diff --git a/nixos/machines/chungus/paperless.nix b/nixos/machines/chungus/paperless.nix
index 85cfed6..0811d34 100644
--- a/nixos/machines/chungus/paperless.nix
+++ b/nixos/machines/chungus/paperless.nix
@@ -12,6 +12,13 @@
     };
   };
 
+  services.permown."/var/lib/paperless/consume" = {
+    owner = "paperless";
+    group = "paperless";
+    directory-mode = "755";
+    file-mode = "640";
+  };
+
   networking.firewall.interfaces.wg0.allowedTCPPorts = [ config.services.paperless.port ];
 
   services.nginx.virtualHosts."paperless.${config.networking.hostName}.private" = {
@@ -20,6 +27,9 @@
       deny all;
     '';
     locations."/" = {
+      extraConfig = ''
+        client_max_body_size 500M;
+      '';
       proxyPass = "http://localhost:${toString config.services.paperless.port}";
       proxyWebsockets = true;
     };
diff --git a/scripts/wireguard-client.sh b/scripts/wireguard-client.sh
index 4e13f21..a73a643 100644
--- a/scripts/wireguard-client.sh
+++ b/scripts/wireguard-client.sh
@@ -4,10 +4,10 @@
 
 client_name="ipad tina"
 client_ip=10.100.0.9
-private_key=$( wg genkey )
-public_key=$( echo "$private_key" | wg pubkey )
+private_key=$(wg genkey)
+public_key=$(echo "$private_key" | wg pubkey)
 
-cat <<EOF > client.conf
+cat <<EOF >client.conf
 [Interface]
 Address = ${client_ip}/32
 MTU = 1280
@@ -39,4 +39,4 @@ for quick configuration
 
 EOF
 
-qrencode -t ansiutf8 < client.conf
+qrencode -t ansiutf8 <client.conf