Paperless Scanner Configuration Guide¶

How to configure a Brother MFC-L8690CDW (or similar) to upload scans directly into the Paperless-ngx SFTP inbox provisioned by paperless_deploy.

Prerequisites¶

Paperless deployed via ops-library/ops-control (just deploy-one paperless)
Scanner user enabled (default username scanner, chroot /srv/sftp-scanner, inbox /srv/sftp-scanner/inbox)
Password stored in secrets and deployed
SSH reachable from the printer (port 22)

Item	Value	Notes
Host/IP	`your-server.taildomain.ts.net` or LAN IP	Use LAN IP if printer lacks DNS
Port	`22`	SFTP only
Username	`scanner`	Match `paperless_scanner_username`
Password	From secrets	Update printer whenever password rotates
Directory	`inbox`	No leading slash (Brother quirk)

Optional: export /etc/ssh/ssh_host_rsa_key.pub and upload via printer UI so it trusts the host key.

Browse to http://<printer-ip> → Scan → Scan to FTP/SFTP.
Add a new profile (e.g. “Paperless”).
Set Protocol SFTP, Host/Port/User/Password per table, and Store Directory inbox.
Recommended scan settings:
- File Type PDF
- Resolution 300 dpi
- Color Mode Auto
- 2-Sided On (duplex profile) or Off (simplex)
Save the profile and add it to printer shortcuts.

Profile	Source	Duplex	Use Case
Paperless ADF	Automatic Document Feeder	On	Multi-page documents
Paperless Flatbed	Flatbed	Off	Passports, thick items
Receipts	ADF	Off	Low-res grayscale (200 dpi)

ADF tips: load pages face-up, enable “ADF Continuous Scan” and “Skip Blank Page”.

From printer: run the Paperless shortcut and wait for “Sent Successfully”.

On server:

ssh root@your-server.taildomain.ts.net
ls -lh /mnt/cryptdata/paperless/consume/

Monitor Paperless:

journalctl -u paperless-scheduler -f

Symptom	Checks
Authentication failed	`ssh scanner@host`, verify `/etc/ssh/sshd_config.d/sftp-scanner.conf`
“Cannot send file”	`mount
Files not processed	`systemctl status paperless-scheduler`, inspect `/mnt/cryptdata/paperless/consume/failed`

Rotate the scanner password via SOPS + just deploy-one paperless, then update the printer profile.
Failed uploads land in /mnt/cryptdata/paperless/consume/failed.
Document profile changes in ops-control/docs/PAPERLESS.md.