From 85022a753c68f72da970c2e85d6a468fa3d477bf Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 1 May 2026 13:33:23 +0200 Subject: [PATCH] nixos/nextcloud: warn on secrets from OCC ending up in the journal Closes #513470 `nextcloud-occ` can be used to set sensitive parameters in `config.php`. However, the entire argv unconditionally ends up in the journal's metadata. Even with `--description=` being set, the full command is logged and thus persisted. --- nixos/modules/services/web-apps/nextcloud.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/nixos/modules/services/web-apps/nextcloud.md b/nixos/modules/services/web-apps/nextcloud.md index 0becc863590b..69d7053d1adc 100644 --- a/nixos/modules/services/web-apps/nextcloud.md +++ b/nixos/modules/services/web-apps/nextcloud.md @@ -68,6 +68,11 @@ It requires elevated permissions to become the `nextcloud` user. Given the way t escalation is implemented, parameters passed via the environment to Nextcloud are currently ignored, except for `OC_PASS` and `NC_PASS`. +::: {.warning} +When Polkit is enabled, the command being executed by `nextcloud-occ` might be logged +into the system's journal. Be careful to not leak secrets that way! +::: + Custom service units that need to run `nextcloud-occ` either need elevated privileges or the systemd configuration from `nextcloud-setup.service` (recommended):