From b81328d400c10569a7708e333275f6d22a86acf1 Mon Sep 17 00:00:00 2001
From: Marty Oehme <contact@martyoeh.me>
Date: Fri, 18 Jul 2025 16:56:08 +0200
Subject: [PATCH] paperless: Add restic backups

---
 roles/paperless/defaults/main.yaml             |  3 +++
 .../paperless/templates/docker-compose.yaml.j2 | 18 ++++++++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/roles/paperless/defaults/main.yaml b/roles/paperless/defaults/main.yaml
index 70860bc..0f933eb 100644
--- a/roles/paperless/defaults/main.yaml
+++ b/roles/paperless/defaults/main.yaml
@@ -7,6 +7,9 @@ stack_paperless_tz: "{{ timezone | default('America/Chicago') }}"
 stack_paperless_puid: "{{ puid | default(1000) }}"
 stack_paperless_pgid: "{{ pgid | default(100) }}"
 
+stack_paperless_restic_enable: true
+stack_paperless_restic_cron: 0 0 2 * * *
+
 stack_paperless_env_dir: /opt/stack_paperless
 stack_paperless_serve_dir: /srv
 stack_paperless_serve_dir_create: true
diff --git a/roles/paperless/templates/docker-compose.yaml.j2 b/roles/paperless/templates/docker-compose.yaml.j2
index e2d739f..a7bf1d0 100644
--- a/roles/paperless/templates/docker-compose.yaml.j2
+++ b/roles/paperless/templates/docker-compose.yaml.j2
@@ -65,6 +65,24 @@ services:
     environment:
       REDIS_ARGS: "--save 60 10"
 
+{% if restic_enable is not undefined and not false and stack_paperless_restic_enable is not undefined and not false %}
+  backup:
+    image: mazzolino/restic
+    environment:
+      TZ: "{{ restic_tz }}"
+      BACKUP_CRON: "{{ stack_paperless_restic_cron }}"
+      RESTIC_REPOSITORY: "{{ restic_repo }}"
+      RESTIC_PASSWORD: "{{ restic_pass }}"
+      AWS_ACCESS_KEY_ID: "{{ restic_s3_key }}"
+      AWS_SECRET_ACCESS_KEY: "{{ restic_s3_secret }}"
+      RESTIC_BACKUP_ARGS: >-
+        --tag paperless
+      RESTIC_BACKUP_SOURCES: "/backup"
+    volumes:
+      - "{{ stack_paperless_env_dir }}:/backup/{{ stack_paperless_env_dir }}"
+      - "{{ stack_paperless_serve_dir }}/documents:/backup/{{ stack_paperless_serve_dir }}/documents"
+{% endif %}
+
 networks:
   caddy:
     external: true