Add open-webui and paperless.

hosts/hub/apps/open-webui.nix

@@ -0,0 +1,22 @@
+{ config, ... }:
+
+{
+  systemd.tmpfiles.rules = [
+    "d /var/lib/open-webui 0755 root root"
+  ];
+
+  virtualisation.oci-containers.containers.open-webui = {
+    image = "ghcr.io/open-webui/open-webui:main";
+    ports = [
+      "8090:8080"
+    ];
+    volumes = [ "/var/lib/open-webui:/app/backend/data" ];
+  };
+
+  services.caddy.virtualHosts."https://open-webui.tailc50184.ts.net".extraConfig = ''
+    bind tailscale/open-webui
+    reverse_proxy http://localhost:8090
+  '';
+
+  networking.firewall.trustedInterfaces = [ "podman0" ];
+}