diff --git a/stacks/haproxy/conf/haproxy.cfg b/stacks/haproxy/conf/haproxy.cfg
index 70b2366..a3ddc94 100644
--- a/stacks/haproxy/conf/haproxy.cfg
+++ b/stacks/haproxy/conf/haproxy.cfg
@@ -133,6 +133,8 @@ frontend fe_https
   acl host_privatebin hdr(host) -i pb.zk-tech.info
   # Vaultwarden
   acl host_vaultwarden hdr(host) -i vw.zk-tech.info
+  # Paperless-NGX
+  acl host_paperless hdr(host) -i pl.zk-tech.info
 
   # Deny access to WUD
   http-request deny if host_wud !allowed_wud
@@ -185,6 +187,8 @@ frontend fe_https
   use_backend bk_privatebin if host_privatebin
   # Vaultwarden backend
   use_backend bk_vaultwarden if host_vaultwarden
+  # Paperless-NGX
+  use_backend bk_paperless if host_paperless
 
   default_backend bk_404
 
@@ -402,3 +406,10 @@ backend bk_vaultwarden
     http-check expect status 200
     timeout tunnel 1h
     server vaultwarden vaultwarden:80 check
+# Paperless
+backend bk_paperless
+    mode http
+    option forwardfor
+    http-request set-header X-Forwarded-Proto https
+    http-request set-header X-Forwarded-Host %[req.hdr(host)]
+    server paperless paperless-ngx:8000 check resolvers paperless_docker_dns resolve-prefer ipv4 init-addr last,libc,none