diff --git a/deskutils/py-paperless-ngx/Makefile b/deskutils/py-paperless-ngx/Makefile
index 59679a6776c3..cc2eff7e80ee 100644
--- a/deskutils/py-paperless-ngx/Makefile
+++ b/deskutils/py-paperless-ngx/Makefile
@@ -1,177 +1,175 @@
 PORTNAME=	paperless-ngx
 PORTVERSION=	2.7.2
 DISTVERSIONPREFIX=	v
-PORTREVISION=	3
+PORTREVISION=	4
 CATEGORIES=	deskutils python
 MASTER_SITES=	https://github.com/${PORTNAME}/${PORTNAME}/releases/download/${DISTVERSIONPREFIX}${DISTVERSION}/:webui \
 		GH:gh
 PKGNAMEPREFIX=	${PYTHON_PKGNAMEPREFIX}
 DISTFILES=	${PORTNAME}-${DISTVERSIONPREFIX}${DISTVERSION}${EXTRACT_SUFX}:webui
 
 MAINTAINER=	grembo@FreeBSD.org
 COMMENT=	Community-supported supercharged version of paperless
 WWW=		https://docs.paperless-ngx.com
 
 LICENSE=	GPLv3
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 BUILD_DEPENDS=	${PYTHON_PKGNAMEPREFIX}bleach>=6.1.0:www/py-bleach@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}concurrent-log-handler>=0.9.19:sysutils/py-concurrent-log-handler@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}dateparser>=1.1.4:devel/py-dateparser@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}channels-redis>=4.2.0:www/py-channels-redis@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}django-allauth>=0.59.0:www/py-django-allauth@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}django-auditlog>=2.3.0:www/py-django-auditlog@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}django-celery-results>=2.5.1:www/py-django-celery-results@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}django-compression-middleware>=0.5.0:www/py-django-compression-middleware@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}django-cors-headers>=4.3.1:www/py-django-cors-headers@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}django-extensions>=3.2.3:www/py-django-extensions@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}django-filter>=23.5:www/py-django-filter@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}django-multiselectfield>=0.1.12:www/py-django-multiselectfield@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}djangorestframework-guardian>=0.3.0:www/py-djangorestframework-guardian@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}drf-writable-nested>=0.7.0:www/py-drf-writable-nested@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}filelock>=3.13.1:sysutils/py-filelock@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}flower>=2.0.1:www/py-flower@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}gotenberg-client>=0.5.0:converters/py-gotenberg-client@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}gunicorn>=21.2.0:www/py-gunicorn@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}h2>=4.1.0:www/py-h2@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}hiredis>=2.0.0:databases/py-hiredis@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}httptools>=0.6.1:www/py-httptools@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}imap-tools>=1.5.0:mail/py-imap-tools@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}inotifyrecursive>=0.3.5_1:devel/py-inotifyrecursive@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}langdetect>=1.0.9:textproc/py-langdetect@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}mysqlclient>=2.2.1:databases/py-mysqlclient@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}nltk>=3.8.1:textproc/py-nltk@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}ocrmypdf>=15.4.4:textproc/py-ocrmypdf@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}pathvalidate>=3.2.0:devel/py-pathvalidate@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}pdf2image>=1.17.0:graphics/py-pdf2image@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}pdftotext>=2.2.2:textproc/py-pdftotext@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}psycopg2>=2.9.9:databases/py-psycopg2@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}python-dotenv>=1.0.0:www/py-python-dotenv@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}python-gnupg>=0.5.1:security/py-python-gnupg@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}python-ipware>=2.0.1:net/py-python-ipware@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}python-magic>=0.4.27:devel/py-python-magic@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}pyzbar>=0.1.9:graphics/py-pyzbar@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}rapidfuzz>=3.6.1:devel/py-rapidfuzz@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}scikit-learn>=1.4.0:science/py-scikit-learn@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}setproctitle>=1.3.2:devel/py-setproctitle@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}sqlite3>0:databases/py-sqlite3@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}tika-client>=0.5.0:textproc/py-tika-client@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}uvicorn>=0.25.0:www/py-uvicorn@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}uvloop>=0.17.0:devel/py-uvloop@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}watchdog>=4.0.0:devel/py-watchdog@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}watchfiles>=0.21.0:devel/py-watchfiles@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}websockets>=12.0:devel/py-websockets@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}whitenoise>=6.2.0:www/py-whitenoise@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}whoosh>=2.7.4:textproc/py-whoosh@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}yaml>=6.0.1:devel/py-yaml@${PY_FLAVOR}
 RUN_DEPENDS:=	${BUILD_DEPENDS}
 RUN_DEPENDS+=	gpg2:security/gnupg \
 		liberation-fonts-ttf>=2.1.3:x11-fonts/liberation-fonts-ttf \
 		optipng:graphics/optipng \
 		tesseract:graphics/tesseract \
 		unpaper:graphics/unpaper
 
 USES=		python shebangfix tar:xz
 USE_GITHUB=	yes
 GH_ACCOUNT=	paperless-ngx
 USE_RC_SUBR=	paperless-beat paperless-consumer paperless-flower \
 		paperless-migrate paperless-webui paperless-worker
 
 SHEBANG_FILES=	${WRKSRC}/src/manage.py
 
 CONFLICTS_INSTALL=	${PYTHON_PKGNAMEPREFIX}*paperless
 
 NO_ARCH=	yes
 
-SUB_FILES=	nginx.conf paperless-ngx.7 pkg-message README sshd_config
+SUB_FILES=	nginx.conf paperless paperless-ngx.7 pkg-message README sshd_config
 SUB_LIST=	CHOWN=${CHOWN} \
 		ECHO=${ECHO} \
 		EGREP=${EGREP} \
 		PKGBASE=${PKGBASE} \
 		PYTHON_CMD=${PYTHON_CMD} \
 		PYTHONPREFIX_SITELIBDIR=${PYTHONPREFIX_SITELIBDIR} \
 		RM=${RM:Q} \
 		TOUCH=${TOUCH}
 
 USERS=		paperless
 GROUPS=		paperless
 
 PORTDOCS=	*
 
 OPTIONS_DEFINE=		DOCS EXAMPLES
 OPTIONS_DEFAULT=	IMAGICK7_X11
 OPTIONS_SINGLE=		IMAGICK
 OPTIONS_SINGLE_IMAGICK=	IMAGICK6_NOX11 IMAGICK6_X11 IMAGICK7_NOX11 IMAGICK7_X11
 
 IMAGICK6_NOX11_DESC=	ImageMagick6 without X11 support
 IMAGICK6_X11_DESC=	ImageMagick6 with X11 support
 IMAGICK7_NOX11_DESC=	ImageMagick7 without X11 support
 IMAGICK7_X11_DESC=	ImageMagick7 with X11 support
 IMAGICK_DESC=		${IMAGEMAGICK_DESC}
 
 IMAGICK6_NOX11_USES=	magick:6,run,nox11
 IMAGICK6_X11_USES=	magick:6,run
 IMAGICK7_NOX11_USES=	magick:7,run,nox11
 IMAGICK7_X11_USES=	magick:7,run
 
 PAPERLESS_STATICDIR=	${WRKSRC}/static
 
 post-patch:
 	@${REINPLACE_CMD} -e 's|/usr/local|${LOCALBASE}|g' \
 		${WRKSRC}/src/paperless/settings.py
 
 do-build:
 	@${PYTHON_CMD} ${PYTHON_LIBDIR}/compileall.py \
 		-d ${PYTHONPREFIX_SITELIBDIR} \
 		-x ".*/tests/" \
 		-f ${WRKSRC}/src
 	@${PYTHON_CMD} -O ${PYTHON_LIBDIR}/compileall.py \
 		-d ${PYTHONPREFIX_SITELIBDIR} \
 		-x ".*/tests/" \
 		-f ${WRKSRC}/src
 	@${PYTHON_CMD} -O ${PYTHON_LIBDIR}/compileall.py \
 		-d ${PYTHONPREFIX_SITELIBDIR} \
 		-f ${WRKSRC}/gunicorn.conf.py
 	@${RM} -r ${PAPERLESS_STATICDIR}
 	@${SETENV} \
 		PAPERLESS_STATICDIR=${PAPERLESS_STATICDIR} \
 		${PYTHON_CMD} ${WRKSRC}/src/manage.py collectstatic -i tests
 
 do-install:
 	@${MKDIR} ${STAGEDIR}${PYTHON_SITELIBDIR}/paperless
 	@cd ${WRKSRC}/resources && \
 		${COPYTREE_SHARE} . ${STAGEDIR}${DATADIR}
 	@cd ${WRKSRC}/src && \
 		${COPYTREE_SHARE} . ${STAGEDIR}${PYTHON_SITELIBDIR}/paperless
 	@cd ${WRKSRC} && ${COPYTREE_SHARE} gunicorn.conf.py \
 		${STAGEDIR}${PYTHON_SITELIBDIR}/paperless
 	@${FIND} ${STAGEDIR}${PYTHON_SITELIBDIR} -name '*.orig' -delete
-	@${RLN} ${STAGEDIR}${PYTHON_SITELIBDIR}/paperless/manage.py \
-		${STAGEDIR}${PREFIX}/bin/paperless
-	@${CHMOD} +x ${STAGEDIR}${PREFIX}/bin/paperless
+	@cd ${WRKDIR} && ${INSTALL_SCRIPT} paperless ${STAGEDIR}${PREFIX}/bin
 	@${SED} -e 's|%%WWWDIR%%|${WWWDIR}|g;' \
 		${WRKSRC}/paperless.conf.example \
 		> ${STAGEDIR}${PREFIX}/etc/paperless.conf.sample
 	@${MKDIR} ${STAGEDIR}/var/db/paperless/consume/input \
 		${STAGEDIR}/var/db/paperless/data/log \
 		${STAGEDIR}/var/db/paperless/media \
 		${STAGEDIR}/var/db/paperless/nltkdata
 	${INSTALL_MAN} ${WRKDIR}/paperless-ngx.7 ${STAGEDIR}${PREFIX}/share/man/man7
 	${MKDIR} ${STAGEDIR}${WWWDIR}
 	@cd ${WRKDIR}/${PORTNAME} && ${COPYTREE_SHARE} static ${STAGEDIR}${WWWDIR}
 	@${MKDIR} ${STAGEDIR}/var/run/paperless
 
 post-install-DOCS-on:
 	@${MKDIR} ${STAGEDIR}${DOCSDIR}/
 	@cd ${WRKSRC}/docs && \
 		${COPYTREE_SHARE} . ${STAGEDIR}${DOCSDIR}
 
 post-install-EXAMPLES-on:
 	@${MKDIR} ${STAGEDIR}${EXAMPLESDIR}
 	${INSTALL_DATA} \
 		${WRKDIR}/README \
 		${WRKDIR}/nginx.conf \
 		${WRKDIR}/sshd_config \
 		${STAGEDIR}${EXAMPLESDIR}
 
 .include <bsd.port.mk>
diff --git a/deskutils/py-paperless-ngx/files/paperless-ngx.7.in b/deskutils/py-paperless-ngx/files/paperless-ngx.7.in
index 6f771e4713e3..23bd7b42d9fb 100644
--- a/deskutils/py-paperless-ngx/files/paperless-ngx.7.in
+++ b/deskutils/py-paperless-ngx/files/paperless-ngx.7.in
@@ -1,389 +1,388 @@
 .\"
 .\" Copyright (c) 2024 Michael Gmelin
 .\"
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE DEVELOPERS ``AS IS'' AND ANY EXPRESS OR
 .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 .\" IN NO EVENT SHALL THE DEVELOPERS BE LIABLE FOR ANY DIRECT, INDIRECT,
 .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd April 24, 2024
+.Dd May 28, 2024
 .Dt PAPERLESS-NGX 7
 .Os
 .Sh NAME
 .Nm paperless-ngx
 .Nd Index and archive scanned paper documents - installation
 .Sh SYNOPSIS
 .Nm pkg install %%PKGBASE%%
 .Sh DESCRIPTION
 .Em Paperless-ngx
 is a Django-based document management system that transforms
 physical documents into a searchable online archive.
 It is the successor of the original Paperless and Paperless-ng projects.
 .Pp
 It consists of multiple parts, a web UI and a couple of backend
 services for consuming and processing documents.
 .Pp
 This man page documents how the
 .Fx
 port is installed and configured.
 It assumes that the paperless-ngx package was already installed, e.g., from the
 .Fx
 package repo as described in
 .Sx SYNOPSIS .
 .Pp
 .Em IMPORTANT :
 Please note that upgrading an existing installation of
 deskutils/paperless needs special precautions.
 See
 .Sx UPGRADING FROM PAPERLESS
 for how to approach that.
 .Pp
 For more information about using paperless-ngx, see
 the official paperless-ngx documentation
 .Pa ( https://docs.paperless-ngx.com ) .
 .Pp
-The package creates a symlink from
-.Pa %%PYTHONPREFIX_SITELIBDIR%%/paperless/manage.py
-to
+The package creates a wrapper
 .Pa %%PREFIX%%/bin/paperless
-for convenience reasons, so whenever the official
-documentation mentions
+which in turn calls
+.Pa %%PYTHONPREFIX_SITELIBDIR%%/paperless/manage.py ,
+so whenever the official documentation mentions
 .Em manage.py
-it can be substituted with
+it should be substituted with
 .Pa %%PREFIX%%/bin/paperless
 or simply
 .Pa paperless .
 .Pp
 .Em Paperless-ngx always needs to be run using the correct system user
 and a UTF-8 codepage.
 .Pp
 The package %%PKGBASE%% created a user
 .Em paperless
 with the following home directory layout, setting appropriate
 restrictive access permissions:
 .Bl -tag -width "/var"
 .It Pa /var/db/paperless
 home directory (only writeable by root)
 .Bl -tag -width "consume/" -compact
 .It Pa consume/
 Consume directory writable by root, used as chroot directory
 for sftp access (see below).
 .Bl -tag -width "123" -compact
 .It Pa input/
 Input files are dropped in there to be processed by the
 paperless document consumer - either directly or via
 a mechanism like sftp.
 .El
 .It Pa data/
 Contains paperless-ngx's data, including its SQLite database
 unless an external database like PostgreSQL or MariaDB is used.
 .Bl -tag -width "123" -compact
 .It Pa log/
 This is where paperless stored its log files
 (on top of what the services write to syslog).
 .El
 .It Pa media/
 Directory used by paperless-ngx to store original files and
 thumbnails.
 .It Pa nltkdata/
 Directory containing data used for natural language processing.
 .El
 .El
 .Sh BACKEND SETUP
 Paperless needs access to a running redis instance, which can be
 installed locally:
 .Bd -literal -offset indent
 pkg install redis
 service redis enable
 service redis start
 .Ed
 .Pp
 Modify
 .Pa %%PREFIX%%/etc/paperless.conf
 to match the configured credentials (when running on localhost,
 it is possible to use no special credentials).
 .Pp
 In case redis is not running on localhost, an ACL entry needs to
 be added to grant permissions to the user used to access the instance:
 .Bd -literal -offset indent
 user paperlessusername on +@all -@admin ~* &*
 .Ed
 .Pp
 The URL paperless is hosted on needs to be configued by setting
 .Va PAPERLESS_URL ,
 it is also possible to tune
 .Va PAPERLESS_THREADS_PER_WORKER
 in the same configuration file to limit the impact on system
 performance.
 .Pp
 Now, the database needs to be initialized.
 This can be accomplished by running
 .Bd -literal -offset indent
 service paperless-migrate onestart
 .Ed
 .Pp
 In case database migrations should be applied on every
 system start, paperless-migrate can be enabled to run on boot:
 .Bd -literal -offset indent
 service paperless-migrate enable
 .Ed
 .Pp
 Next, mandatory backend services are enabled
 .Bd -literal -offset indent
 service paperless-beat enable
 service paperless-consumer enable
 service paperless-webui enable
 service paperless-worker enable
 .Ed
 .Pp
 and subsequently started
 .Bd -literal -offset indent
 service paperless-beat start
 service paperless-consumer start
 service paperless-webui start
 service paperless-worker start
 .Ed
 .Sh NLTK DATA
 In order to process scanned documents using machine learning,
 paperless-ngx requires NLTK (natural language toolkit) data.
 The required files can be downloaded by using these commands:
 .Bd -literal -offset indent
 su -l paperless -c '%%PYTHON_CMD%% -m nltk.downloader \\
   stopwords snowball_data punkt -d /var/db/paperless/nltkdata'
 .Ed
 .Pp
 Normally, the document classifier is run automatically by
 Celery, but it can also be initiated manually by calling
 .Bd -literal -offset indent
 su -l paperless \\
    -c '%%PREFIX%%/bin/paperless document_create_classifier'
 .Ed
 .Sh OPTIONAL FLOWER SERVICE
 paperless-ngx makes use of Celery to control a cluster of workers.
 There is a component called flower which can be enabled optionally
 to monitor the cluster.
 It can be enabled and started like this:
 .Bd -literal -offset indent
 service paperless-flower enable
 service paperless-flower start
 .Ed
 .Sh JBIG2 ENCODING
 In case a binary named `jbig2enc' is found in $PATH, textproc/py-ocrmypdf
 will automatically pick it up to encode PDFs with it.
 .Pp
 A patch to add a port skeleton for jbig2enc for manual building
 on a local ports tree can be found here:
 .Pa https://people.freebsd.org/~grembo/graphics-jbig2enc.patch
 .Pp
 There are various considerations to be made when using jbig2enc,
 including potential patent claims and regulatory requirements,
 see also
 .Pa https://en.wikipedia.org/wiki/JBIG2 .
 .Sh WEB UI SETUP
 Before using the web ui, make sure to create a super user and assign
 a password
 .Bd -literal -offset indent
 su -l paperless -c '%%PREFIX%%/bin/paperless createsuperuser'
 .Ed
 .Pp
 It is recommended to host the web component using a real
 web server, e.g., nginx:
 .Bd -literal -offset indent
 pkg install nginx
 .Ed
 .Pp
 Copy-in basic server configuration:
 .Bd -literal -offset indent
 cp %%EXAMPLESDIR%%/nginx.conf \\
    %%PREFIX%%/etc/nginx/nginx.conf
 .Ed
 .Pp
 This server configuration contains TLS certificates, which
 need to be created by the administrator.
 See below for an example of how to create a self-signed
 certificate to get started:
 .Bd -literal -offset indent
 openssl req -x509 -nodes -days 365 -newkey rsa:4096 \\
   -keyout %%PREFIX%%/etc/nginx/selfsigned.key \\
   -out %%PREFIX%%/etc/nginx/selfsigned.crt
 .Ed
 .Pp
 Enable and start nginx:
 .Bd -literal -offset indent
 service nginx enable
 service nginx start
 .Ed
 .Pp
 The default nginx.conf can be adapted by the administrator to their
 needs.
 In case the optional flower service was enabled earlier, the commented
 out block in the example file can be uncommented to make flower available
 at /flower.
 .Pp
 .Em \&It is important to properly secure a public facing web server.
 .Em Doing this properly is up to the administrator.
 .Sh SETUP WITHOUT A WEB SERVER
 Even though
 .Em not
 recommended, it is also possible to configure paperless to serve static
 artifacts directly.
 To do so, set
 .Va PAPERLESS_STATICDIR=%%WWWDIR%%/static
 in
 .Pa %%PREFIX%%/etc/paperless.conf .
 .Sh SFTP SETUP
 Setting up
 .Em sftp
 enabled direct upload of files to be processed by the paperless
 consumer.
 Some scanners allow configuring sftp with key based authentication,
 which is convenient as it scans directly to the paperless processing
 pipeline.
 .Pp
 In case paperless is using a dedicated instance of
 .Xr sshd 8 ,
 access can be limited to the paperless user by adding
 these lines to
 .Pa /etc/ssh/sshd_config :
 .Bd -literal -offset indent
 # Only include if sshd is dedicated to paperless
 # otherwise you'll lock yourself out
 AllowUsers paperless
 .Ed
 .Pp
 The following block limits the paperless user to using the
 .Xr sftp 1
 protocol and locks it into the consume directory:
 .Bd -literal -offset indent
 # paperless can only do sftp and is dropped into correct directory
 Match User paperless
 	ChrootDirectory %h/consume
 	ForceCommand internal-sftp -u 0077 -d /input
 	AllowTcpForwarding no
 	X11Forwarding no
 	PasswordAuthentication no
 .Ed
 .Pp
 The public keys of authorized users/devices need to be added to
 .Pa /var/db/paperless/.ssh/authorized_keys :
 .Bd -literal -offset indent
 mkdir -p /var/db/paperless/.ssh
 cat path/to/pubkey >>/var/db/paperless/.ssh/authorized_keys
 .Ed
 .Pp
 Make sure
 .Xr sshd 8
 is enabled and restart (or reload) it:
 .Bd -literal -offset indent
 service sshd enable
 service sshd restart
 .Ed
 .Pp
 The user will be dropped into the correct directory, so uploading
 a file is as simple as:
 .Bd -literal -offset indent
 echo put file.pdf | sftp -b - paperless@host
 .Ed
 .Sh UPGRADING FROM PAPERLESS
 In case deskutils/paperless is installed, follow the upgrading
 guide at:
 .Pa https://docs.paperless-ngx.com/setup/#migrating-from-paperless
 .Pp
 This guide is for a docker based installation, so here a few basic
 hints for upgrading a
 .Fx
 based installation:
 .Bl -bullet -compact
 .It
 There need to be good and working backups before migrating
 .It
 In case PGP encryption was used, files need to be decrypted first
 by using the existing installation of deskutils/py-paperless.
 See
 .Pa https://github.com/the-paperless-project/paperless/issues/714
 for a description on how to do this and potential pitfalls.
 The basic idea is to comment out lines 95 and 96 in
 .Pa change_storage_type.py
 and then run:
 .Bd -literal -offset indent
 su -l paperless -c \\
   '%%PREFIX%%/bin/paperless change_storage_type gpg unencrypted'
 .Ed
 .Pp
 .It
 Deinstall py-paperless (it might be good to keep a backup of the
 package).
 .It
 Move the old paperless configuration file out of the way before
 installing paperless-ngx:
 .Bd -literal -offset indent
 mv %%PREFIX%%/etc/paperless.conf \\
    %%PREFIX%%/etc/paperless.conf.old
 .Ed
 .Pp
 .It
 Install paperless-ngx:
 .Bd -literal -offset indent
 pkg install %%PKGBASE%%
 .Ed
 .Pp
 .It
 Configure
 .Pa %%PREFIX%%/etc/paperless.conf
 as described above.
 .It
 Re-index documents:
 .Bd -literal -offset indent
 su -l paperless \\
    -c '%%PREFIX%%/bin/paperless document_index reindex'
 .Ed
 .Pp
 .It
 Check if documents are okay:
 .Bd -literal -offset indent
 su -l paperless \\
    -c '%%PREFIX%%/bin/paperless document_sanity_checker'
 .Ed
 .Pp
 .It
 In general, things should be expected to fail, so being able to
 restore from backup is vital.
 .El
 .Sh FILES
 .Bl -tag -width ".Pa %%PREFIX%%/etc/paperless.conf" -compact
 .It Pa %%PREFIX%%/etc/paperless.conf
 See
 .Pa %%PREFIX%%/etc/paperless.conf.sample
 for an example.
 .It Pa %%EXAMPLESDIR%%
 Configuration examples, complementary to this man page.
 .El
 .Sh SEE ALSO
 .Xr sftp 1 ,
 .Xr sshd_config 5 ,
 .Xr ports 7 ,
 .Xr daemon 8 ,
 .Xr service 8
 .Pp
 .Pa https://docs.paperless-nginx.com
 .Sh AUTHORS
 .An -nosplit
 This manual page was written by
 .An Michael Gmelin Aq Mt grembo@FreeBSD.org .
diff --git a/deskutils/py-paperless-ngx/files/paperless.in b/deskutils/py-paperless-ngx/files/paperless.in
new file mode 100644
index 000000000000..5753e5d4e003
--- /dev/null
+++ b/deskutils/py-paperless-ngx/files/paperless.in
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+set -e
+
+export OMP_NUM_THREADS=1
+exec \
+  %%PYTHON_CMD%% \
+  %%PYTHONPREFIX_SITELIBDIR%%/paperless/manage.py \
+  "$@"