gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/nextcloud: warn on secrets from OCC ending up in the journal

Browse Source 
Closes #513470

`nextcloud-occ` can be used to set sensitive parameters in `config.php`.
However, the entire argv unconditionally ends up in the journal's
metadata. Even with `--description=` being set, the full command is
logged and thus persisted.
This commit is contained in:
Maximilian Bosch
2026-05-14 18:52:19 +02:00
parent a547c278f8
commit 85022a753c
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/services/web-apps/nextcloud.md
+5
View File
@@ -68,6 +68,11 @@ It requires elevated permissions to become the `nextcloud` user. Given the way t
escalation is implemented, parameters passed via the environment to Nextcloud are
currently ignored, except for `OC_PASS` and `NC_PASS`.
::: {.warning}
When Polkit is enabled, the command being executed by `nextcloud-occ` might be logged
into the system's journal. Be careful to not leak secrets that way!
:::
Custom service units that need to run `nextcloud-occ` either need elevated privileges
or the systemd configuration from `nextcloud-setup.service` (recommended):