From 1bc2a274ae0550cc38448c3327457e3b2992cb39 Mon Sep 17 00:00:00 2001
From: Christoph Schmatzler <christoph@schmatzler.com>
Date: Sat, 20 Dec 2025 23:19:57 +0100
Subject: [PATCH] fix csrf

---
 hosts/tahani/paperless.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hosts/tahani/paperless.nix b/hosts/tahani/paperless.nix
index b0f3a6f..c8ec428 100644
--- a/hosts/tahani/paperless.nix
+++ b/hosts/tahani/paperless.nix
@@ -3,6 +3,9 @@
 		enable = true;
 		virtualHosts."docs.manticore-hippocampus.ts.net" = {
 			extraConfig = ''
+				tls {
+					get_certificate tailscale
+				}
 				reverse_proxy localhost:${toString config.services.paperless.port}
 			'';
 		};
@@ -30,6 +33,7 @@
 				"desktop.ini"
 			];
 			PAPERLESS_OCR_LANGUAGE = "deu+eng";
+			PAPERLESS_CSRF_TRUSTED_ORIGINS = "https://docs.manticore-hippocampus.ts.net";
 		};
 	};
 }