movefasta/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-06-28 20:16:41 +03:00
Code Activity

nixos/paperless: set PAPERLESS_SECRET_KEY

Browse source 
If the PAPERLESS_SECRET_KEY environment variable is left unset
paperless-ngx defaults to a well-known value, which is insecure.

Co-authored-by: Erik Arvstedt <erik.arvstedt@gmail.com>
This commit is contained in:
Matthias Riße 2023-10-18 18:01:34 +02:00
parent 6d0c07733d
commit 63ef033992
1 changed files with 20 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

25
nixos/modules/services/misc/paperless.nix
View file

@ -332,12 +332,28 @@ in
# during migrations
bindsTo = [ "paperless-scheduler.service" ];
after = [ "paperless-scheduler.service" ];
# Setup PAPERLESS_SECRET_KEY.
# If this environment variable is left unset, paperless-ngx defaults
# to a well-known value, which is insecure.
script = let
secretKeyFile = "${cfg.dataDir}/nixos-paperless-secret-key";
in ''
if [[ ! -f '${secretKeyFile}' ]]; then
(
umask 0377
tr -dc A-Za-z0-9 < /dev/urandom | head -c64 | ${pkgs.moreutils}/bin/sponge '${secretKeyFile}'
)
fi
export PAPERLESS_SECRET_KEY=$(cat '${secretKeyFile}')
if [[ ! $PAPERLESS_SECRET_KEY ]]; then
echo "PAPERLESS_SECRET_KEY is empty, refusing to start."
exit 1
fi
exec ${pkg.python.pkgs.gunicorn}/bin/gunicorn \
-c ${pkg}/lib/paperless-ngx/gunicorn.conf.py paperless.asgi:application
'';
serviceConfig = defaultServiceConfig // {
User = cfg.user;
ExecStart = ''
${pkg.python.pkgs.gunicorn}/bin/gunicorn \
-c ${pkg}/lib/paperless-ngx/gunicorn.conf.py paperless.asgi:application
'';
Restart = "on-failure";
# gunicorn needs setuid, liblapack needs mbind
@ -349,7 +365,6 @@ in
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
};
environment = env // {
PATH = mkForce pkg.path;
PYTHONPATH = "${pkg.python.pkgs.makePythonPath pkg.propagatedBuildInputs}:${pkg}/lib/paperless-ngx/src";
};
# Allow the web interface to access the private /tmp directory of the server.