{
  self,
  config,
  ...
}:
let
  d = self.lib.data.services.paperless;
  sec = config.age.secrets;
  inherit (self.lib.secrets) mkServiceSecrets;
in
{
  services.paperless = {
    enable = true;
    inherit (d) port;
    address = "0.0.0.0";
    domain = d.extUrl;
    database.createLocally = true;
    configureTika = true;
    settings = {
      PAPERLESS_EMAIL_TASK_CRON = "0 */4 * * *";
      PAPERLESS_TIME_ZONE = "America/New_York";
      PAPERLESS_EMAIL_HOST = "smtp.purelymail.com";
      PAPERLESS_EMAIL_PORT = 465;
      PAPERLESS_EMAIL_HOST_USER = "paperless@pyrox.dev";
      PAPERLESS_EMAIL_FROM = "dish Docs<paperless@pyrox.dev>";
      PAPERLESS_EMAIL_USE_SSL = true;
      PAPERLESS_APP_TITLE = "dish Docs";
      PAPERLESS_TASK_WORKERS = 3;
    };
    environmentFile = sec.paperless-secrets.path;
  };

  age.secrets = mkServiceSecrets "paperless" ./secrets [
    "admin-password"
    "secrets"
  ];
}