refactor(paperless)!: switch to app-template

Explicitly define PAPERLESS_PORT due to environment variable conflict.

https://docs.paperless-ngx.com/troubleshooting/#gunicorn-fails-to-start-with-is-not-a-valid-port-number

apps/paperless/Chart.yaml

@@ -2,6 +2,6 @@ apiVersion: v2
 name: paperless
 version: 0.0.0
 dependencies:
-  - name: paperless
-    version: 8.5.0
-    repository: https://k8s-at-home.com/charts/
+  - name: app-template
+    version: 2.5.0
+    repository: https://bjw-s.github.io/helm-charts

apps/paperless/templates/secret.yaml

@@ -0,0 +1,12 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: {{ .Release.Name }}-secret
+  namespace: {{ .Release.Namespace }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: global-secrets
+  dataFrom:
+    - extract:
+        key: paperless.admin

apps/paperless/values.yaml

@@ -1,18 +1,55 @@
-paperless:
+app-template:
+  controllers:
+    main:
+      containers:
+        main:
+          image:
+            repository: ghcr.io/paperless-ngx/paperless-ngx
+            tag: 2.3.3
+          env:
+            PAPERLESS_PORT: 8000
+            PAPERLESS_ADMIN_USER: admin
+            PAPERLESS_URL: https://paperless.khuedoan.com
+          envFrom:
+            - secret: "{{ .Release.Name }}-secret"
+        redis:
+          image:
+            repository: docker.io/library/redis
+            tag: 7.2.4
+  service:
+    main:
+      ports:
+        http:
+          port: 8000
+          protocol: HTTP
   ingress:
     main:
       enabled: true
-      ingressClassName: nginx
+      className: nginx
       annotations:
         cert-manager.io/cluster-issuer: letsencrypt-prod
+        external-dns.alpha.kubernetes.io/target: homelab-tunnel.khuedoan.com
+        external-dns.alpha.kubernetes.io/cloudflare-proxied: 'true'
       hosts:
         - host: &host paperless.khuedoan.com
           paths:
             - path: /
               pathType: Prefix
+              service:
+                name: main
+                port: http
       tls:
-        - secretName: paperless-tls-certificate
-          hosts:
+        - hosts:
             - *host
-  postgresql:
-    enabled: true
+          secretName: paperless-tls-certificate
+  persistence:
+    data:
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      advancedMounts:
+        main:
+          main:
+            - path: /usr/src/paperless/data
+              subPath: data
+            - path: /usr/src/paperless/media
+              subPath: media

platform/global-secrets/files/secret-generator/config.yaml

@@ -30,3 +30,10 @@
     - key: secret
       length: 32
       special: false
+
+# Paperless
+- name: paperless.admin
+  data:
+    - key: PAPERLESS_ADMIN_PASSWORD
+      length: 32
+      special: true