From 88b387f90d45f8e5a51a078ae12731c3d5424c9d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Tue, 26 Aug 2025 16:20:58 +0200 Subject: [PATCH 1/6] nixos/tests/gotenberg: auto start chromium and libreoffice to detect failures starting them without having to convert a document --- nixos/tests/gotenberg.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/nixos/tests/gotenberg.nix b/nixos/tests/gotenberg.nix index c640657ea872..05b326996aa6 100644 --- a/nixos/tests/gotenberg.nix +++ b/nixos/tests/gotenberg.nix @@ -7,6 +7,9 @@ nodes.machine = { services.gotenberg = { enable = true; + # fail the service if any of those does not come up + chromium.autoStart = true; + libreoffice.autoStart = true; }; }; From e5143301e214ec9099f882fda8363d9080e86243 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Tue, 26 Aug 2025 16:31:18 +0200 Subject: [PATCH 2/6] nixos/gotenberg: fix starting chromium [Tue Aug 26 16:12:02 2025] audit: type=1326 audit(1756217587.085:126): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=3124193 comm="chromium" exe="/nix/store/xrjg398ps4mkbpsz66kpjgqfzfjpm2cr-chromium-unwrapped-139.0.7258.127/libexec/chromium/chromium" sig=31 arch=c000003e syscall=330 compat=0 ip=0x7f001d2c4afb code=0x80000000 --- nixos/modules/services/misc/gotenberg.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/services/misc/gotenberg.nix b/nixos/modules/services/misc/gotenberg.nix index e306e530116a..ed4549b03436 100644 --- a/nixos/modules/services/misc/gotenberg.nix +++ b/nixos/modules/services/misc/gotenberg.nix @@ -303,6 +303,7 @@ in }; serviceConfig = { Type = "simple"; + # NOTE: disable to debug chromium crashes or otherwise no coredump is created and forbidden syscalls are not being logged DynamicUser = true; ExecStart = "${lib.getExe cfg.package} ${lib.escapeShellArgs args}"; @@ -340,6 +341,7 @@ in "@sandbox" "@system-service" "@chown" + "@pkey" # required by chromium or it crashes ]; SystemCallArchitectures = "native"; From 67cffed7d9de1c4b8e6fe5681c53f9513492be55 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Tue, 26 Aug 2025 16:37:54 +0200 Subject: [PATCH 3/6] gotenberg: 8.21.1 -> 8.22.0 Changelog: https://github.com/gotenberg/gotenberg/releases/tag/v8.22.0 --- pkgs/by-name/go/gotenberg/package.nix | 29 ++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-) diff --git a/pkgs/by-name/go/gotenberg/package.nix b/pkgs/by-name/go/gotenberg/package.nix index ddce8144813a..225dc55e14ff 100644 --- a/pkgs/by-name/go/gotenberg/package.nix +++ b/pkgs/by-name/go/gotenberg/package.nix @@ -1,6 +1,6 @@ { lib, - buildGoModule, + buildGo125Module, chromium, fetchFromGitHub, libreoffice, @@ -22,18 +22,23 @@ let libreoffice' = "${libreoffice}/lib/libreoffice/program/soffice.bin"; inherit (lib) getExe; in -buildGoModule rec { +buildGo125Module rec { pname = "gotenberg"; - version = "8.21.1"; + version = "8.22.0"; + + outputs = [ + "out" + "hyphen" + ]; src = fetchFromGitHub { owner = "gotenberg"; repo = "gotenberg"; tag = "v${version}"; - hash = "sha256-2uILOK5u+HrdjqN+ZQjGv48QxSCrzSvnF+Ae6iCKCbU="; + hash = "sha256-LrkJlUkcvW8ky9e2Ltj13wxcL0rvaE4NfVJrcrgPHL4="; }; - vendorHash = "sha256-sTcP/tyrCtvgYeOnsbqRFdBC1bbMAbA978t6LOTKFio="; + vendorHash = "sha256-JHsuCYx9Ec/w8LBT2R4LxlrfjYyYve0+4/Xq0U1sq5I="; postPatch = '' find ./pkg -name '*_test.go' -exec sed -i -e 's#/tests#${src}#g' {} \; @@ -82,14 +87,20 @@ buildGoModule rec { in [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ]; + postInstall = '' + mkdir $hyphen + cp -r build/chromium-hyphen-data/*/* $hyphen/ + ''; + preFixup = '' wrapProgram $out/bin/gotenberg \ + --set CHROMIUM_HYPHEN_DATA_DIR_PATH "$hyphen" \ + --set EXIFTOOL_BIN_PATH "${getExe exiftool}" \ + --set JAVA_HOME "${jre'}" \ + --set PDFCPU_BIN_PATH "${getExe pdfcpu}" \ --set PDFTK_BIN_PATH "${getExe pdftk}" \ --set QPDF_BIN_PATH "${getExe qpdf}" \ - --set UNOCONVERTER_BIN_PATH "${getExe unoconv}" \ - --set EXIFTOOL_BIN_PATH "${getExe exiftool}" \ - --set PDFCPU_BIN_PATH "${getExe pdfcpu}" \ - --set JAVA_HOME "${jre'}" + --set UNOCONVERTER_BIN_PATH "${getExe unoconv}" ''; passthru.updateScript = nix-update-script { }; From 9f09125d21e21cac053f8d0ab6b923a424d9f9d1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Tue, 26 Aug 2025 17:13:57 +0200 Subject: [PATCH 4/6] nixos/gotenberg: fix typos --- nixos/modules/services/misc/gotenberg.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/misc/gotenberg.nix b/nixos/modules/services/misc/gotenberg.nix index ed4549b03436..de8c7805673c 100644 --- a/nixos/modules/services/misc/gotenberg.nix +++ b/nixos/modules/services/misc/gotenberg.nix @@ -115,7 +115,7 @@ in autoStart = mkOption { type = types.bool; default = false; - description = "Automatically start chromium when Gotenberg starts. If false, Chromium will start on the first conversion request that uses it."; + description = "Automatically start Chromium when Gotenberg starts. If false, Chromium will start on the first conversion request that uses it."; }; disableJavascript = mkOption { @@ -172,7 +172,7 @@ in autoStart = mkOption { type = types.bool; default = false; - description = "Automatically start LibreOffice when Gotenberg starts. If false, Chromium will start on the first conversion request that uses it."; + description = "Automatically start LibreOffice when Gotenberg starts. If false, LibreOffice will start on the first conversion request that uses it."; }; disableRoutes = mkOption { From 53fb369dfaaf670bcc137d8eda6c06ee8e3ed664 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Tue, 26 Aug 2025 17:14:06 +0200 Subject: [PATCH 5/6] nixos/paperless: update link --- nixos/modules/services/misc/paperless.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix index 4a54e637507a..78b427021408 100644 --- a/nixos/modules/services/misc/paperless.nix +++ b/nixos/modules/services/misc/paperless.nix @@ -598,7 +598,7 @@ in services.gotenberg = lib.mkIf cfg.configureTika { enable = true; - # https://github.com/paperless-ngx/paperless-ngx/blob/v2.15.3/docker/compose/docker-compose.sqlite-tika.yml#L64-L69 + # https://github.com/paperless-ngx/paperless-ngx/blob/v2.18.2/docker/compose/docker-compose.sqlite-tika.yml#L60-L65 chromium.disableJavascript = true; extraArgs = [ "--chromium-allow-list=file:///tmp/.*" ]; }; From cb12d1512442e1acf979ced0f59e83b07eb00117 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Tue, 26 Aug 2025 18:01:29 +0200 Subject: [PATCH 6/6] nixos/gotenberg: allow another syscall which caused a coredump while doing further testing --- nixos/modules/services/misc/gotenberg.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/misc/gotenberg.nix b/nixos/modules/services/misc/gotenberg.nix index de8c7805673c..e9a6388b970b 100644 --- a/nixos/modules/services/misc/gotenberg.nix +++ b/nixos/modules/services/misc/gotenberg.nix @@ -342,6 +342,7 @@ in "@system-service" "@chown" "@pkey" # required by chromium or it crashes + "mincore" ]; SystemCallArchitectures = "native";