From 94f00041f0cd3916be55bc90367a3e160717533f Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 4 Sep 2022 13:46:35 +0200 Subject: [PATCH 1/5] nixos/paperless: Allow mbind syscall in paperless-web.services After uploading a document through the webinterface I started seeing it killed through the SYSBUS signal. Inspecting the call trace led me to liblapack's memory allocator, that uses the mbind syscall on Linux. --- nixos/modules/services/misc/paperless.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix index fbf1338a0dff..c17bde0da33c 100644 --- a/nixos/modules/services/misc/paperless.nix +++ b/nixos/modules/services/misc/paperless.nix @@ -287,8 +287,8 @@ in AmbientCapabilities = "CAP_NET_BIND_SERVICE"; CapabilityBoundingSet = "CAP_NET_BIND_SERVICE"; - # gunicorn needs setuid - SystemCallFilter = defaultServiceConfig.SystemCallFilter ++ [ "@setuid" ]; + # gunicorn needs setuid, liblapack needs mbind + SystemCallFilter = defaultServiceConfig.SystemCallFilter ++ [ "@setuid mbind" ]; # Needs to serve web page PrivateNetwork = false; }; From 81a17f7352bd7acc438c298f317c190d2fbdcc35 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 4 Sep 2022 13:50:17 +0200 Subject: [PATCH 2/5] nixos/paperless: Use system timezone by default, if set --- nixos/modules/services/misc/paperless.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix index c17bde0da33c..8750770cea20 100644 --- a/nixos/modules/services/misc/paperless.nix +++ b/nixos/modules/services/misc/paperless.nix @@ -17,9 +17,11 @@ let GUNICORN_CMD_ARGS = "--bind=${cfg.address}:${toString cfg.port}"; } // ( lib.mapAttrs (_: toString) cfg.extraConfig - ) // (optionalAttrs enableRedis { + ) // optionalAttrs (config.time.timeZone != null) { + PAPERLESS_TIME_ZONE = lib.mkDefault config.time.timeZone; + } // optionalAttrs enableRedis { PAPERLESS_REDIS = "unix://${redisServer.unixSocket}"; - }); + }; manage = let setupEnv = lib.concatStringsSep "\n" (mapAttrsToList (name: val: "export ${name}=\"${val}\"") env); From 2d257f81019e6a9ee255a92810be771d753b8ba5 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 4 Sep 2022 13:52:14 +0200 Subject: [PATCH 3/5] nixos/paperless: Add pgsql via unix socket example Finding out how to connect paperless to a PostgreSQL database via unix sockets and peer authentication took me a few minutes, so leaving a hint in the extraConfig example seems like a good idea to me. Also remove unnecessary use of literalExpression for attribute set, it is only required for complex values like functions or values that depend on other values or packages. --- nixos/modules/services/misc/paperless.nix | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix index 8750770cea20..9e554b93fc82 100644 --- a/nixos/modules/services/misc/paperless.nix +++ b/nixos/modules/services/misc/paperless.nix @@ -176,11 +176,10 @@ in See [the documentation](https://paperless-ngx.readthedocs.io/en/latest/configuration.html) for available options. ''; - example = literalExpression '' - { - PAPERLESS_OCR_LANGUAGE = "deu+eng"; - } - ''; + example = { + PAPERLESS_OCR_LANGUAGE = "deu+eng"; + PAPERLESS_DBHOST = "/run/postgresql"; + }; }; user = mkOption { From 73e10d9d5a150c2dbaac705389b9ca41fcc0626d Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 4 Sep 2022 16:01:45 +0200 Subject: [PATCH 4/5] paperless: Expose python environment in passthru This allows adding more python dependencies through overrides. --- pkgs/applications/office/paperless-ngx/default.nix | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/pkgs/applications/office/paperless-ngx/default.nix b/pkgs/applications/office/paperless-ngx/default.nix index 679a732c2d67..a42ec844d115 100644 --- a/pkgs/applications/office/paperless-ngx/default.nix +++ b/pkgs/applications/office/paperless-ngx/default.nix @@ -16,7 +16,7 @@ let # Use specific package versions required by paperless-ngx - py = python3.override { + python = python3.override { packageOverrides = self: super: { django = super.django_4; @@ -51,7 +51,7 @@ let path = lib.makeBinPath [ ghostscript imagemagick jbig2enc optipng pngquant qpdf tesseract4 unpaper ]; in -py.pkgs.pythonPackages.buildPythonApplication rec { +python.pkgs.pythonPackages.buildPythonApplication rec { pname = "paperless-ngx"; version = "1.8.0"; @@ -63,7 +63,7 @@ py.pkgs.pythonPackages.buildPythonApplication rec { format = "other"; - propagatedBuildInputs = with py.pkgs.pythonPackages; [ + propagatedBuildInputs = with python.pkgs.pythonPackages; [ aioredis arrow asgiref @@ -169,7 +169,7 @@ py.pkgs.pythonPackages.buildPythonApplication rec { # Compile manually because `pythonRecompileBytecodeHook` only works for # files in `python.sitePackages` postBuild = '' - ${py.interpreter} -OO -m compileall src + ${python.interpreter} -OO -m compileall src ''; installPhase = '' @@ -181,7 +181,7 @@ py.pkgs.pythonPackages.buildPythonApplication rec { --prefix PATH : "${path}" ''; - checkInputs = with py.pkgs.pythonPackages; [ + checkInputs = with python.pkgs.pythonPackages; [ pytest-django pytest-env pytest-sugar @@ -207,6 +207,7 @@ py.pkgs.pythonPackages.buildPythonApplication rec { ''; passthru = { + inherit python; # PYTHONPATH of all dependencies used by the package pythonPath = python3.pkgs.makePythonPath propagatedBuildInputs; inherit path; From f98011803ebbe7e68e2133a3405d4928f3c274c7 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 4 Sep 2022 16:14:17 +0200 Subject: [PATCH 5/5] nixos/paperless: Restrict CAP_NET_BIND_SERVICE Handing CAP_NET_BIND_SERVICE to the `paperless-web.service` only makes sense when it actually wants to bind to a port < 1024. Don't hand it out if that is not the case. --- nixos/modules/services/misc/paperless.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix index 9e554b93fc82..b1cf72258d17 100644 --- a/nixos/modules/services/misc/paperless.nix +++ b/nixos/modules/services/misc/paperless.nix @@ -286,12 +286,13 @@ in ''; Restart = "on-failure"; - AmbientCapabilities = "CAP_NET_BIND_SERVICE"; - CapabilityBoundingSet = "CAP_NET_BIND_SERVICE"; # gunicorn needs setuid, liblapack needs mbind SystemCallFilter = defaultServiceConfig.SystemCallFilter ++ [ "@setuid mbind" ]; # Needs to serve web page PrivateNetwork = false; + } // lib.optionalAttrs (cfg.port < 1024) { + AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ]; + CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ]; }; environment = env // { PATH = mkForce cfg.package.path;