This repository has no description
3.0 kB
99 lines
1{ config, pkgs, ... }:
2let
3 domain = "paperless.lassul.us";
4 cfg = config.services.paperless;
5 zitadelEnv = config.lass.zitadel.projects.paperless.apps.web.envFile.path;
6 oidcEnv = "/run/paperless-oidc/oidc.env";
7 paperlessServices = [
8 "paperless-secret-key.service"
9 "paperless-scheduler.service"
10 "paperless-task-queue.service"
11 "paperless-consumer.service"
12 "paperless-web.service"
13 ];
14in
15{
16 clan.core.vars.generators.paperless-admin = {
17 files."password" = { };
18 runtimeInputs = with pkgs; [
19 coreutils
20 pwgen
21 ];
22 script = ''
23 pwgen -s 32 1 | tr -d '\n' > "$out/password"
24 '';
25 };
26
27 services.paperless = {
28 enable = true;
29 inherit domain;
30 passwordFile = config.clan.core.vars.generators.paperless-admin.files."password".path;
31 environmentFile = oidcEnv;
32 settings = {
33 PAPERLESS_OCR_LANGUAGE = "deu+eng";
34 PAPERLESS_TIME_ZONE = "Europe/Berlin";
35 PAPERLESS_APPS = "allauth.socialaccount.providers.openid_connect";
36 PAPERLESS_SOCIAL_AUTO_SIGNUP = true;
37 # only the login form; API tokens and basic auth keep working
38 PAPERLESS_DISABLE_REGULAR_LOGIN = true;
39 };
40 };
41
42 # Zitadel (id.lassul.us) login, only for users with a grant on the project.
43 # zitadel-reconcile writes the client id/secret to zitadelEnv.
44 lass.zitadel.projects.paperless = {
45 access = "declarative";
46 users = [ "lass@lassul.us" ];
47 apps.web = {
48 redirectUris = [ "https://${domain}/accounts/oidc/zitadel/login/callback/" ];
49 authMethod = "post";
50 };
51 };
52
53 # Builds PAPERLESS_SOCIALACCOUNT_PROVIDERS with the client secret into
54 # oidcEnv, the paperless environmentFile. Accounts are keyed by `sub`.
55 systemd.services.paperless-oidc-env = {
56 wants = [ "zitadel-reconcile.service" ];
57 after = [ "zitadel-reconcile.service" ];
58 before = paperlessServices;
59 requiredBy = paperlessServices;
60 path = [ pkgs.jq ];
61 serviceConfig = {
62 Type = "oneshot";
63 RemainAfterExit = true;
64 RuntimeDirectory = "paperless-oidc";
65 RuntimeDirectoryMode = "0700";
66 RuntimeDirectoryPreserve = true;
67 UMask = "0077";
68 EnvironmentFile = zitadelEnv;
69 };
70 script = ''
71 providers=$(jq -nc '{openid_connect: {APPS: [{
72 provider_id: "zitadel",
73 name: "lassul.us ID",
74 client_id: env.CLIENT_ID,
75 secret: env.CLIENT_SECRET,
76 settings: {
77 server_url: "https://id.lassul.us",
78 token_auth_method: "client_secret_post",
79 uid_field: "sub"
80 }
81 }]}}')
82 printf "PAPERLESS_SOCIALACCOUNT_PROVIDERS='%s'\n" "$providers" > ${oidcEnv}.tmp
83 mv ${oidcEnv}.tmp ${oidcEnv}
84 '';
85 };
86
87 services.nginx.virtualHosts.${domain} = {
88 enableACME = true;
89 forceSSL = true;
90 locations."/" = {
91 proxyPass = "http://${cfg.address}:${toString cfg.port}";
92 recommendedProxySettings = true;
93 proxyWebsockets = true;
94 extraConfig = ''
95 client_max_body_size 100M;
96 '';
97 };
98 };
99}