diff --git a/boxes/copernicus/services/default.nix b/boxes/copernicus/services/default.nix
index 0be66ee..120a739 100644
--- a/boxes/copernicus/services/default.nix
+++ b/boxes/copernicus/services/default.nix
@@ -5,5 +5,6 @@
     ./wireguard.nix
     ./grafana.nix
     ./nextcloud.nix
+    ./paperless.nix
   ];
 }
diff --git a/boxes/copernicus/services/paperless.nix b/boxes/copernicus/services/paperless.nix
new file mode 100644
index 0000000..17d081e
--- /dev/null
+++ b/boxes/copernicus/services/paperless.nix
@@ -0,0 +1,10 @@
+{ lib, config, pkgs, ...}:
+
+{
+  services.paperless = {
+    enable = true;
+    passwordFile = "/home/usr/wg-keys/paperless";
+    address = "10.100.0.2";
+    port = 6230;
+  };
+}
diff --git a/boxes/netbox/default.nix b/boxes/netbox/default.nix
index 71cf240..31e6602 100644
--- a/boxes/netbox/default.nix
+++ b/boxes/netbox/default.nix
@@ -19,6 +19,7 @@
       ./wireguard.nix
       ./nextcloud-bridge.nix
       ./grafana-bridge.nix
+      ./paperless-bridge.nix
       ./prometheus.nix
       ./socks.nix
     ];
diff --git a/boxes/netbox/paperless-bridge.nix b/boxes/netbox/paperless-bridge.nix
new file mode 100644
index 0000000..fda0c4c
--- /dev/null
+++ b/boxes/netbox/paperless-bridge.nix
@@ -0,0 +1,15 @@
+{ lib, config, pkgs, ... }:
+{
+  services.nginx.virtualHosts."paperless.beepboop.systems" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://10.100.0.2:6230";
+      extraConfig = ''
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Host $host;
+        proxy_buffering off;
+      '';
+    };
+  };
+}