k.renner
fea3062728
Replaces the legacy paperless-syncthing-1 docker container on VM 111 that the 2026-05-09 cutover stopped. Phones (Pixel 10 Pro) and laptop (XPS 13-9310) sync into a syncthing/ subdirectory on the existing paperless-consume PVC; paperless's recursive consumer picks files up. - StatefulSet runAsUser 1000 — matches paperless's uid, no ACL or chown gymnastics required (the FTP scanner path already proved the consume PVC works with mixed writers when uid lines up). - Sync ports exposed via LoadBalancer at 10.2.40.85 with UniFi-only DNS (syncthing.paperless.renner.uno); cloudflare label deliberately omitted (sync is TCP+UDP, not HTTPS). - UI (8384) is ClusterIP-only on first deploy. Set the admin password via kubectl port-forward before publishing it; no Ingress yet. - allow-syncthing-sync CNP opens 22000 TCP+UDP and 21027 UDP from world/host/remote-node; the namespace default-deny otherwise blocks external ingress. When adding the paperless-consume folder in the Syncthing UI, set folder type to 'Receive Only' on the cluster side — paperless's consume-then-delete would otherwise propagate deletions back to the phones.