feat(k8s/paperless): enable native AI with Claude Haiku 5.5 and local embeddings

kubernetes/app/paperless/deployment.yaml

@@ -86,6 +86,31 @@ spec:
               value: allauth.socialaccount.providers.openid_connect
             - name: PAPERLESS_SOCIALACCOUNT_ALLOW_SIGNUPS
               value: "false"
+            - name: PAPERLESS_AI_ENABLED
+              value: "true"
+            - name: PAPERLESS_AI_LLM_BACKEND
+              value: openai-like
+            - name: PAPERLESS_AI_LLM_ENDPOINT
+              value: https://api.anthropic.com/v1/
+            - name: PAPERLESS_AI_LLM_MODEL
+              value: claude-haiku-5-5
+            - name: PAPERLESS_AI_LLM_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: paperless-ai
+                  key: anthropic-api-key
+            # Haiku 5.5 only accepts temperature 1; llama-index defaults to 0.1
+            - name: PAPERLESS_AI_LLM_EXTRA_PARAMS
+              value: '{"temperature": 1}'
+            - name: PAPERLESS_AI_LLM_OUTPUT_LANGUAGE
+              value: Ukrainian
+            - name: PAPERLESS_AI_LLM_EMBEDDING_BACKEND
+              value: huggingface
+            - name: PAPERLESS_AI_LLM_EMBEDDING_MODEL
+              value: intfloat/multilingual-e5-small
+            # matches the embedding model's 512-token input limit
+            - name: PAPERLESS_AI_LLM_EMBEDDING_CHUNK_SIZE
+              value: "512"
           volumeMounts:
             - name: data
               mountPath: /usr/src/paperless/data
@@ -110,9 +135,9 @@ spec:
           resources:
             requests:
               cpu: 100m
-              memory: 512Mi
+              memory: 1536Mi
             limits:
-              memory: 5Gi
+              memory: 6Gi
       volumes:
         - name: data
           persistentVolumeClaim:

kubernetes/app/paperless/secret-ai.sops.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: paperless-ai
+    namespace: paperless
+stringData:
+    anthropic-api-key: ENC[AES256_GCM,data:kTSTHIO771Zl8/kEyv1seKF1GyodZ4lxhjUSjsyIyCneC+aFdqrq/QYFnqtlQnjBOMq94LQxy0T4Ox2an2+0v2ywP+lIZzYDkE22JdXgbJgCW2aJTBqPtEFV7M2EP0LexDeD2aqebwicxA==,iv:IeO0+Y3jAL0iYM3UbpTtFU7TgqogUYt2gipYUJO2ABQ=,tag:qffHT+GkrNWFmJ1EffHEWg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4Nzg2Zmc4ZVNvRzhzQmVp
+            Mlp6MXhRUExmOU1yWHRESmhBQWlsczZCZEQ0CmkvZDEzVTFwWmt6N3E5eXlsQ0d5
+            VDU1YWIvRDdocXFQNlhnK29CNDVtME0KLS0tIEMybTgzaGs4cVEyeTdEL1RPUmR3
+            S2VvK2FMZ0JnQWJUZG41MmIrRjkxVHcKzjclDColGY9ciQZPRodQrH8UkmsHTsTC
+            hExT/sbhwIznhryfzw/Wkgrm8bzH4NxEkjOWRXvEEJ7Fp5gkvfo0tQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+    encrypted_regex: ^(data|stringData|email)$
+    lastmodified: "2026-10-10T18:39:57Z"
+    mac: ENC[AES256_GCM,data:SG3jk09+cI2mYvovl8PvT5Ay8QrD/wWYVJAdJWhE83bI+MgwgoXvkdW9B+3epcIfvNWV4Z83w2vS89+bo5k81CEIu66yAQPDA+wSCReiRalZdHYGidmnW5ZccmfjTGTNRIIY8RbJlB2ZW6EJJnjjT8Bp4wZskIk5EhGhU2+5jg8=,iv:XeyO9yKzZv6qHwe3LfBqqeRJ3gnU1AmGmeVv3Zp/UyY=,tag:xCgbaWR4fd738hF2T/QVAw==,type:str]
+    version: 3.13.3