 +87,7 @@ jobs:
             console.log(`Found ${result.repository.discussions.nodes.length} open answered discussions`)
 
             for (const discussion of result.repository.discussions.nodes) {
-              console.log(`Closing dicussion #${discussion.number} (${discussion.id})`)
+              console.log(`Closing discussion #${discussion.number} (${discussion.id})`)
 
               const addCommentMutation = `mutation($discussion:ID!, $body:String!) {
                 addDiscussionComment(input:{discussionId:$discussion, body:$body}) {
@@ -81,7 +96,7 @@ jobs:
               }`;
               const commentVariables = {
                 discussion: discussion.id,
-                body: 'This discussion has been automatically closed because it was marked as answered.',
+                body: 'This discussion has been automatically closed because it was marked as answered. Please see our [contributing guidelines](https://github.com/paperless-ngx/paperless-ngx/blob/dev/CONTRIBUTING.md#automatic-repository-maintenance) for more details.',
               }
               await github.graphql(addCommentMutation, commentVariables)
 
@@ -96,4 +111,184 @@ jobs:
               }
               await github.graphql(closeDiscussionMutation, closeVariables)
 
+              await sleep(1000)
+            }
+  close-outdated-discussions:
+    name: 'Close Outdated Discussions'
+    if: github.repository_owner == 'paperless-ngx'
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/github-script@v7
+        with:
+          script: |
+            function sleep(ms) {
+              return new Promise(resolve => setTimeout(resolve, ms));
+            }
+
+            const CUTOFF_DAYS = 180;
+            const cutoff = new Date();
+            cutoff.setDate(cutoff.getDate() - CUTOFF_DAYS);
+
+            const query = `query(
+                $owner:String!,
+                $name:String!,
+                $supportCategory:ID!,
+                $generalCategory:ID!,
+              ) {
+              supportDiscussions: repository(owner:$owner, name:$name){
+                discussions(
+                  categoryId:$supportCategory,
+                  last:50,
+                  answered:false,
+                  states:[OPEN],
+                ) {
+                  nodes {
+                    id,
+                    number,
+                    updatedAt
+                  }
+                },
+              },
+              generalDiscussions: repository(owner:$owner, name:$name){
+                discussions(
+                  categoryId:$generalCategory,
+                  last:50,
+                  states:[OPEN],
+                ) {
+                  nodes {
+                    id,
+                    number,
+                    updatedAt
+                  }
+                }
+              }
+            }`;
+            const variables = {
+              owner: context.repo.owner,
+              name: context.repo.repo,
+              supportCategory: "DIC_kwDOG1Zs184CBKWK",
+              generalCategory: "DIC_kwDOG1Zs184CBKWJ"
+            }
+            const result = await github.graphql(query, variables);
+            const combinedDiscussions = [
+              ...result.supportDiscussions.discussions.nodes,
+              ...result.generalDiscussions.discussions.nodes,
+            ]
+
+            console.log(`Checking ${combinedDiscussions.length} open discussions`);
+
+            for (const discussion of combinedDiscussions) {
+              if (new Date(discussion.updatedAt) < cutoff) {
+                console.log(`Closing outdated discussion #${discussion.number} (${discussion.id}), last updated at ${discussion.updatedAt}`);
+                const addCommentMutation = `mutation($discussion:ID!, $body:String!) {
+                  addDiscussionComment(input:{discussionId:$discussion, body:$body}) {
+                    clientMutationId
+                  }
+                }`;
+                const commentVariables = {
+                  discussion: discussion.id,
+                  body: 'This discussion has been automatically closed due to inactivity. Please see our [contributing guidelines](https://github.com/paperless-ngx/paperless-ngx/blob/dev/CONTRIBUTING.md#automatic-repository-maintenance) for more details.',
+                }
+                await github.graphql(addCommentMutation, commentVariables);
+
+                const closeDiscussionMutation = `mutation($discussion:ID!, $reason:DiscussionCloseReason!) {
+                  closeDiscussion(input:{discussionId:$discussion, reason:$reason}) {
+                    clientMutationId
+                  }
+                }`;
+                const closeVariables = {
+                  discussion: discussion.id,
+                  reason: "OUTDATED",
+                }
+                await github.graphql(closeDiscussionMutation, closeVariables);
+
+                await sleep(1000);
+              }
+            }
+  close-unsupported-feature-requests:
+    name: 'Close Unsupported Feature Requests'
+    if: github.repository_owner == 'paperless-ngx'
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/github-script@v7
+        with:
+          script: |
+            function sleep(ms) {
+              return new Promise(resolve => setTimeout(resolve, ms));
+            }
+
+            const CUTOFF_MAX_COUNT = 80;
+            const CUTOFF_1_DAYS = 180;
+            const CUTOFF_1_COUNT = 5;
+            const CUTOFF_2_DAYS = 365;
+            const CUTOFF_2_COUNT = 20;
+            const CUTOFF_3_DAYS = 730;
+            const CUTOFF_3_COUNT = 40;
+
+            const cutoff1Date = new Date();
+            cutoff1Date.setDate(cutoff1Date.getDate() - CUTOFF_1_DAYS);
+            const cutoff2Date = new Date();
+            cutoff2Date.setDate(cutoff2Date.getDate() - CUTOFF_2_DAYS);
+            const cutoff3Date = new Date();
+            cutoff3Date.setDate(cutoff3Date.getDate() - CUTOFF_3_DAYS);
+
+            const query = `query(
+                $owner:String!,
+                $name:String!,
+                $featureRequestsCategory:ID!,
+              ) {
+              repository(owner:$owner, name:$name){
+                discussions(
+                  categoryId:$featureRequestsCategory,
+                  last:100,
+                  states:[OPEN],
+                ) {
+                  nodes {
+                    id,
+                    number,
+                    updatedAt,
+                    upvoteCount,
+                  }
+                },
+              }
+            }`;
+            const variables = {
+              owner: context.repo.owner,
+              name: context.repo.repo,
+              featureRequestsCategory: "DIC_kwDOG1Zs184CBNr4"
+            }
+            const result = await github.graphql(query, variables);
+
+            for (const discussion of result.repository.discussions.nodes) {
+              const discussionUpdatedDate = new Date(discussion.updatedAt);
+              const discussionCreatedDate = new Date(discussion.createdAt);
+              if ((discussionUpdatedDate < cutoff1Date && discussion.upvoteCount < CUTOFF_MAX_COUNT) ||
+                  (discussionCreatedDate < cutoff1Date && discussion.upvoteCount < CUTOFF_1_COUNT) ||
+                  (discussionCreatedDate < cutoff2Date && discussion.upvoteCount < CUTOFF_2_COUNT) ||
+                  (discussionCreatedDate < cutoff3Date && discussion.upvoteCount < CUTOFF_3_COUNT)) {
+                console.log(`Closing discussion #${discussion.number} (${discussion.id}), last updated at ${discussion.updatedAt} with votes ${discussion.upvoteCount}`);
+                const addCommentMutation = `mutation($discussion:ID!, $body:String!) {
+                  addDiscussionComment(input:{discussionId:$discussion, body:$body}) {
+                    clientMutationId
+                  }
+                }`;
+                const commentVariables = {
+                  discussion: discussion.id,
+                  body: 'This discussion has been automatically closed due to lack of community support. Please see our [contributing guidelines](https://github.com/paperless-ngx/paperless-ngx/blob/dev/CONTRIBUTING.md#automatic-repository-maintenance) for more details.',
+                }
+                await github.graphql(addCommentMutation, commentVariables);
+
+                const closeDiscussionMutation = `mutation($discussion:ID!, $reason:DiscussionCloseReason!) {
+                  closeDiscussion(input:{discussionId:$discussion, reason:$reason}) {
+                    clientMutationId
+                  }
+                }`;
+                const closeVariables = {
+                  discussion: discussion.id,
+                  reason: "OUTDATED",
+                }
+                await github.graphql(closeDiscussionMutation, closeVariables);
+
+                await sleep(1000);
+              }
             }

.gitignore

@@ -22,6 +22,7 @@ var/
 *.egg-info/
 .installed.cfg
 *.egg
+/src/paperless_mail/templates/node_modules
 
 # PyInstaller
 #  Usually these files are written by a python script from a template
@@ -43,6 +44,7 @@ nosetests.xml
 coverage.xml
 *,cover
 .pytest_cache
+junit.xml
 
 # Translations
 *.mo
@@ -65,6 +67,8 @@ target/
 .vscode
 /src-ui/.vscode
 /docs/.vscode
+.vscode-server
+*CommandMarker
 
 # Other stuff that doesn't belong
 .virtualenv
@@ -97,3 +101,9 @@ scripts/nuke
 
 # celery schedule file
 celerybeat-schedule*
+
+# ignore .devcontainer sub folders
+/.devcontainer/consume/
+/.devcontainer/data/
+/.devcontainer/media/
+/.devcontainer/redisdata/

.pre-commit-config.yaml

@@ -5,12 +5,14 @@
 repos:
   # General hooks
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.5.0
+    rev: v5.0.0
     hooks:
       - id: check-docstring-first
       - id: check-json
         exclude: "tsconfig.*json"
       - id: check-yaml
+        args:
+          - "--unsafe"
       - id: check-toml
       - id: check-executables-have-shebangs
       - id: end-of-file-fixer
@@ -26,24 +28,36 @@ repos:
           - svg
       - id: check-case-conflict
       - id: detect-private-key
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: 'v3.1.0'
+  - repo: https://github.com/codespell-project/codespell
+    rev: v2.4.0
+    hooks:
+      - id: codespell
+        exclude: "(^src-ui/src/locale/)|(^src-ui/pnpm-lock.yaml)|(^src-ui/e2e/)|(^src/paperless_mail/tests/samples/)"
+        exclude_types:
+          - pofile
+          - json
+  # See https://github.com/prettier/prettier/issues/15742 for the fork reason
+  - repo: https://github.com/rbubley/mirrors-prettier
+    rev: 'v3.3.3'
     hooks:
       - id: prettier
         types_or:
           - javascript
           - ts
           - markdown
-        exclude: "(^Pipfile\\.lock$)"
+        additional_dependencies:
+          - prettier@3.3.3
+          - 'prettier-plugin-organize-imports@4.1.0'
   # Python hooks
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 'v0.1.5'
+    rev: v0.9.9
     hooks:
       - id: ruff
-  - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 23.11.0
+      - id: ruff-format
+  - repo: https://github.com/tox-dev/pyproject-fmt
+    rev: "v2.5.1"
     hooks:
-      - id: black
+      - id: pyproject-fmt
   # Dockerfile hooks
   - repo: https://github.com/AleksaC/hadolint-py
     rev: v2.12.0.3
@@ -54,9 +68,11 @@ repos:
     rev: v6.2.1
     hooks:
       - id: beautysh
+        additional_dependencies:
+          - setuptools
         args:
           - "--tab"
   - repo: https://github.com/shellcheck-py/shellcheck-py
-    rev: "v0.9.0.6"
+    rev: "v0.10.0.1"
     hooks:
       - id: shellcheck

.prettierrc

@@ -1,16 +0,0 @@
-{
-    # https://prettier.io/docs/en/options.html#semicolons
-    "semi": false,
-    # https://prettier.io/docs/en/options.html#quotes
-    "singleQuote": true,
-    # https://prettier.io/docs/en/options.html#trailing-commas
-    "trailingComma": "es5",
-    "overrides": [
-        {
-            "files": "index.md",
-            "options": {
-                "tabWidth": 4
-            }
-        }
-    ]
-}

.prettierrc.js

@@ -0,0 +1,19 @@
+const config = {
+	// https://prettier.io/docs/en/options.html#semicolons
+	semi: false,
+	// https://prettier.io/docs/en/options.html#quotes
+	singleQuote: true,
+	// https://prettier.io/docs/en/options.html#trailing-commas
+	trailingComma: 'es5',
+	overrides: [
+		{
+			files: ['docs/*.md'],
+			options: {
+				tabWidth: 4,
+			},
+		},
+	],
+	plugins: [require('prettier-plugin-organize-imports')],
+}
+
+module.exports = config

.python-version

@@ -1 +0,0 @@
-3.9.18

.ruff.toml

@@ -1,23 +0,0 @@
-# https://beta.ruff.rs/docs/settings/
-# https://beta.ruff.rs/docs/rules/
-extend-select = ["I", "W", "UP", "COM", "DJ", "EXE", "ISC", "ICN", "G201", "INP", "PIE", "RSE", "SIM", "TID", "PLC", "PLE", "RUF"]
-# TODO PTH
-ignore = ["DJ001", "SIM105", "RUF012"]
-fix = true
-line-length = 88
-respect-gitignore = true
-src = ["src"]
-target-version = "py39"
-output-format = "grouped"
-show-fixes = true
-
-[per-file-ignores]
-".github/scripts/*.py" = ["E501", "INP001", "SIM117"]
-"docker/wait-for-redis.py" = ["INP001"]
-"*/tests/*.py" = ["E501", "SIM117"]
-"*/migrations/*.py" = ["E501", "SIM"]
-"src/paperless_tesseract/tests/test_parser.py" = ["RUF001"]
-"src/documents/models.py" = ["SIM115"]
-
-[isort]
-force-single-line = true

CODEOWNERS

@@ -5,5 +5,6 @@
 /src-ui/ @paperless-ngx/frontend
 
 /src/ @paperless-ngx/backend
-Pipfile* @paperless-ngx/backend
+pyproject.toml @paperless-ngx/backend
+uv.lock @paperless-ngx/backend
 *.py @paperless-ngx/backend

CODE_OF_CONDUCT.md

@@ -5,7 +5,7 @@
 We as members, contributors, and leaders pledge to make participation in our
 community a harassment-free experience for everyone, regardless of age, body
 size, visible or invisible disability, ethnicity, sex characteristics, gender
-identity and expression, level of experience, education, socio-economic status,
+identity and expression, level of experience, education, socioeconomic status,
 nationality, personal appearance, race, religion, or sexual identity
 and orientation.
 

CONTRIBUTING.md

@@ -11,7 +11,7 @@ If you want to implement something big:
 
 ## Python
 
-Paperless supports python 3.9 - 3.11. We format Python code with [Black](https://github.com/psf/black).
+Paperless supports python 3.10 - 3.12 at this time. We format Python code with [ruff](https://docs.astral.sh/ruff/formatter/).
 
 ## Branches
 
@@ -81,7 +81,7 @@ Some notes about translation:
 
 If a language has already been added, and you would like to contribute new translations or change existing translations, please read the "Translation" section in the README.md file for further details on that.
 
-If you would like the project to be translated to another language, first head over to https://crwd.in/paperless-ngx to check if that language has already been enabled for translation.
+If you would like the project to be translated to another language, first head over to https://crowdin.com/project/paperless-ngx to check if that language has already been enabled for translation.
 If not, please request the language to be added by creating an issue on GitHub. The issue should contain:
 
 - English name of the language (the localized name can be added on Crowdin).
@@ -94,7 +94,7 @@ The following files need to be changed:
 
 - src-ui/angular.json (under the _projects/paperless-ui/i18n/locales_ JSON key)
 - src/paperless/settings.py (in the _LANGUAGES_ array)
-- src-ui/src/app/services/settings.service.ts (inside the _getLanguageOptions_ method)
+- src-ui/src/app/services/settings.service.ts (inside the _LANGUAGE_OPTIONS_ array)
 - src-ui/src/app/app.module.ts (import locale from _angular/common/locales_ and call _registerLocaleData_)
 
 Please add the language in the correct order, alphabetically by locale.
@@ -137,3 +137,19 @@ All team members are notified when mentioned or assigned to a relevant issue or
 We are not overly strict with inviting people to the organization. If you have read the [team permissions](#permissions) and think having additional access would enhance your contributions, please reach out to an [admin](#structure) of the team.
 
 The admins occasionally invite contributors directly if we believe having them on a team will accelerate their work.
+
+# Automatic Repository Maintenance
+
+The Paperless-ngx team appreciates all effort and interest from the community in filing bug reports, creating feature requests, sharing ideas and helping other
+community members. That said, in an effort to keep the repository organized and managebale the project uses automatic handling of certain areas:
+
+- Issues that cannot be reproduced will be marked 'stale' after 7 days of inactivity and closed after 14 further days of inactivity.
+- Issues, pull requests and discussions that are closed will be locked after 30 days of inactivity.
+- Discussions with a marked answer will be automatically closed.
+- Discussions in the 'General' or 'Support' categories will be closed after 180 days of inactivity.
+- Feature requests that do not meet the following thresholds will be closed: 180 days of inactivity, < 5 "up-votes" after 180 days, < 20 "up-votes" after 1 year or < 80 "up-votes" at 2 years.
+
+In all cases, threads can be re-opened by project maintainers and, of course, users can always create a new discussion for related concerns.
+Finally, remember that all information remains searchable and 'closed' feature requests can still serve as inspiration for new features.
+
+Thank you all for your contributions.

Dockerfile

@@ -4,40 +4,90 @@
 # Stage: compile-frontend
 # Purpose: Compiles the frontend
 # Notes:
-#  - Does NPM stuff with Typescript and such
+#  - Does PNPM stuff with Typescript and such
 FROM --platform=$BUILDPLATFORM docker.io/node:20-bookworm-slim AS compile-frontend
 
 COPY ./src-ui /src/src-ui
 
 WORKDIR /src/src-ui
 RUN set -eux \
-  && npm update npm -g \
-  && npm ci --omit=optional
+  && npm update -g pnpm \
+  && npm install -g corepack@latest \
+  && corepack enable \
+  && pnpm install
+
+ARG PNGX_TAG_VERSION=
+# Add the tag to the environment file if its a tagged dev build
+RUN set -eux && \
+case "${PNGX_TAG_VERSION}" in \
+  dev|beta|fix*|feature*) \
+    sed -i -E "s/version: '([0-9\.]+)'/version: '\1 #${PNGX_TAG_VERSION}'/g" /src/src-ui/src/environments/environment.prod.ts \
+    ;; \
+esac
+
 RUN set -eux \
   && ./node_modules/.bin/ng build --configuration production
 
-# Stage: pipenv-base
-# Purpose: Generates a requirements.txt file for building
+# Stage: s6-overlay-base
+# Purpose: Installs s6-overlay and rootfs
 # Comments:
-#  - pipenv dependencies are not left in the final image
-#  - pipenv can't touch the final image somehow
-FROM --platform=$BUILDPLATFORM docker.io/python:3.11-alpine as pipenv-base
+#  - Don't leave anything extra in here either
+FROM ghcr.io/astral-sh/uv:0.6.13-python3.12-bookworm-slim AS s6-overlay-base
 
-WORKDIR /usr/src/pipenv
+WORKDIR /usr/src/s6
 
-COPY Pipfile* ./
+# https://github.com/just-containers/s6-overlay#customizing-s6-overlay-behaviour
+ENV \
+    S6_BEHAVIOUR_IF_STAGE2_FAILS=2 \
+    S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 \
+    S6_VERBOSITY=1 \
+    PATH=/command:$PATH
+
+# Buildx provided, must be defined to use though
+ARG TARGETARCH
+ARG TARGETVARIANT
+# Lock this version
+ARG S6_OVERLAY_VERSION=3.2.0.2
+
+ARG S6_BUILD_TIME_PKGS="curl \
+                        xz-utils"
 
 RUN set -eux \
-  && echo "Installing pipenv" \
-    && python3 -m pip install --no-cache-dir --upgrade pipenv==2023.10.24 \
-  && echo "Generating requirement.txt" \
-    && pipenv requirements > requirements.txt
+    && echo "Installing build time packages" \
+      && apt-get update \
+      && apt-get install --yes --quiet --no-install-recommends ${S6_BUILD_TIME_PKGS} \
+    && echo "Determining arch" \
+      && S6_ARCH="" \
+      && if [ "${TARGETARCH}${TARGETVARIANT}" = "amd64" ]; then S6_ARCH="x86_64"; \
+      elif [ "${TARGETARCH}${TARGETVARIANT}" = "arm64" ]; then S6_ARCH="aarch64"; fi\
+      && if [ -z "${S6_ARCH}" ]; then { echo "Error: Not able to determine arch"; exit 1; }; fi \
+    && echo "Installing s6-overlay for ${S6_ARCH}" \
+      && curl --fail --silent --no-progress-meter --show-error --location --remote-name-all --parallel --parallel-max 4 \
+        "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz" \
+        "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz.sha256" \
+        "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-${S6_ARCH}.tar.xz" \
+        "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-${S6_ARCH}.tar.xz.sha256" \
+      && echo "Validating s6-archive checksums" \
+        && sha256sum --check ./*.sha256 \
+      && echo "Unpacking archives" \
+        && tar --directory / -Jxpf s6-overlay-noarch.tar.xz \
+        && tar --directory / -Jxpf s6-overlay-${S6_ARCH}.tar.xz \
+      && echo "Removing downloaded archives" \
+        && rm ./*.tar.xz \
+        && rm ./*.sha256 \
+    && echo "Cleaning up image" \
+      && apt-get --yes purge ${S6_BUILD_TIME_PKGS} \
+      && apt-get --yes autoremove --purge \
+      && rm -rf /var/lib/apt/lists/*
+
+# Copy our service defs and filesystem
+COPY ./docker/rootfs /
 
 # Stage: main-app
 # Purpose: The final image
 # Comments:
 #  - Don't leave anything extra in here
-FROM docker.io/python:3.11-slim-bookworm as main-app
+FROM s6-overlay-base AS main-app
 
 LABEL org.opencontainers.image.authors="paperless-ngx team <hello@paperless-ngx.com>"
 LABEL org.opencontainers.image.documentation="https://docs.paperless-ngx.com/"
@@ -51,9 +101,19 @@ ARG DEBIAN_FRONTEND=noninteractive
 ARG TARGETARCH
 
 # Can be workflow provided, defaults set for manual building
-ARG JBIG2ENC_VERSION=0.29
-ARG QPDF_VERSION=11.6.3
-ARG GS_VERSION=10.02.0
+ARG JBIG2ENC_VERSION=0.30
+ARG QPDF_VERSION=11.9.0
+ARG GS_VERSION=10.03.1
+
+# Set Python environment variables
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    # Ignore warning from Whitenoise about async iterators
+    PYTHONWARNINGS="ignore:::django.http.response:517" \
+    PNGX_CONTAINERIZED=1 \
+    # https://docs.astral.sh/uv/reference/settings/#link-mode
+    UV_LINK_MODE=copy \
+    UV_CACHE_DIR=/cache/uv/
 
 #
 # Begin installation and configuration
@@ -76,7 +136,6 @@ ARG RUNTIME_PACKAGES="\
   icc-profiles-free \
   imagemagick \
   # PostgreSQL
-  libpq5 \
   postgresql-client \
   # MySQL / MariaDB
   mariadb-client \
@@ -111,124 +170,60 @@ RUN set -eux \
     && apt-get update \
     && apt-get install --yes --quiet --no-install-recommends ${RUNTIME_PACKAGES} \
     && echo "Installing pre-built updates" \
+      && curl --fail --silent --no-progress-meter --show-error --location --remote-name-all --parallel --parallel-max 4 \
+        https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+        https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
+        https://github.com/paperless-ngx/builder/releases/download/jbig2enc-${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
       && echo "Installing qpdf ${QPDF_VERSION}" \
-        && curl --fail --silent --show-error --location \
-          --output libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
-          https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
-        && curl --fail --silent --show-error --location \
-          --output qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
-          https://github.com/paperless-ngx/builder/releases/download/qpdf-${QPDF_VERSION}/qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
         && dpkg --install ./libqpdf29_${QPDF_VERSION}-1_${TARGETARCH}.deb \
         && dpkg --install ./qpdf_${QPDF_VERSION}-1_${TARGETARCH}.deb \
       && echo "Installing Ghostscript ${GS_VERSION}" \
-        && curl --fail --silent --show-error --location \
-          --output libgs10_${GS_VERSION}.dfsg-2_${TARGETARCH}.deb \
-          https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10_${GS_VERSION}.dfsg-2_${TARGETARCH}.deb \
-        && curl --fail --silent --show-error --location \
-          --output ghostscript_${GS_VERSION}.dfsg-2_${TARGETARCH}.deb \
-          https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/ghostscript_${GS_VERSION}.dfsg-2_${TARGETARCH}.deb \
-        && curl --fail --silent --show-error --location \
-          --output libgs10-common_${GS_VERSION}.dfsg-2_all.deb \
-          https://github.com/paperless-ngx/builder/releases/download/ghostscript-${GS_VERSION}/libgs10-common_${GS_VERSION}.dfsg-2_all.deb \
-        && dpkg --install ./libgs10-common_${GS_VERSION}.dfsg-2_all.deb \
-        && dpkg --install ./libgs10_${GS_VERSION}.dfsg-2_${TARGETARCH}.deb \
-        && dpkg --install ./ghostscript_${GS_VERSION}.dfsg-2_${TARGETARCH}.deb \
+        && dpkg --install ./libgs10-common_${GS_VERSION}.dfsg-1_all.deb \
+        && dpkg --install ./libgs10_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
+        && dpkg --install ./ghostscript_${GS_VERSION}.dfsg-1_${TARGETARCH}.deb \
       && echo "Installing jbig2enc" \
-        && curl --fail --silent --show-error --location \
-          --output jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
-          https://github.com/paperless-ngx/builder/releases/download/jbig2enc-${JBIG2ENC_VERSION}/jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
         && dpkg --install ./jbig2enc_${JBIG2ENC_VERSION}-1_${TARGETARCH}.deb \
+      && echo "Configuring imagemagick" \
+        && cp /etc/ImageMagick-6/paperless-policy.xml /etc/ImageMagick-6/policy.xml \
       && echo "Cleaning up image layer" \
         && rm --force --verbose *.deb \
-    && rm --recursive --force --verbose /var/lib/apt/lists/* \
-  && echo "Installing supervisor" \
-    && python3 -m pip install --default-timeout=1000 --upgrade --no-cache-dir supervisor==4.2.5
-
-# Copy gunicorn config
-# Changes very infrequently
-WORKDIR /usr/src/paperless/
-
-COPY gunicorn.conf.py .
-
-# setup docker-specific things
-# These change sometimes, but rarely
-WORKDIR /usr/src/paperless/src/docker/
-
-COPY [ \
-  "docker/imagemagick-policy.xml", \
-  "docker/supervisord.conf", \
-  "docker/docker-entrypoint.sh", \
-  "docker/docker-prepare.sh", \
-  "docker/paperless_cmd.sh", \
-  "docker/wait-for-redis.py", \
-  "docker/env-from-file.sh", \
-  "docker/management_script.sh", \
-  "docker/flower-conditional.sh", \
-  "docker/install_management_commands.sh", \
-  "/usr/src/paperless/src/docker/" \
-]
-
-RUN set -eux \
-  && echo "Configuring ImageMagick" \
-    && mv imagemagick-policy.xml /etc/ImageMagick-6/policy.xml \
-  && echo "Configuring supervisord" \
-    && mkdir /var/log/supervisord /var/run/supervisord \
-    && mv supervisord.conf /etc/supervisord.conf \
-  && echo "Setting up Docker scripts" \
-    && mv docker-entrypoint.sh /sbin/docker-entrypoint.sh \
-    && chmod 755 /sbin/docker-entrypoint.sh \
-    && mv docker-prepare.sh /sbin/docker-prepare.sh \
-    && chmod 755 /sbin/docker-prepare.sh \
-    && mv wait-for-redis.py /sbin/wait-for-redis.py \
-    && chmod 755 /sbin/wait-for-redis.py \
-    && mv env-from-file.sh /sbin/env-from-file.sh \
-    && chmod 755 /sbin/env-from-file.sh \
-    && mv paperless_cmd.sh /usr/local/bin/paperless_cmd.sh \
-    && chmod 755 /usr/local/bin/paperless_cmd.sh \
-    && mv flower-conditional.sh /usr/local/bin/flower-conditional.sh \
-    && chmod 755 /usr/local/bin/flower-conditional.sh \
-  && echo "Installing managment commands" \
-    && chmod +x install_management_commands.sh \
-    && ./install_management_commands.sh
+    && rm --recursive --force --verbose /var/lib/apt/lists/*
 
 WORKDIR /usr/src/paperless/src/
 
 # Python dependencies
 # Change pretty frequently
-COPY --from=pipenv-base /usr/src/pipenv/requirements.txt ./
+COPY --chown=1000:1000 ["pyproject.toml", "uv.lock", "/usr/src/paperless/src/"]
 
 # Packages needed only for building a few quick Python
 # dependencies
 ARG BUILD_PACKAGES="\
   build-essential \
-  git \
-  # https://www.psycopg.org/docs/install.html#prerequisites
-  libpq-dev \
   # https://github.com/PyMySQL/mysqlclient#linux
   default-libmysqlclient-dev \
   pkg-config"
 
 # hadolint ignore=DL3042
-RUN --mount=type=cache,target=/root/.cache/pip/,id=pip-cache \
+RUN --mount=type=cache,target=${UV_CACHE_DIR},id=python-cache \
   set -eux \
   && echo "Installing build system packages" \
     && apt-get update \
     && apt-get install --yes --quiet --no-install-recommends ${BUILD_PACKAGES} \
-    && python3 -m pip install --no-cache-dir --upgrade wheel \
   && echo "Installing Python requirements" \
-    && python3 -m pip install --default-timeout=1000 --requirement requirements.txt \
-  && echo "Patching whitenoise for compression speedup" \
-    && curl --fail --silent --show-error --location --output 484.patch https://github.com/evansd/whitenoise/pull/484.patch \
-    && patch -d /usr/local/lib/python3.11/site-packages --verbose -p2 < 484.patch \
-    && rm 484.patch \
+    && uv export --quiet --no-dev --all-extras --format requirements-txt --output-file requirements.txt \
+    && uv pip install --system --no-python-downloads --python-preference system --requirements requirements.txt \
   && echo "Installing NLTK data" \
     && python3 -W ignore::RuntimeWarning -m nltk.downloader -d "/usr/share/nltk_data" snowball_data \
     && python3 -W ignore::RuntimeWarning -m nltk.downloader -d "/usr/share/nltk_data" stopwords \
-    && python3 -W ignore::RuntimeWarning -m nltk.downloader -d "/usr/share/nltk_data" punkt \
+    && python3 -W ignore::RuntimeWarning -m nltk.downloader -d "/usr/share/nltk_data" punkt_tab \
   && echo "Cleaning up image" \
     && apt-get --yes purge ${BUILD_PACKAGES} \
     && apt-get --yes autoremove --purge \
     && apt-get clean --yes \
+    && rm --recursive --force --verbose *.whl \
     && rm --recursive --force --verbose /var/lib/apt/lists/* \
     && rm --recursive --force --verbose /tmp/* \
     && rm --recursive --force --verbose /var/tmp/* \
@@ -244,6 +239,7 @@ COPY --from=compile-frontend --chown=1000:1000 /src/src/documents/static/fronten
 # add users, setup scripts
 # Mount the compiled frontend to expected location
 RUN set -eux \
+  && sed -i '1s|^#!/usr/bin/env python3|#!/command/with-contenv python3|' manage.py \
   && echo "Setting up user/group" \
     && addgroup --gid 1000 paperless \
     && useradd --uid 1000 --gid paperless --home-dir /usr/src/paperless paperless \
@@ -252,19 +248,21 @@ RUN set -eux \
     && mkdir --parents --verbose /usr/src/paperless/media \
     && mkdir --parents --verbose /usr/src/paperless/consume \
     && mkdir --parents --verbose /usr/src/paperless/export \
+  && echo "Creating gnupg directory" \
+    && mkdir -m700 --verbose /usr/src/paperless/.gnupg \
   && echo "Adjusting all permissions" \
     && chown --from root:root --changes --recursive paperless:paperless /usr/src/paperless \
   && echo "Collecting static files" \
-    && gosu paperless python3 manage.py collectstatic --clear --no-input --link \
-    && gosu paperless python3 manage.py compilemessages
+    && s6-setuidgid paperless python3 manage.py collectstatic --clear --no-input --link \
+    && s6-setuidgid paperless python3 manage.py compilemessages
 
 VOLUME ["/usr/src/paperless/data", \
         "/usr/src/paperless/media", \
         "/usr/src/paperless/consume", \
         "/usr/src/paperless/export"]
 
-ENTRYPOINT ["/sbin/docker-entrypoint.sh"]
+ENTRYPOINT ["/init"]
 
 EXPOSE 8000
 
-CMD ["/usr/local/bin/paperless_cmd.sh"]
+HEALTHCHECK --interval=30s --timeout=10s --retries=5 CMD [ "curl", "-fs", "-S", "--max-time", "2", "http://localhost:8000" ]

Pipfile

@@ -1,95 +0,0 @@
-[[source]]
-url = "https://pypi.python.org/simple"
-verify_ssl = true
-name = "pypi"
-
-[packages]
-dateparser = "~=1.1"
-# WARNING: django does not use semver.
-#          Only patch versions are guaranteed to not introduce breaking changes.
-django = "~=4.2.7"
-django-auditlog = "*"
-django-celery-results = "*"
-django-compression-middleware = "*"
-django-cors-headers = "*"
-django-extensions = "*"
-django-filter = "~=23.3"
-django-guardian = "*"
-django-multiselectfield = "*"
-djangorestframework = "~=3.14"
-djangorestframework-guardian = "*"
-drf-writable-nested = "*"
-bleach = "*"
-celery = "*"
-channels = "~=4.0"
-channels-redis = "*"
-concurrent-log-handler = "*"
-filelock = "*"
-flower = "*"
-gotenberg-client = "*"
-gunicorn = "*"
-imap-tools = "*"
-inotifyrecursive = "~=0.3"
-langdetect = "*"
-mysqlclient = "*"
-nltk = "*"
-ocrmypdf = "~=15.0"
-pathvalidate = "*"
-pdf2image = "*"
-psycopg2 = "*"
-python-dateutil = "*"
-python-dotenv = "*"
-python-gnupg = "*"
-python-ipware = "*"
-python-magic = "*"
-pyzbar = "*"
-rapidfuzz = "*"
-redis = {extras = ["hiredis"], version = "*"}
-scikit-learn = "~=1.3"
-setproctitle = "*"
-tika-client = "*"
-tqdm = "*"
-uvicorn = {extras = ["standard"], version = "*"}
-watchdog = "~=3.0"
-whitenoise = "~=6.6"
-whoosh="~=2.7"
-zxing-cpp = {version = "*", platform_machine = "== 'x86_64'"}
-
-[dev-packages]
-# Linting
-black = "*"
-pre-commit = "*"
-ruff = "*"
-# Testing
-factory-boy = "*"
-pytest = "*"
-pytest-cov = "*"
-pytest-django = "*"
-pytest-httpx = "*"
-pytest-env = "*"
-pytest-sugar = "*"
-pytest-xdist = "*"
-pytest-rerunfailures = "*"
-imagehash = "*"
-daphne = "*"
-# Documentation
-mkdocs-material = "*"
-mkdocs-glightbox = "*"
-
-[typing-dev]
-mypy = "*"
-types-Pillow = "*"
-django-filter-stubs = "*"
-types-python-dateutil = "*"
-djangorestframework-stubs = {extras= ["compatible-mypy"], version="*"}
-celery-types = "*"
-django-stubs = {extras= ["compatible-mypy"], version="*"}
-types-dateparser = "*"
-types-bleach = "*"
-types-redis = "*"
-types-tqdm = "*"
-types-Markdown = "*"
-types-Pygments = "*"
-types-colorama = "*"
-types-psycopg2 = "*"
-types-setuptools = "*"

README.md

@@ -6,8 +6,11 @@
 [![demo](https://cronitor.io/badges/ve7ItY/production/W5E_B9jkelG9ZbDiNHUPQEVH3MY.svg)](https://demo.paperless-ngx.com)
 
 <p align="center">
-<img src="https://github.com/paperless-ngx/paperless-ngx/raw/main/resources/logo/web/png/Black%20logo%20-%20no%20background.png#gh-light-mode-only" width="50%" />
-<img src="https://github.com/paperless-ngx/paperless-ngx/raw/main/resources/logo/web/png/White%20logo%20-%20no%20background.png#gh-dark-mode-only" width="50%" />
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://github.com/paperless-ngx/paperless-ngx/blob/main/resources/logo/web/png/White%20logo%20-%20no%20background.png" width="50%">
+    <source media="(prefers-color-scheme: light)" srcset="https://github.com/paperless-ngx/paperless-ngx/raw/main/resources/logo/web/png/Black%20logo%20-%20no%20background.png" width="50%">
+    <img src="https://github.com/paperless-ngx/paperless-ngx/raw/main/resources/logo/web/png/Black%20logo%20-%20no%20background.png" width="50%">
+  </picture>
 </p>
 
 <!-- omit in toc -->
@@ -18,7 +21,7 @@ Paperless-ngx is a document management system that transforms your physical docu
 
 Paperless-ngx is the official successor to the original [Paperless](https://github.com/the-paperless-project/paperless) & [Paperless-ng](https://github.com/jonaswinkler/paperless-ng) projects and is designed to distribute the responsibility of advancing and supporting the project among a team of people. [Consider joining us!](#community-support)
 
-A demo is available at [demo.paperless-ngx.com](https://demo.paperless-ngx.com) using login `demo` / `demo`. _Note: demo content is reset frequently and confidential information should not be uploaded._
+Thanks to the generous folks at [DigitalOcean](https://m.do.co/c/8d70b916d462), a demo is available at [demo.paperless-ngx.com](https://demo.paperless-ngx.com) using login `demo` / `demo`. _Note: demo content is reset frequently and confidential information should not be uploaded._
 
 - [Features](#features)
 - [Getting started](#getting-started)
@@ -27,27 +30,40 @@ A demo is available at [demo.paperless-ngx.com](https://demo.paperless-ngx.com)
   - [Translation](#translation)
   - [Feature Requests](#feature-requests)
   - [Bugs](#bugs)
-- [Affiliated Projects](#affiliated-projects)
+- [Related Projects](#related-projects)
 - [Important Note](#important-note)
 
+<p align="right">This project is supported by:<br/>
+  <a href="https://m.do.co/c/8d70b916d462" style="padding-top: 4px; display: block;">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_white.svg" width="140px">
+      <source media="(prefers-color-scheme: light)" srcset="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" width="140px">
+      <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_black_.svg" width="140px">
+    </picture>
+  </a>
+</p>
+
 # Features
 
-![Dashboard](https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/docs/assets/screenshots/documents-smallcards.png#gh-light-mode-only)
-![Dashboard](https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/docs/assets/screenshots/documents-smallcards-dark.png#gh-dark-mode-only)
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/docs/assets/screenshots/documents-smallcards-dark.png">
+  <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/docs/assets/screenshots/documents-smallcards.png">
+  <img src="https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/docs/assets/screenshots/documents-smallcards.png">
+</picture>
 
 A full list of [features](https://docs.paperless-ngx.com/#features) and [screenshots](https://docs.paperless-ngx.com/#screenshots) are available in the [documentation](https://docs.paperless-ngx.com/).
 
 # Getting started
 
-The easiest way to deploy paperless is docker-compose. The files in the [`/docker/compose` directory](https://github.com/paperless-ngx/paperless-ngx/tree/main/docker/compose) are configured to pull the image from GitHub Packages.
+The easiest way to deploy paperless is `docker compose`. The files in the [`/docker/compose` directory](https://github.com/paperless-ngx/paperless-ngx/tree/main/docker/compose) are configured to pull the image from the GitHub container registry.
 
-If you'd like to jump right in, you can configure a docker-compose environment with our install script:
+If you'd like to jump right in, you can configure a `docker compose` environment with our install script:
 
 ```bash
 bash -c "$(curl -L https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/install-paperless-ngx.sh)"
 ```
 
-Alternatively, you can install the dependencies and setup apache and a database server yourself. The [documentation](https://docs.paperless-ngx.com/setup/#installation) has a step by step guide on how to do it.
+More details and step-by-step guides for alternative installation methods can be found in [the documentation](https://docs.paperless-ngx.com/setup/#installation).
 
 Migrating from Paperless-ng is easy, just drop in the new docker image! See the [documentation on migrating](https://docs.paperless-ngx.com/setup/#migrating-to-paperless-ngx) for more details.
 
@@ -67,7 +83,7 @@ People interested in continuing the work on paperless-ngx are encouraged to reac
 
 ## Translation
 
-Paperless-ngx is available in many languages that are coordinated on Crowdin. If you want to help out by translating paperless-ngx into your language, please head over to https://crwd.in/paperless-ngx, and thank you! More details can be found in [CONTRIBUTING.md](https://github.com/paperless-ngx/paperless-ngx/blob/main/CONTRIBUTING.md#translating-paperless-ngx).
+Paperless-ngx is available in many languages that are coordinated on Crowdin. If you want to help out by translating paperless-ngx into your language, please head over to https://crowdin.com/project/paperless-ngx, and thank you! More details can be found in [CONTRIBUTING.md](https://github.com/paperless-ngx/paperless-ngx/blob/main/CONTRIBUTING.md#translating-paperless-ngx).
 
 ## Feature Requests
 
@@ -77,9 +93,9 @@ Feature requests can be submitted via [GitHub Discussions](https://github.com/pa
 
 For bugs please [open an issue](https://github.com/paperless-ngx/paperless-ngx/issues) or [start a discussion](https://github.com/paperless-ngx/paperless-ngx/discussions) if you have questions.
 
-# Affiliated Projects
+# Related Projects
 
-Please see [the wiki](https://github.com/paperless-ngx/paperless-ngx/wiki/Affiliated-Projects) for a user-maintained list of affiliated projects and software that is compatible with Paperless-ngx.
+Please see [the wiki](https://github.com/paperless-ngx/paperless-ngx/wiki/Related-Projects) for a user-maintained list of related projects and software that is compatible with Paperless-ngx.
 
 # Important Note
 

SECURITY.md

@@ -0,0 +1,9 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+The Paperless-ngx team and community take security bugs seriously. We appreciate your efforts to responsibly disclose your findings, and will make every effort to acknowledge your contributions.
+
+To report a security issue, please use the GitHub Security Advisory ["Report a Vulnerability"](https://github.com/paperless-ngx/paperless-ngx/security/advisories/new) tab.
+
+The team will send a response indicating the next steps in handling your report. After the initial reply to your report, the security team will keep you informed of the progress towards a fix and full announcement, and may ask for additional information or guidance.

crowdin.yml

@@ -1,8 +1,6 @@
-commit_message: '[ci skip]'
-pull_request_labels: [
-  "skip-changelog",
-  "translation"
-]
+project_id_env: CROWDIN_PROJECT_ID
+api_token_env: CROWDIN_PERSONAL_TOKEN
+preserve_hierarchy: true
 files:
   - source: /src/locale/en_US/LC_MESSAGES/django.po
     translation: /src/locale/%locale_with_underscore%/LC_MESSAGES/django.po

docker/compose/docker-compose.ci-test.yml

@@ -1,12 +1,11 @@
-# docker-compose file for running paperless testing with actual gotenberg
+# Docker Compose file for running paperless testing with actual gotenberg
 # and Tika containers for a more end to end test of the Tika related functionality
-# Can be used locally or by the CI to start the nessecary containers with the
+# Can be used locally or by the CI to start the necessary containers with the
 # correct networking for the tests
 
-version: "3.7"
 services:
   gotenberg:
-    image: docker.io/gotenberg/gotenberg:7.8
+    image: docker.io/gotenberg/gotenberg:8.19
     hostname: gotenberg
     container_name: gotenberg
     network_mode: host
@@ -17,8 +16,10 @@ services:
       - "gotenberg"
       - "--chromium-disable-javascript=true"
       - "--chromium-allow-list=file:///tmp/.*"
+      - "--log-level=warn"
+      - "--log-format=text"
   tika:
-    image: ghcr.io/paperless-ngx/tika:latest
+    image: docker.io/apache/tika:latest
     hostname: tika
     container_name: tika
     network_mode: host

docker/compose/docker-compose.env

@@ -1,26 +1,17 @@
+###############################################################################
+# Paperless-ngx settings                                                      #
+###############################################################################
+
+# See http://docs.paperless-ngx.com/configuration/ for all available options.
+
 # The UID and GID of the user used to run paperless in the container. Set this
 # to your UID and GID on the host so that you have write access to the
 # consumption directory.
 #USERMAP_UID=1000
 #USERMAP_GID=1000
 
-# Additional languages to install for text recognition, separated by a
-# whitespace. Note that this is
-# different from PAPERLESS_OCR_LANGUAGE (default=eng), which defines the
-# language used for OCR.
-# The container installs English, German, Italian, Spanish and French by
-# default.
-# See https://packages.debian.org/search?keywords=tesseract-ocr-&searchon=names&suite=buster
-# for available languages.
-#PAPERLESS_OCR_LANGUAGES=tur ces
-
-###############################################################################
-# Paperless-specific settings                                                 #
-###############################################################################
-
-# All settings defined in the paperless.conf.example can be used here. The
-# Docker setup does not use the configuration file.
-# A few commonly adjusted settings are provided below.
+# See the documentation linked above for all options. A few commonly adjusted settings
+# are provided below.
 
 # This is required if you will be exposing Paperless-ngx on a public domain
 # (if doing so please consider security measures such as reverse proxy)
@@ -30,13 +21,17 @@
 # be a very long sequence of random characters. You don't need to remember it.
 #PAPERLESS_SECRET_KEY=change-me
 
-# Use this variable to set a timezone for the Paperless Docker containers. If not specified, defaults to UTC.
+# Use this variable to set a timezone for the Paperless Docker containers. Defaults to UTC.
 #PAPERLESS_TIME_ZONE=America/Los_Angeles
 
 # The default language to use for OCR. Set this to the language most of your
 # documents are written in.
 #PAPERLESS_OCR_LANGUAGE=eng
 
-# Set if accessing paperless via a domain subpath e.g. https://domain.com/PATHPREFIX and using a reverse-proxy like traefik or nginx
-#PAPERLESS_FORCE_SCRIPT_NAME=/PATHPREFIX
-#PAPERLESS_STATIC_URL=/PATHPREFIX/static/ # trailing slash required
+# Additional languages to install for text recognition, separated by a whitespace.
+# Note that this is different from PAPERLESS_OCR_LANGUAGE (default=eng), which defines
+# the language used for OCR.
+# The container installs English, German, Italian, Spanish and French by default.
+# See https://packages.debian.org/search?keywords=tesseract-ocr-&searchon=names&suite=buster
+# for available languages.
+#PAPERLESS_OCR_LANGUAGES=tur ces

docker/compose/docker-compose.mariadb-tika.yml

@@ -1,4 +1,4 @@
-# docker-compose file for running paperless from the Docker Hub.
+# docker compose file for running paperless from the Docker Hub.
 # This file contains everything paperless needs to run.
 # Paperless supports amd64, arm and arm64 hardware.
 #
@@ -10,7 +10,7 @@
 #   as this file and mounted to the correct folders inside the container.
 # - Paperless listens on port 8000.
 #
-# In addition to that, this docker-compose file adds the following optional
+# In addition to that, this Docker Compose file adds the following optional
 # configurations:
 #
 # - Instead of SQLite (default), MariaDB is used as the database server.
@@ -23,14 +23,13 @@
 #
 # - Copy this file as 'docker-compose.yml' and the files 'docker-compose.env'
 #   and '.env' into a folder.
-# - Run 'docker-compose pull'.
-# - Run 'docker-compose run --rm webserver createsuperuser' to create a user.
-# - Run 'docker-compose up -d'.
+# - Run 'docker compose pull'.
+# - Run 'docker compose up -d'.
+
 #
 # For more extensive installation and update instructions, refer to the
 # documentation.
 
-version: "3.4"
 services:
   broker:
     image: docker.io/library/redis:7
@@ -39,7 +38,7 @@ services:
       - redisdata:/data
 
   db:
-    image: docker.io/library/mariadb:10
+    image: docker.io/library/mariadb:11
     restart: unless-stopped
     volumes:
       - dbdata:/var/lib/mysql
@@ -60,11 +59,6 @@ services:
       - tika
     ports:
       - "8000:8000"
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8000"]
-      interval: 30s
-      timeout: 10s
-      retries: 5
     volumes:
       - data:/usr/src/paperless/data
       - media:/usr/src/paperless/media
@@ -83,7 +77,7 @@ services:
       PAPERLESS_TIKA_ENDPOINT: http://tika:9998
 
   gotenberg:
-    image: docker.io/gotenberg/gotenberg:7.8
+    image: docker.io/gotenberg/gotenberg:8.19
     restart: unless-stopped
     # The gotenberg chromium route is used to convert .eml files. We do not
     # want to allow external content like tracking pixels or even javascript.
@@ -93,7 +87,7 @@ services:
       - "--chromium-allow-list=file:///tmp/.*"
 
   tika:
-    image: ghcr.io/paperless-ngx/tika:latest
+    image: docker.io/apache/tika:latest
     restart: unless-stopped
 
 volumes:

docker/compose/docker-compose.mariadb.yml

@@ -1,4 +1,4 @@
-# docker-compose file for running paperless from the Docker Hub.
+# Docker Compose file for running paperless from the Docker Hub.
 # This file contains everything paperless needs to run.
 # Paperless supports amd64, arm and arm64 hardware.
 #
@@ -10,7 +10,7 @@
 #   as this file and mounted to the correct folders inside the container.
 # - Paperless listens on port 8000.
 #
-# In addition to that, this docker-compose file adds the following optional
+# In addition to that, this Docker Compose file adds the following optional
 # configurations:
 #
 # - Instead of SQLite (default), MariaDB is used as the database server.
@@ -19,14 +19,12 @@
 #
 # - Copy this file as 'docker-compose.yml' and the files 'docker-compose.env'
 #   and '.env' into a folder.
-# - Run 'docker-compose pull'.
-# - Run 'docker-compose run --rm webserver createsuperuser' to create a user.
-# - Run 'docker-compose up -d'.
+# - Run 'docker compose pull'.
+# - Run 'docker compose up -d'.
 #
 # For more extensive installation and update instructions, refer to the
 # documentation.
 
-version: "3.4"
 services:
   broker:
     image: docker.io/library/redis:7
@@ -35,7 +33,7 @@ services:
       - redisdata:/data
 
   db:
-    image: docker.io/library/mariadb:10
+    image: docker.io/library/mariadb:11
     restart: unless-stopped
     volumes:
       - dbdata:/var/lib/mysql
@@ -54,11 +52,6 @@ services:
       - broker
     ports:
       - "8000:8000"
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8000"]
-      interval: 30s
-      timeout: 10s
-      retries: 5
     volumes:
       - data:/usr/src/paperless/data
       - media:/usr/src/paperless/media
@@ -73,7 +66,6 @@ services:
       PAPERLESS_DBPASS: paperless # only needed if non-default password
       PAPERLESS_DBPORT: 3306
 
-
 volumes:
   data:
   media:

docker/compose/docker-compose.portainer.yml

@@ -1,4 +1,4 @@
-# docker-compose file for running paperless from the Docker Hub.
+# Docker Compose file for running paperless from the Docker Hub.
 # This file contains everything paperless needs to run.
 # Paperless supports amd64, arm and arm64 hardware.
 #
@@ -10,7 +10,7 @@
 #   as this file and mounted to the correct folders inside the container.
 # - Paperless listens on port 8010.
 #
-# In addition to that, this docker-compose file adds the following optional
+# In addition to that, this Docker Compose file adds the following optional
 # configurations:
 #
 # - Instead of SQLite (default), PostgreSQL is used as the database server.
@@ -18,17 +18,14 @@
 # To install and update paperless with this file, do the following:
 #
 # - Open portainer Stacks list and click 'Add stack'
-# - Paste the contents of this file and assign a name, e.g. 'Paperless'
+# - Paste the contents of this file and assign a name, e.g. 'paperless'
+# - Upload 'docker-compose.env' by clicking on 'Load variables from .env file'
+# - Modify the environment variables as needed
 # - Click 'Deploy the stack' and wait for it to be deployed
-# - Open the list of containers, select paperless_webserver_1
-# - Click 'Console' and then 'Connect' to open the command line inside the container
-# - Run 'python3 manage.py createsuperuser' to create a user
-# - Exit the console
 #
 # For more extensive installation and update instructions, refer to the
 # documentation.
 
-version: "3.4"
 services:
   broker:
     image: docker.io/library/redis:7
@@ -37,7 +34,7 @@ services:
       - redisdata:/data
 
   db:
-    image: docker.io/library/postgres:15
+    image: docker.io/library/postgres:17
     restart: unless-stopped
     volumes:
       - pgdata:/var/lib/postgresql/data
@@ -54,11 +51,6 @@ services:
       - broker
     ports:
       - "8010:8000"
-    healthcheck:
-      test: ["CMD", "curl", "-fs", "-S", "--max-time", "2", "http://localhost:8000"]
-      interval: 30s
-      timeout: 10s
-      retries: 5
     volumes:
       - data:/usr/src/paperless/data
       - media:/usr/src/paperless/media
@@ -67,28 +59,8 @@ services:
     environment:
       PAPERLESS_REDIS: redis://broker:6379
       PAPERLESS_DBHOST: db
-# The UID and GID of the user used to run paperless in the container. Set this
-# to your UID and GID on the host so that you have write access to the
-# consumption directory.
-      USERMAP_UID: 1000
-      USERMAP_GID: 100
-# Additional languages to install for text recognition, separated by a
-# whitespace. Note that this is
-# different from PAPERLESS_OCR_LANGUAGE (default=eng), which defines the
-# language used for OCR.
-# The container installs English, German, Italian, Spanish and French by
-# default.
-# See https://packages.debian.org/search?keywords=tesseract-ocr-&searchon=names&suite=buster
-# for available languages.
-      #PAPERLESS_OCR_LANGUAGES: tur ces
-# Adjust this key if you plan to make paperless available publicly. It should
-# be a very long sequence of random characters. You don't need to remember it.
-      #PAPERLESS_SECRET_KEY: change-me
-# Use this variable to set a timezone for the Paperless Docker containers. If not specified, defaults to UTC.
-      #PAPERLESS_TIME_ZONE: America/Los_Angeles
-# The default language to use for OCR. Set this to the language most of your
-# documents are written in.
-      #PAPERLESS_OCR_LANGUAGE: eng
+    env_file:
+      - stack.env
 
 volumes:
   data:

docker/compose/docker-compose.postgres-tika.yml

@@ -1,4 +1,4 @@
-# docker-compose file for running paperless from the docker container registry.
+# Docker Compose file for running paperless from the docker container registry.
 # This file contains everything paperless needs to run.
 # Paperless supports amd64, arm and arm64 hardware.
 #
@@ -10,7 +10,7 @@
 #   as this file and mounted to the correct folders inside the container.
 # - Paperless listens on port 8000.
 #
-# In addition to that, this docker-compose file adds the following optional
+# In addition to that, this Docker Compose file adds the following optional
 # configurations:
 #
 # - Instead of SQLite (default), PostgreSQL is used as the database server.
@@ -23,14 +23,12 @@
 #
 # - Copy this file as 'docker-compose.yml' and the files 'docker-compose.env'
 #   and '.env' into a folder.
-# - Run 'docker-compose pull'.
-# - Run 'docker-compose run --rm webserver createsuperuser' to create a user.
-# - Run 'docker-compose up -d'.
+# - Run 'docker compose pull'.
+# - Run 'docker compose up -d'.
 #
 # For more extensive installation and update instructions, refer to the
 # documentation.
 
-version: "3.4"
 services:
   broker:
     image: docker.io/library/redis:7
@@ -39,7 +37,7 @@ services:
       - redisdata:/data
 
   db:
-    image: docker.io/library/postgres:15
+    image: docker.io/library/postgres:17
     restart: unless-stopped
     volumes:
       - pgdata:/var/lib/postgresql/data
@@ -58,11 +56,6 @@ services:
       - tika
     ports:
       - "8000:8000"
-    healthcheck:
-      test: ["CMD", "curl", "-fs", "-S", "--max-time", "2", "http://localhost:8000"]
-      interval: 30s
-      timeout: 10s
-      retries: 5
     volumes:
       - data:/usr/src/paperless/data
       - media:/usr/src/paperless/media
@@ -77,7 +70,7 @@ services:
       PAPERLESS_TIKA_ENDPOINT: http://tika:9998
 
   gotenberg:
-    image: docker.io/gotenberg/gotenberg:7.8
+    image: docker.io/gotenberg/gotenberg:8.19
     restart: unless-stopped
 
     # The gotenberg chromium route is used to convert .eml files. We do not
@@ -88,7 +81,7 @@ services:
       - "--chromium-allow-list=file:///tmp/.*"
 
   tika:
-    image: ghcr.io/paperless-ngx/tika:latest
+    image: docker.io/apache/tika:latest
     restart: unless-stopped
 
 volumes:

docker/compose/docker-compose.postgres.yml

@@ -1,4 +1,4 @@
-# docker-compose file for running paperless from the Docker Hub.
+# Docker Compose file for running paperless from the Docker Hub.
 # This file contains everything paperless needs to run.
 # Paperless supports amd64, arm and arm64 hardware.
 #
@@ -10,7 +10,7 @@
 #   as this file and mounted to the correct folders inside the container.
 # - Paperless listens on port 8000.
 #
-# In addition to that, this docker-compose file adds the following optional
+# In addition to that, this Docker Compose file adds the following optional
 # configurations:
 #
 # - Instead of SQLite (default), PostgreSQL is used as the database server.
@@ -19,14 +19,12 @@
 #
 # - Copy this file as 'docker-compose.yml' and the files 'docker-compose.env'
 #   and '.env' into a folder.
-# - Run 'docker-compose pull'.
-# - Run 'docker-compose run --rm webserver createsuperuser' to create a user.
-# - Run 'docker-compose up -d'.
+# - Run 'docker compose pull'.
+# - Run 'docker compose up -d'.
 #
 # For more extensive installation and update instructions, refer to the
 # documentation.
 
-version: "3.4"
 services:
   broker:
     image: docker.io/library/redis:7
@@ -35,7 +33,7 @@ services:
       - redisdata:/data
 
   db:
-    image: docker.io/library/postgres:15
+    image: docker.io/library/postgres:17
     restart: unless-stopped
     volumes:
       - pgdata:/var/lib/postgresql/data
@@ -52,11 +50,6 @@ services:
       - broker
     ports:
       - "8000:8000"
-    healthcheck:
-      test: ["CMD", "curl", "-fs", "-S", "--max-time", "2", "http://localhost:8000"]
-      interval: 30s
-      timeout: 10s
-      retries: 5
     volumes:
       - data:/usr/src/paperless/data
       - media:/usr/src/paperless/media
@@ -67,7 +60,6 @@ services:
       PAPERLESS_REDIS: redis://broker:6379
       PAPERLESS_DBHOST: db
 
-
 volumes:
   data:
   media:

docker/compose/docker-compose.sqlite-tika.yml

@@ -1,4 +1,4 @@
-# docker-compose file for running paperless from the docker container registry.
+# Docker Compose file for running paperless from the docker container registry.
 # This file contains everything paperless needs to run.
 # Paperless supports amd64, arm and arm64 hardware.
 # All compose files of paperless configure paperless in the following way:
@@ -11,7 +11,7 @@
 #
 # SQLite is used as the database. The SQLite file is stored in the data volume.
 #
-# In addition to that, this docker-compose file adds the following optional
+# In addition to that, this Docker Compose file adds the following optional
 # configurations:
 #
 # - Apache Tika and Gotenberg servers are started with paperless and paperless
@@ -23,14 +23,12 @@
 #
 # - Copy this file as 'docker-compose.yml' and the files 'docker-compose.env'
 #   and '.env' into a folder.
-# - Run 'docker-compose pull'.
-# - Run 'docker-compose run --rm webserver createsuperuser' to create a user.
-# - Run 'docker-compose up -d'.
+# - Run 'docker compose pull'.
+# - Run 'docker compose up -d'.
 #
 # For more extensive installation and update instructions, refer to the
 # documentation.
 
-version: "3.4"
 services:
   broker:
     image: docker.io/library/redis:7
@@ -47,11 +45,6 @@ services:
       - tika
     ports:
       - "8000:8000"
-    healthcheck:
-      test: ["CMD", "curl", "-fs", "-S", "--max-time", "2", "http://localhost:8000"]
-      interval: 30s
-      timeout: 10s
-      retries: 5
     volumes:
       - data:/usr/src/paperless/data
       - media:/usr/src/paperless/media
@@ -65,7 +58,7 @@ services:
       PAPERLESS_TIKA_ENDPOINT: http://tika:9998
 
   gotenberg:
-    image: docker.io/gotenberg/gotenberg:7.8
+    image: docker.io/gotenberg/gotenberg:8.19
     restart: unless-stopped
 
     # The gotenberg chromium route is used to convert .eml files. We do not
@@ -76,7 +69,7 @@ services:
       - "--chromium-allow-list=file:///tmp/.*"
 
   tika:
-    image: ghcr.io/paperless-ngx/tika:latest
+    image: docker.io/apache/tika:latest
     restart: unless-stopped
 
 volumes:

docker/compose/docker-compose.sqlite.yml

@@ -1,4 +1,4 @@
-# docker-compose file for running paperless from the Docker Hub.
+# Docker Compose file for running paperless from the Docker Hub.
 # This file contains everything paperless needs to run.
 # Paperless supports amd64, arm and arm64 hardware.
 #
@@ -16,14 +16,12 @@
 #
 # - Copy this file as 'docker-compose.yml' and the files 'docker-compose.env'
 #   and '.env' into a folder.
-# - Run 'docker-compose pull'.
-# - Run 'docker-compose run --rm webserver createsuperuser' to create a user.
-# - Run 'docker-compose up -d'.
+# - Run 'docker compose pull'.
+# - Run 'docker compose up -d'.
 #
 # For more extensive installation and update instructions, refer to the
 # documentation.
 
-version: "3.4"
 services:
   broker:
     image: docker.io/library/redis:7
@@ -38,11 +36,6 @@ services:
       - broker
     ports:
       - "8000:8000"
-    healthcheck:
-      test: ["CMD", "curl", "-fs", "-S", "--max-time", "2", "http://localhost:8000"]
-      interval: 30s
-      timeout: 10s
-      retries: 5
     volumes:
       - data:/usr/src/paperless/data
       - media:/usr/src/paperless/media
@@ -52,7 +45,6 @@ services:
     environment:
       PAPERLESS_REDIS: redis://broker:6379
 
-
 volumes:
   data:
   media:

docker/docker-entrypoint.sh

@@ -1,168 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-# Source: https://github.com/sameersbn/docker-gitlab/
-map_uidgid() {
-	local -r usermap_original_uid=$(id -u paperless)
-	local -r usermap_original_gid=$(id -g paperless)
-	local -r usermap_new_uid=${USERMAP_UID:-$usermap_original_uid}
-	local -r usermap_new_gid=${USERMAP_GID:-${usermap_original_gid:-$usermap_new_uid}}
-	if [[ ${usermap_new_uid} != "${usermap_original_uid}" || ${usermap_new_gid} != "${usermap_original_gid}" ]]; then
-		echo "Mapping UID and GID for paperless:paperless to $usermap_new_uid:$usermap_new_gid"
-		usermod -o -u "${usermap_new_uid}" paperless
-		groupmod -o -g "${usermap_new_gid}" paperless
-	fi
-}
-
-map_folders() {
-	# Export these so they can be used in docker-prepare.sh
-	export DATA_DIR="${PAPERLESS_DATA_DIR:-/usr/src/paperless/data}"
-	export MEDIA_ROOT_DIR="${PAPERLESS_MEDIA_ROOT:-/usr/src/paperless/media}"
-	export CONSUME_DIR="${PAPERLESS_CONSUMPTION_DIR:-/usr/src/paperless/consume}"
-}
-
-custom_container_init() {
-	# Mostly borrowed from the LinuxServer.io base image
-	# https://github.com/linuxserver/docker-baseimage-ubuntu/tree/bionic/root/etc/cont-init.d
-	local -r custom_script_dir="/custom-cont-init.d"
-	# Tamper checking.
-	# Don't run files which are owned by anyone except root
-	# Don't run files which are writeable by others
-	if [ -d "${custom_script_dir}" ]; then
-		if [ -n "$(/usr/bin/find "${custom_script_dir}" -maxdepth 1 ! -user root)" ]; then
-			echo "**** Potential tampering with custom scripts detected ****"
-			echo "**** The folder '${custom_script_dir}' must be owned by root ****"
-			return 0
-		fi
-		if [ -n "$(/usr/bin/find "${custom_script_dir}" -maxdepth 1 -perm -o+w)" ]; then
-			echo "**** The folder '${custom_script_dir}' or some of contents have write permissions for others, which is a security risk. ****"
-			echo "**** Please review the permissions and their contents to make sure they are owned by root, and can only be modified by root. ****"
-			return 0
-		fi
-
-		# Make sure custom init directory has files in it
-		if [ -n "$(/bin/ls -A "${custom_script_dir}" 2>/dev/null)" ]; then
-			echo "[custom-init] files found in ${custom_script_dir} executing"
-			# Loop over files in the directory
-			for SCRIPT in "${custom_script_dir}"/*; do
-				NAME="$(basename "${SCRIPT}")"
-				if [ -f "${SCRIPT}" ]; then
-					echo "[custom-init] ${NAME}: executing..."
-					/bin/bash "${SCRIPT}"
-					echo "[custom-init] ${NAME}: exited $?"
-				elif [ ! -f "${SCRIPT}" ]; then
-					echo "[custom-init] ${NAME}: is not a file"
-				fi
-			done
-		else
-			echo "[custom-init] no custom files found exiting..."
-		fi
-
-	fi
-}
-
-initialize() {
-
-	# Setup environment from secrets before anything else
-	# Check for a version of this var with _FILE appended
-	# and convert the contents to the env var value
-	# Source it so export is persistent
-	# shellcheck disable=SC1091
-	source /sbin/env-from-file.sh
-
-	# Change the user and group IDs if needed
-	map_uidgid
-
-	# Check for overrides of certain folders
-	map_folders
-
-	local -r export_dir="/usr/src/paperless/export"
-
-	for dir in \
-		"${export_dir}" \
-		"${DATA_DIR}" "${DATA_DIR}/index" \
-		"${MEDIA_ROOT_DIR}" "${MEDIA_ROOT_DIR}/documents" "${MEDIA_ROOT_DIR}/documents/originals" "${MEDIA_ROOT_DIR}/documents/thumbnails" \
-		"${CONSUME_DIR}"; do
-		if [[ ! -d "${dir}" ]]; then
-			echo "Creating directory ${dir}"
-			mkdir "${dir}"
-		fi
-	done
-
-	local -r tmp_dir="/tmp/paperless"
-	echo "Creating directory ${tmp_dir}"
-	mkdir -p "${tmp_dir}"
-
-	set +e
-	echo "Adjusting permissions of paperless files. This may take a while."
-	chown -R paperless:paperless ${tmp_dir}
-	for dir in \
-		"${export_dir}" \
-		"${DATA_DIR}" \
-		"${MEDIA_ROOT_DIR}" \
-		"${CONSUME_DIR}"; do
-		find "${dir}" -not \( -user paperless -and -group paperless \) -exec chown paperless:paperless {} +
-	done
-	set -e
-
-	"${gosu_cmd[@]}" /sbin/docker-prepare.sh
-
-	# Leave this last thing
-	custom_container_init
-
-}
-
-install_languages() {
-	echo "Installing languages..."
-
-	read -ra langs <<<"$1"
-
-	# Check that it is not empty
-	if [ ${#langs[@]} -eq 0 ]; then
-		return
-	fi
-	apt-get update
-
-	for lang in "${langs[@]}"; do
-		pkg="tesseract-ocr-$lang"
-
-		if dpkg -s "$pkg" &>/dev/null; then
-			echo "Package $pkg already installed!"
-			continue
-		fi
-
-		if ! apt-cache show "$pkg" &>/dev/null; then
-			echo "Package $pkg not found! :("
-			continue
-		fi
-
-		echo "Installing package $pkg..."
-		if ! apt-get -y install "$pkg" &>/dev/null; then
-			echo "Could not install $pkg"
-			exit 1
-		fi
-	done
-}
-
-echo "Paperless-ngx docker container starting..."
-
-gosu_cmd=(gosu paperless)
-if [ "$(id -u)" == "$(id -u paperless)" ]; then
-	gosu_cmd=()
-fi
-
-# Install additional languages if specified
-if [[ -n "$PAPERLESS_OCR_LANGUAGES" ]]; then
-	install_languages "$PAPERLESS_OCR_LANGUAGES"
-fi
-
-initialize
-
-if [[ "$1" != "/"* ]]; then
-	echo Executing management command "$@"
-	exec "${gosu_cmd[@]}" python3 manage.py "$@"
-else
-	echo Executing "$@"
-	exec "$@"
-fi

docker/docker-prepare.sh

@@ -1,118 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-wait_for_postgres() {
-	local attempt_num=1
-	local -r max_attempts=5
-
-	echo "Waiting for PostgreSQL to start..."
-
-	local -r host="${PAPERLESS_DBHOST:-localhost}"
-	local -r port="${PAPERLESS_DBPORT:-5432}"
-
-	# Disable warning, host and port can't have spaces
-	# shellcheck disable=SC2086
-	while [ ! "$(pg_isready -h ${host} -p ${port})" ]; do
-
-		if [ $attempt_num -eq $max_attempts ]; then
-			echo "Unable to connect to database."
-			exit 1
-		else
-			echo "Attempt $attempt_num failed! Trying again in 5 seconds..."
-		fi
-
-		attempt_num=$(("$attempt_num" + 1))
-		sleep 5
-	done
-}
-
-wait_for_mariadb() {
-	echo "Waiting for MariaDB to start..."
-
-	local -r host="${PAPERLESS_DBHOST:=localhost}"
-	local -r port="${PAPERLESS_DBPORT:=3306}"
-
-	local attempt_num=1
-	local -r max_attempts=5
-
-	# Disable warning, host and port can't have spaces
-	# shellcheck disable=SC2086
-	while ! true > /dev/tcp/$host/$port; do
-
-		if [ $attempt_num -eq $max_attempts ]; then
-			echo "Unable to connect to database."
-			exit 1
-		else
-			echo "Attempt $attempt_num failed! Trying again in 5 seconds..."
-
-		fi
-
-		attempt_num=$(("$attempt_num" + 1))
-		sleep 5
-	done
-}
-
-wait_for_redis() {
-	# We use a Python script to send the Redis ping
-	# instead of installing redis-tools just for 1 thing
-	if ! python3 /sbin/wait-for-redis.py; then
-		exit 1
-	fi
-}
-
-migrations() {
-	(
-		# flock is in place to prevent multiple containers from doing migrations
-		# simultaneously. This also ensures that the db is ready when the command
-		# of the current container starts.
-		flock 200
-		echo "Apply database migrations..."
-		python3 manage.py migrate --skip-checks --no-input
-	) 200>"${DATA_DIR}/migration_lock"
-}
-
-django_checks() {
-	# Explicitly run the Django system checks
-	echo "Running Django checks"
-	python3 manage.py check
-}
-
-search_index() {
-
-	local -r index_version=7
-	local -r index_version_file=${DATA_DIR}/.index_version
-
-	if [[ (! -f "${index_version_file}") || $(<"${index_version_file}") != "$index_version" ]]; then
-		echo "Search index out of date. Updating..."
-		python3 manage.py document_index reindex --no-progress-bar
-		echo ${index_version} | tee "${index_version_file}" >/dev/null
-	fi
-}
-
-superuser() {
-	if [[ -n "${PAPERLESS_ADMIN_USER}" ]]; then
-		python3 manage.py manage_superuser
-	fi
-}
-
-do_work() {
-	if [[ "${PAPERLESS_DBENGINE}" == "mariadb" ]]; then
-		wait_for_mariadb
-	elif [[ -n "${PAPERLESS_DBHOST}" ]]; then
-		wait_for_postgres
-	fi
-
-	wait_for_redis
-
-	migrations
-
-	django_checks
-
-	search_index
-
-	superuser
-
-}
-
-do_work

docker/env-from-file.sh

@@ -1,42 +0,0 @@
-#!/usr/bin/env bash
-
-# Scans the environment variables for those with the suffix _FILE
-# When located, checks the file exists, and exports the contents
-# of the file as the same name, minus the suffix
-# This allows the use of Docker secrets or mounted files
-# to fill in any of the settings configurable via environment
-# variables
-
-set -eu
-
-for line in $(printenv)
-do
-	# Extract the name of the environment variable
-	env_name=${line%%=*}
-	# Check if it starts with "PAPERLESS_" and ends in "_FILE"
-	if [[ ${env_name} == PAPERLESS_*_FILE ]]; then
-		# This should have been named different..
-		if [[ ${env_name} == "PAPERLESS_OCR_SKIP_ARCHIVE_FILE" ]]; then
-			continue
-		fi
-		# Extract the value of the environment
-		env_value=${line#*=}
-
-		# Check the file exists
-		if [[ -f ${env_value} ]]; then
-
-			# Trim off the _FILE suffix
-			non_file_env_name=${env_name%"_FILE"}
-			echo "Setting ${non_file_env_name} from file"
-
-			# Reads the value from th file
-			val="$(< "${!env_name}")"
-
-			# Sets the normal name to the read file contents
-			export "${non_file_env_name}"="${val}"
-
-		else
-			echo "File ${env_value} referenced by ${env_name} doesn't exist"
-		fi
-	fi
-done

docker/flower-conditional.sh

@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-
-echo "Checking if we should start flower..."
-
-if [[ -n  "${PAPERLESS_ENABLE_FLOWER}" ]]; then
-	# Small delay to allow celery to be up first
-	echo "Starting flower in 5s"
-	sleep 5
-	celery --app paperless flower --conf=/usr/src/paperless/src/paperless/flowerconfig.py
-else
-	echo "Not starting flower"
-fi

docker/install_management_commands.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 
+# Run this script to generate the management commands again (for example if a new command is create or the template is updated)
+
 set -eu
 
 for command in decrypt_documents \
@@ -14,9 +16,12 @@ for command in decrypt_documents \
 	document_thumbnails \
 	document_sanity_checker \
 	document_fuzzy_match \
-	manage_superuser;
+	manage_superuser \
+	convert_mariadb_uuid \
+	prune_audit_logs \
+	createsuperuser;
 do
 	echo "installing $command..."
-	sed "s/management_command/$command/g" management_script.sh > /usr/local/bin/$command
-	chmod +x /usr/local/bin/$command
+	sed "s/management_command/$command/g" management_script.sh >"$PWD/rootfs/usr/local/bin/$command"
+	chmod u=rwx,g=rwx,o=rx "$PWD/rootfs/usr/local/bin/$command"
 done

docker/management_script.sh

@@ -1,17 +1,13 @@
-#!/usr/bin/env bash
+#!/command/with-contenv /usr/bin/bash
+# shellcheck shell=bash
 
 set -e
 
-cd /usr/src/paperless/src/
-# This ensures environment is setup
-# shellcheck disable=SC1091
-source /sbin/env-from-file.sh
+cd "${PAPERLESS_SRC_DIR}"
 
-if [[ $(id -u) == 0 ]] ;
-then
-	gosu paperless python3 manage.py management_command "$@"
-elif [[ $(id -un) == "paperless" ]] ;
-then
+if [[ $(id -u) == 0 ]]; then
+	s6-setuidgid paperless python3 manage.py management_command "$@"
+elif [[ $(id -un) == "paperless" ]]; then
 	python3 manage.py management_command "$@"
 else
 	echo "Unknown user."

docker/paperless_cmd.sh

@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-
-rootless_args=()
-if [ "$(id -u)" == "$(id -u paperless)" ]; then
-	rootless_args=(
-		--user
-		paperless
-		--logfile
-		supervisord.log
-		--pidfile
-		supervisord.pid
-	)
-fi
-
-exec /usr/local/bin/supervisord -c /etc/supervisord.conf "${rootless_args[@]}"

docker/rootfs/etc/s6-overlay/s6-rc.d/init-complete/run

@@ -0,0 +1,8 @@
+#!/command/with-contenv /usr/bin/bash
+# shellcheck shell=bash
+declare -r log_prefix="[init-complete]"
+declare -r end_time=$(date +%s)
+declare -r start_time=${PAPERLESS_START_TIME_S}
+
+echo "${log_prefix} paperless-ngx docker container init completed in $(($end_time-$start_time)) seconds"
+echo "${log_prefix} Starting services"

docker/rootfs/etc/s6-overlay/s6-rc.d/init-complete/type

@@ -0,0 +1 @@
+oneshot

docker/rootfs/etc/s6-overlay/s6-rc.d/init-complete/up

@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/init-complete/run

docker/rootfs/etc/s6-overlay/s6-rc.d/init-custom-init/run

@@ -0,0 +1,44 @@
+#!/command/with-contenv /usr/bin/bash
+# shellcheck shell=bash
+
+declare -r log_prefix="[custom-init]"
+
+# Mostly borrowed from the LinuxServer.io base image
+# https://github.com/linuxserver/docker-baseimage-ubuntu/tree/bionic/root/etc/cont-init.d
+declare -r custom_script_dir="/custom-cont-init.d"
+
+# Tamper checking.
+# Don't run files which are owned by anyone except root
+# Don't run files which are writeable by others
+if [ -d "${custom_script_dir}" ]; then
+	if [ -n "$(/usr/bin/find "${custom_script_dir}" -maxdepth 1 ! -user root)" ]; then
+		echo "${log_prefix} **** Potential tampering with custom scripts detected ****"
+		echo "${log_prefix} **** The folder '${custom_script_dir}' must be owned by root ****"
+		exit 0
+	fi
+	if [ -n "$(/usr/bin/find "${custom_script_dir}" -maxdepth 1 -perm -o+w)" ]; then
+		echo "${log_prefix} **** The folder '${custom_script_dir}' or some of contents have write permissions for others, which is a security risk. ****"
+		echo "${log_prefix} **** Please review the permissions and their contents to make sure they are owned by root, and can only be modified by root. ****"
+		exit 0
+	fi
+
+	# Make sure custom init directory has files in it
+	if [ -n "$(/bin/ls --almost-all "${custom_script_dir}" 2>/dev/null)" ]; then
+		echo "${log_prefix} files found in ${custom_script_dir} executing"
+		# Loop over files in the directory
+		for SCRIPT in "${custom_script_dir}"/*; do
+			NAME="$(basename "${SCRIPT}")"
+			if [ -f "${SCRIPT}" ]; then
+				echo "${log_prefix} ${NAME}: executing..."
+				/command/with-contenv /bin/bash "${SCRIPT}"
+				echo "${log_prefix} ${NAME}: exited $?"
+			elif [ ! -f "${SCRIPT}" ]; then
+				echo "${log_prefix} ${NAME}: is not a file"
+			fi
+		done
+	else
+		echo "${log_prefix} no custom files found exiting..."
+	fi
+else
+	echo "${log_prefix} ${custom_script_dir} doesn't exist, nothing to do"
+fi

docker/rootfs/etc/s6-overlay/s6-rc.d/init-custom-init/type

@@ -0,0 +1 @@
+oneshot

docker/rootfs/etc/s6-overlay/s6-rc.d/init-custom-init/up

@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/init-custom-init/run

docker/rootfs/etc/s6-overlay/s6-rc.d/init-env-file/run

@@ -0,0 +1,33 @@
+#!/command/with-contenv /usr/bin/bash
+# shellcheck shell=bash
+
+declare -r log_prefix="[env-init]"
+
+echo "${log_prefix} Checking for environment from files"
+
+if find /run/s6/container_environment/*"_FILE" -maxdepth 1 > /dev/null 2>&1; then
+	for FILENAME in /run/s6/container_environment/*; do
+		if [[ "${FILENAME##*/}" == PAPERLESS_*_FILE ]]; then
+			# This should have been named different..
+			if [[ ${FILENAME} == "PAPERLESS_OCR_SKIP_ARCHIVE_FILE" || ${FILENAME} == "PAPERLESS_MODEL_FILE" ]]; then
+				continue
+			fi
+			SECRETFILE=$(cat "${FILENAME}")
+			# Check the file exists
+			if [[ -f ${SECRETFILE} ]]; then
+				# Trim off trailing _FILE
+				FILESTRIP=${FILENAME//_FILE/}
+				if [[ $(tail -n1 "${SECRETFILE}" | wc -l) != 0 ]]; then
+					echo "${log_prefix} Your secret: ${FILENAME##*/} contains a trailing newline and may not work as expected"
+				fi
+				# Set environment variable
+				cat "${SECRETFILE}" > "${FILESTRIP}"
+				echo "${log_prefix} ${FILESTRIP##*/} set from ${FILENAME##*/}"
+			else
+				echo "${log_prefix} cannot find secret in ${FILENAME##*/}"
+			fi
+		fi
+	done
+else
+		echo "${log_prefix} No *_FILE environment found"
+fi

docker/rootfs/etc/s6-overlay/s6-rc.d/init-env-file/type

@@ -0,0 +1 @@
+oneshot

docker/rootfs/etc/s6-overlay/s6-rc.d/init-env-file/up

@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/init-env-file/run

docker/rootfs/etc/s6-overlay/s6-rc.d/init-folders/run

@@ -0,0 +1,33 @@
+#!/command/with-contenv /usr/bin/bash
+# shellcheck shell=bash
+
+declare -r log_prefix="[init-folders]"
+
+declare -r export_dir="/usr/src/paperless/export"
+declare -r data_dir="${PAPERLESS_DATA_DIR:-/usr/src/paperless/data}"
+declare -r media_root_dir="${PAPERLESS_MEDIA_ROOT:-/usr/src/paperless/media}"
+declare -r consume_dir="${PAPERLESS_CONSUMPTION_DIR:-/usr/src/paperless/consume}"
+declare -r tmp_dir="${PAPERLESS_SCRATCH_DIR:=/tmp/paperless}"
+
+echo "${log_prefix} Checking for folder existence"
+
+for dir in \
+	"${export_dir}" \
+	"${data_dir}" "${data_dir}/index" \
+	"${media_root_dir}" "${media_root_dir}/documents" "${media_root_dir}/documents/originals" "${media_root_dir}/documents/thumbnails" \
+	"${consume_dir}" \
+	"${tmp_dir}"; do
+	if [[ ! -d "${dir}" ]]; then
+		mkdir --parents --verbose "${dir}"
+	fi
+done
+
+echo "${log_prefix} Adjusting file and folder permissions"
+for dir in \
+	"${export_dir}" \
+	"${data_dir}" \
+	"${media_root_dir}" \
+	"${consume_dir}" \
+	"${tmp_dir}"; do
+	find "${dir}" -not \( -user paperless -and -group paperless \) -exec chown --changes paperless:paperless {} +
+done

docker/rootfs/etc/s6-overlay/s6-rc.d/init-folders/type

@@ -0,0 +1 @@
+oneshot

docker/rootfs/etc/s6-overlay/s6-rc.d/init-folders/up

@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/init-folders/run

docker/rootfs/etc/s6-overlay/s6-rc.d/init-migrations/migrate.sh

@@ -0,0 +1,7 @@
+#!/command/with-contenv /usr/bin/bash
+# shellcheck shell=bash
+declare -r data_dir="${PAPERLESS_DATA_DIR:-/usr/src/paperless/data}"
+
+# shellcheck disable=SC2164
+cd "${PAPERLESS_SRC_DIR}"
+exec s6-setlock -n "${data_dir}/migration_lock" python3 manage.py migrate --skip-checks --no-input

docker/rootfs/etc/s6-overlay/s6-rc.d/init-migrations/run

@@ -0,0 +1,12 @@
+#!/command/with-contenv /usr/bin/bash
+# shellcheck shell=bash
+declare -r log_prefix="[init-migrations]"
+
+echo "${log_prefix} Apply database migrations..."
+
+# The whole migrate, with flock, needs to run as the right user
+if [[ -n "${USER_IS_NON_ROOT}" ]]; then
+	exec /etc/s6-overlay/s6-rc.d/init-migrations/migrate.sh
+else
+	exec s6-setuidgid paperless /etc/s6-overlay/s6-rc.d/init-migrations/migrate.sh
+fi

docker/rootfs/etc/s6-overlay/s6-rc.d/init-migrations/type

@@ -0,0 +1 @@
+oneshot

docker/rootfs/etc/s6-overlay/s6-rc.d/init-migrations/up

@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/init-migrations/run

docker/rootfs/etc/s6-overlay/s6-rc.d/init-modify-user/run

@@ -0,0 +1,22 @@
+#!/command/with-contenv /usr/bin/bash
+# shellcheck shell=bash
+declare -r log_prefix="[init-user]"
+
+declare -r usermap_original_uid=$(id -u paperless)
+declare -r usermap_original_gid=$(id -g paperless)
+declare -r usermap_new_uid=${USERMAP_UID:-$usermap_original_uid}
+declare -r usermap_new_gid=${USERMAP_GID:-${usermap_original_gid:-$usermap_new_uid}}
+
+if [[ ${usermap_new_uid} != "${usermap_original_uid}" ]]; then
+	echo "${log_prefix} Mapping UID for paperless to $usermap_new_uid"
+	usermod --non-unique --uid "${usermap_new_uid}" paperless
+else
+	echo "${log_prefix} No UID changes for paperless"
+fi
+
+if [[ ${usermap_new_gid} != "${usermap_original_gid}" ]]; then
+	echo "${log_prefix} Mapping GID for paperless to $usermap_new_gid"
+	groupmod --non-unique --gid "${usermap_new_gid}" paperless
+else
+	echo "${log_prefix} No GID changes for paperless"
+fi

docker/rootfs/etc/s6-overlay/s6-rc.d/init-modify-user/type

@@ -0,0 +1 @@
+oneshot

docker/rootfs/etc/s6-overlay/s6-rc.d/init-modify-user/up

@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/init-modify-user/run

docker/rootfs/etc/s6-overlay/s6-rc.d/init-search-index/run

@@ -0,0 +1,28 @@
+#!/command/with-contenv /usr/bin/bash
+# shellcheck shell=bash
+
+declare -r log_prefix="[init-index]"
+
+declare -r index_version=9
+declare -r data_dir="${PAPERLESS_DATA_DIR:-/usr/src/paperless/data}"
+declare -r index_version_file="${data_dir}/.index_version"
+
+update_index () {
+	echo "${log_prefix} Search index out of date. Updating..."
+	cd "${PAPERLESS_SRC_DIR}"
+	if [[ -n "${USER_IS_NON_ROOT}" ]]; then
+		python3 manage.py document_index reindex --no-progress-bar
+		echo ${index_version} | tee "${index_version_file}" > /dev/null
+	else
+		s6-setuidgid paperless python3 manage.py document_index reindex --no-progress-bar
+		echo ${index_version} | s6-setuidgid paperless tee "${index_version_file}" > /dev/null
+	fi
+}
+
+if [[ (! -f "${index_version_file}") ]]; then
+	echo "${log_prefix} No index version file found"
+	update_index
+elif [[ $(<"${index_version_file}") != "$index_version" ]]; then
+	echo "${log_prefix} index version updated"
+	update_index
+fi

docker/rootfs/etc/s6-overlay/s6-rc.d/init-search-index/type

@@ -0,0 +1 @@
+oneshot