From 6833a678b90969b8ddd06490ca0a15d9781417be Mon Sep 17 00:00:00 2001
From: provokateurin <kate@provokateurin.de>
Date: Mon, 13 Jul 2026 23:40:42 +0200
Subject: [PATCH] nixos/paperless: Use security.pki.caBundle to automatically
 accept self-signed certificates

Without this self-signed certificates used by authentication providers will not work.
---
 nixos/modules/services/misc/paperless.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index f7ca6c2717bc..bfe8b651b350 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -24,6 +24,8 @@ let
     GRANIAN_HOST = cfg.address;
     GRANIAN_PORT = toString cfg.port;
     GRANIAN_WORKERS_KILL_TIMEOUT = "60";
+    # django-allauth uses python requests, which doesn't use the systems CA bundle by default: https://requests.readthedocs.io/en/latest/user/advanced/#ca-certificates
+    REQUESTS_CA_BUNDLE = config.security.pki.caBundle;
   }
   // lib.optionalAttrs (config.time.timeZone != null) {
     PAPERLESS_TIME_ZONE = config.time.timeZone;