nixserve: open Music Assistant/mDNS ports, add paperless service, bump flake inputs

Allow TCP 8095 (Music Assistant web UI) and UDP 5353 (mDNS) through the
firewall so the LAN interface can reach it and Chromecast discovery works;
previously only the trusted tailscale0 interface had access.

flake.lock

@@ -8,11 +8,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1790642832,
-        "narHash": "sha256-dhAifTJeh8sfK0s/KzUZIo1qHlv+AFit3HOyCT+QC5E=",
+        "lastModified": 1791759048,
+        "narHash": "sha256-/KMQbdh5X6Sa1GTUqyKf3vHdHDgpuRfJr9iHommwiH8=",
         "owner": "ogulcancelik",
         "repo": "herdr",
-        "rev": "9dc3a1df2b563df0637264fc0dffcd607c324ac5",
+        "rev": "dc6b6e5f42831ea7114f34dcf12900680eb36ae0",
         "type": "github"
       },
       "original": {
@@ -28,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790215976,
-        "narHash": "sha256-VkR1rMGyjU9jtw8ISFx5uqR9e+LEaOlhHwrseFkiIVk=",
+        "lastModified": 1790996401,
+        "narHash": "sha256-f+kOxEmOUnQazVAmGg0i8hzwgd1kX/geY+k/Dpheye8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a6631107a83ceab5872f298a2ea710859c80c4cb",
+        "rev": "db7d5e2332710f5abb088f6b5de927d7f9511b35",
         "type": "github"
       },
       "original": {
@@ -44,11 +44,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1790533781,
-        "narHash": "sha256-hzJtu90JIQXnmgxKeP23CAx86G4L+dcQ+GHB1JK04qA=",
-        "rev": "cf5e76507c6e23b59f7e0ffcc7baa2a39ddd8442",
+        "lastModified": 1791662279,
+        "narHash": "sha256-tM6MAMxVwetta6uD2aMzoWQ9v5EAaLLmYumiE4jVZeg=",
+        "rev": "6fcc160353f63555b560f25588925133c8f61f2a",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.10769.cf5e76507c6e/nixexprs.tar.zst"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.11680.6fcc160353f6/nixexprs.tar.zst"
       },
       "original": {
         "id": "nixpkgs",

hosts/nixserve/default.nix

@@ -47,8 +47,8 @@
   users.groups.media = {};
   users.users.jellyfin.extraGroups = [ "media" ];
 
-  networking.firewall.allowedTCPPorts = [ 80 443 /* HTTP */ 111 2049 4000 4001 4002 20048 /* NFS */ 3923 /* copyparty */ 8123 /* Home Assistant (LAN devices, e.g. Cast TTS fetch) */ ];
-  networking.firewall.allowedUDPPorts = [ 111 2049 4000 4001 4002 20048 /* NFS */ ];
+  networking.firewall.allowedTCPPorts = [ 80 443 /* HTTP */ 111 2049 4000 4001 4002 20048 /* NFS */ 3923 /* copyparty */ 8123 /* Home Assistant (LAN devices, e.g. Cast TTS fetch) */ 8095 /* Music Assistant */ ];
+  networking.firewall.allowedUDPPorts = [ 111 2049 4000 4001 4002 20048 /* NFS */ 5353 /* mDNS - Chromecast discovery */ ];
   networking.firewall.trustedInterfaces = [ "tailscale0" ];
 
   programs.zsh.enable = true;

hosts/nixserve/services.nix

@@ -52,6 +52,17 @@ in
 
   services.jellyfin.enable = true;
 
+  services.paperless = {
+    enable = true;
+    dataDir = "/media/apps/paperless";
+    address = "127.0.0.1";
+    port = 28981;
+    domain = "paperless.maybec.at";
+    settings = {
+      PAPERLESS_OCR_LANGUAGE = "eng+swe";
+    };
+  };
+
   services.tailscale = {
     enable = true;
     openFirewall = true;
@@ -313,5 +324,6 @@ virtualHosts."aftersummer.maybec.at"  = proxyVhost { upstream = "http://127.0.0.
     virtualHosts."share.maybec.at"       = proxyVhost { upstream = "http://127.0.0.1:8090"; maxBodySize = "10g"; };
     virtualHosts."cam.maybec.at"         = proxyVhost { upstream = "https://127.0.0.1:8971"; proxySsl = true; };
     virtualHosts."home.maybec.at"        = proxyVhost { upstream = "http://127.0.0.1:8123"; };
+    virtualHosts."paperless.maybec.at"   = proxyVhost { upstream = "http://127.0.0.1:28981"; };
   };
 }