diff --git a/sys/srv/default.nix b/sys/srv/default.nix
index 4b02f44..ab547c1 100644
--- a/sys/srv/default.nix
+++ b/sys/srv/default.nix
@@ -18,5 +18,6 @@ with lib; {
     ./msmtp.nix
     ./kuma.nix
     ./authentik.nix
+    ./paperless.nix
   ];
 }
diff --git a/sys/srv/paperless.nix b/sys/srv/paperless.nix
new file mode 100644
index 0000000..8a2a137
--- /dev/null
+++ b/sys/srv/paperless.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+with lib; {
+  services = {
+    nginx = {
+      virtualHosts."docs.posixlycorrect.com" = {
+        enableACME = true;
+        forceSSL = true;
+        extraConfig = ''
+          proxy_headers_hash_max_size 512;
+          proxy_headers_hash_bucket_size 128;
+        '';
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:28981";
+        };
+      };
+    };
+
+    paperless = {
+      enable = true;
+      user = "paperless";
+      passwordFile = "/var/trust/paperless/passwordFile";
+      openMPThreadingWorkaround = true; # see https://github.com/NixOS/nixpkgs/issues/240591
+      address = "127.0.0.1";
+      port = 28981;
+      settings = {
+        PAPERLESS_URL = "docs.posixlycorrect.com";
+        PAPERLESS_OCR_LANGUAGE = "eng+spa";
+        PAPERLESS_APP_TITLE = "posixlycorrect";
+      };
+    };
+  };
+}