From e9022e0d4abcb39c9b077a12b1813011d09bf520 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Thu, 25 Jun 2026 12:44:41 +0200 Subject: [PATCH] paperless: move ftp-scanner vsftpd config to hash-suffixed generator Moves the static ftp-scanner-config ConfigMap out of ftp-scanner.yaml into a configMapGenerator in kustomization.yaml. Values are unchanged (PASV_ADDRESS=10.2.99.82, ports 21100-21104, scanner, uid/gid 1000). The content-hash name suffix is kept on purpose: vsftpd templates pasv_address from PASV_ADDRESS at container start, so a changed value must roll the pod. With the hash suffix, editing any value renames the generated ConfigMap, mutates the Deployment pod template, and triggers an automatic rolling restart. Without it, an IP change (e.g. an LB re-allocation) would silently leave the pod advertising a stale PASV address, breaking classic-PASV clients (older Brother scanners) while EPSV clients keep working. The Deployment consumes the CM via envFrom.configMapRef, so kustomize's nameReference transformer rewrites the reference to the hashed name -- verified with `kubectl kustomize` (ftp-scanner-config-6d2597bt4d). Co-Authored-By: Claude Opus 4.8 (1M context) --- kubernetes/apps/paperless/ftp-scanner.yaml | 17 -------------- kubernetes/apps/paperless/kustomization.yaml | 24 ++++++++++++++++++++ 2 files changed, 24 insertions(+), 17 deletions(-) diff --git a/kubernetes/apps/paperless/ftp-scanner.yaml b/kubernetes/apps/paperless/ftp-scanner.yaml index 39369f3a..65330e35 100644 --- a/kubernetes/apps/paperless/ftp-scanner.yaml +++ b/kubernetes/apps/paperless/ftp-scanner.yaml @@ -1,20 +1,3 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: ftp-scanner-config - namespace: paperless -data: - PASV_ADDRESS: "10.2.99.82" - PASV_MIN_PORT: "21100" - PASV_MAX_PORT: "21104" - FTP_USER: "scanner" - # Run vsftpd's chrooted user as paperless's uid/gid. Uploaded files - # then come in already owned paperless:paperless, so paperless's - # init-folders s6 service (which chowns the consume-dir to paperless: - # paperless on every start) is a no-op and no ACL workaround is needed. - UID: "1000" - GID: "1000" ---- apiVersion: apps/v1 kind: Deployment metadata: diff --git a/kubernetes/apps/paperless/kustomization.yaml b/kubernetes/apps/paperless/kustomization.yaml index 42db491c..261dcee7 100644 --- a/kubernetes/apps/paperless/kustomization.yaml +++ b/kubernetes/apps/paperless/kustomization.yaml @@ -12,3 +12,27 @@ resources: - ftp-scanner.yaml - syncthing.yaml - network-policy.yaml +configMapGenerator: + # vsftpd config for the ftp-scanner deployment. The content-hash name + # suffix is intentionally LEFT ENABLED (unlike home-assistant's nginx + # config): vsftpd templates pasv_address from PASV_ADDRESS at container + # start, so a changed value must roll the pod. With the hash suffix, + # editing any value here renames the generated ConfigMap, which mutates + # the Deployment's pod template and triggers an automatic rolling + # restart. Without it, an IP change (e.g. an LB re-allocation) silently + # leaves the running pod advertising the stale PASV address, which + # breaks classic-PASV clients (older Brother scanners) while EPSV + # clients keep working. + - name: ftp-scanner-config + namespace: paperless + literals: + - PASV_ADDRESS=10.2.99.82 + - PASV_MIN_PORT=21100 + - PASV_MAX_PORT=21104 + - FTP_USER=scanner + # Run vsftpd's chrooted user as paperless's uid/gid. Uploaded files + # then come in already owned paperless:paperless, so paperless's + # init-folders s6 service (which chowns the consume-dir to paperless: + # paperless on every start) is a no-op and no ACL workaround is needed. + - UID=1000 + - GID=1000 -- 2.54.0