diff --git a/paperless-ngx/paperless-stack.yaml b/paperless-ngx/paperless-stack.yaml
new file mode 100644
index 0000000..6ed1f8d
--- /dev/null
+++ b/paperless-ngx/paperless-stack.yaml
@@ -0,0 +1,175 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: paperless
+---
+# 1. THE AUTOMATED CNPG POSTGRES CLUSTER
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: paperless-db
+  namespace: paperless
+spec:
+  instances: 1 # True 3-node HA across your mini-PCs! - edit down to 1, 3 overkill
+  imageName: ghcr.io/cloudnative-pg/postgresql:16.4
+  storage:
+    size: 15Gi
+    storageClass: longhorn
+  bootstrap:
+    initdb:
+      database: paperless_prod
+      owner: paperless_admin
+  #affinity:
+  #  enablePodAntiAffinity: true
+  #  topologyKey: "kubernetes.io/hostname"
+---
+# 2. THE SIMPLE INDEPENDENT VALKEY CACHE
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: paperless-valkey
+  namespace: paperless
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: paperless-valkey
+  template:
+    metadata:
+      labels:
+        app: paperless-valkey
+    spec:
+      containers:
+        - name: valkey
+          image: valkey/valkey:8.0-alpine
+          args: ["--maxmemory", "256mb", "--maxmemory-policy", "allkeys-lru"]
+          ports:
+            - containerPort: 6379
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: paperless-valkey-svc
+  namespace: paperless
+spec:
+  ports:
+    - port: 6379
+  selector:
+    app: paperless-valkey
+---
+# 3. THE PAPERLESS APPLICATION STORAGE
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: paperless-data-pvc
+  namespace: paperless
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 30Gi
+---
+# 4. THE PAPERLESS APPLICATION CORE
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: paperless-ngx
+  namespace: paperless
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: paperless-ngx
+  template:
+    metadata:
+      labels:
+        app: paperless-ngx
+    spec:
+      containers:
+        - name: paperless
+          image: ghcr.io/paperless-ngx/paperless-ngx:2.14
+          ports:
+            - containerPort: 8000
+          env:
+            - name: PAPERLESS_REDIS
+              value: "redis://paperless-valkey-svc:6379"
+            - name: PAPERLESS_DBENGINE
+              value: "postgresql"
+            - name: PAPERLESS_DBHOST
+              value: "paperless-db-rw" # Automatically routes to the active HA primary pod
+            - name: PAPERLESS_DBPORT
+              value: "5432"
+            - name: PAPERLESS_DBNAME
+              value: "paperless_prod"
+            - name: PAPERLESS_DBUSER
+              value: "paperless_admin"
+            - name: PAPERLESS_DBPASS
+              valueFrom:
+                secretKeyRef:
+                  name: paperless-db-app # Automatically created by CNPG using cluster name
+                  key: password
+            # 👇 FIXES START HERE 👇
+            - name: PAPERLESS_URL
+              value: "https://paper.needlestack.boo" # Must match your sub-domain exactly (no trailing slash)
+            - name: PAPERLESS_ALLOWED_HOSTS
+              value: "paper.needlestack.boo" # Add this to let Django trust the incoming Host header
+            - name: PAPERLESS_CSRF_TRUSTED_ORIGINS
+              value: "https://paper.needlestack.boo" # Must match the full HTTPS URL
+            # 👇 INJECT THIS RAW DJANGO OVERRIDE 👇
+            - name: DJANGO_CSRF_TRUSTED_ORIGINS
+              value: "https://paper.needlestack.boo"
+            # 👇 ADD THESE TWO ENTRIES 👇
+            - name: PAPERLESS_TRUSTED_PROXIES
+              value: "10.42.0.0/16,10.43.0.0/16" # Trusts the internal k3s pod/service CIDR blocks
+            - name: PAPERLESS_TIME_ZONE
+              value: "Europe/London"
+          volumeMounts:
+            - name: paperless-storage
+              mountPath: /usr/src/paperless/data
+      volumes:
+        - name: paperless-storage
+          persistentVolumeClaim:
+            claimName: paperless-data-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: paperless-svc
+  namespace: paperless
+spec:
+  ports:
+    - port: 8000
+  selector:
+    app: paperless-ngx
+---
+# 5. THE INGRESS NETWORK ROUTING
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: paperless-ingress
+  namespace: paperless
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-production"
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    # 👇 ADD THESE THREE FOR CSRF / PROXY ALIGNMENT 👇
+    nginx.ingress.kubernetes.io/proxy-body-size: "50m" # Essential later for uploading large PDFs!
+    nginx.ingress.kubernetes.io/ssl-redirect: "true" # 👈 This handles forcing HTTPS routing safely
+spec:
+  ingressClassName: nginx
+  tls:
+    - secretName: paperless-tls-secret
+      hosts:
+        - paper.needlestack.boo
+  rules:
+  - host: paper.needlestack.boo
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: paperless-svc
+            port:
+              number: 8000