nixos/paperless: Add database.isRemote option

When the database is on another host, unit isolation for the document
consumer has to be disabled.

nixos/modules/services/misc/paperless.nix

@@ -251,6 +251,14 @@ in
           Configure local PostgreSQL database server for Paperless.
         '';
       };
+      isRemote = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Database server is remote over the network. This will disable network isolation of
+          the document consumer.
+        '';
+      };
     };
   };
 
@@ -298,6 +306,7 @@ in
         ExecStart = "${cfg.package}/bin/celery --app paperless beat --loglevel INFO";
         Restart = "on-failure";
         LoadCredential = lib.optionalString (cfg.passwordFile != null) "PAPERLESS_ADMIN_PASSWORD:${cfg.passwordFile}";
+        PrivateNetwork = lib.mkIf cfg.database.isRemote false;
       };
       environment = env;
 
@@ -374,6 +383,7 @@ in
         User = cfg.user;
         ExecStart = "${cfg.package}/bin/paperless-ngx document_consumer";
         Restart = "on-failure";
+        PrivateNetwork = lib.mkIf cfg.database.isRemote false;
       };
       environment = env;
       # Allow the consumer to access the private /tmp directory of the server.