This repository has no description
1{ config, pkgs, ... }:
2let
3 domain = "paperless.lassul.us";
4 cfg = config.services.paperless;
5 zitadelEnv = config.lass.zitadel.projects.paperless.apps.web.envFile.path;
6 oidcEnv = "/run/paperless-oidc/oidc.env";
7 paperlessServices = [
8 "paperless-secret-key.service"
9 "paperless-scheduler.service"
10 "paperless-task-queue.service"
11 "paperless-consumer.service"
12 "paperless-web.service"
13 ];
14in
15{
16 clan.core.vars.generators.paperless-admin = {
17 files."password" = { };
18 runtimeInputs = with pkgs; [
19 coreutils
20 pwgen
21 ];
22 script = ''
23 pwgen -s 32 1 | tr -d '\n' > "$out/password"
24 '';
25 };
26
27 services.paperless = {
28 enable = true;
29 inherit domain;
30 passwordFile = config.clan.core.vars.generators.paperless-admin.files."password".path;
31 environmentFile = oidcEnv;
32 settings = {
33 PAPERLESS_OCR_LANGUAGE = "deu+eng";
34 PAPERLESS_TIME_ZONE = "Europe/Berlin";
35 PAPERLESS_APPS = "allauth.socialaccount.providers.openid_connect";
36 PAPERLESS_SOCIAL_AUTO_SIGNUP = true;
37 # only the login form; API tokens and basic auth keep working
38 PAPERLESS_DISABLE_REGULAR_LOGIN = true;
39 };
40 };
41
42 # documents, index and classifier; the SQLite database is dumped
43 # consistently instead of copied
44 lass.backup.state.paperless = {
45 folders = [ "/var/lib/paperless" ];
46 exclude = [ "/var/lib/paperless/db.sqlite3*" ];
47 preBackup = ''
48 ${pkgs.sqlite}/bin/sqlite3 -cmd ".timeout 60000" /var/lib/paperless/db.sqlite3 ".backup /var/backup/paperless.sqlite3"
49 '';
50 # WAL-mode SQLite readers need to write the -shm file
51 readWritePaths = [ "/var/lib/paperless" ];
52 };
53
54 # Zitadel (id.lassul.us) login, only for users with a grant on the project.
55 # zitadel-reconcile writes the client id/secret to zitadelEnv.
56 lass.zitadel.projects.paperless = {
57 access = "declarative";
58 users = [ "lass@lassul.us" ];
59 apps.web = {
60 redirectUris = [ "https://${domain}/accounts/oidc/zitadel/login/callback/" ];
61 authMethod = "post";
62 };
63 };
64
65 # Builds PAPERLESS_SOCIALACCOUNT_PROVIDERS with the client secret into
66 # oidcEnv, the paperless environmentFile. Accounts are keyed by `sub`.
67 systemd.services.paperless-oidc-env = {
68 wants = [ "zitadel-reconcile.service" ];
69 after = [ "zitadel-reconcile.service" ];
70 before = paperlessServices;
71 requiredBy = paperlessServices;
72 path = [ pkgs.jq ];
73 serviceConfig = {
74 Type = "oneshot";
75 RemainAfterExit = true;
76 RuntimeDirectory = "paperless-oidc";
77 RuntimeDirectoryMode = "0700";
78 RuntimeDirectoryPreserve = true;
79 UMask = "0077";
80 EnvironmentFile = zitadelEnv;
81 };
82 script = ''
83 providers=$(jq -nc '{openid_connect: {APPS: [{
84 provider_id: "zitadel",
85 name: "lassul.us ID",
86 client_id: env.CLIENT_ID,
87 secret: env.CLIENT_SECRET,
88 settings: {
89 server_url: "https://id.lassul.us",
90 token_auth_method: "client_secret_post",
91 uid_field: "sub"
92 }
93 }]}}')
94 printf "PAPERLESS_SOCIALACCOUNT_PROVIDERS='%s'\n" "$providers" > ${oidcEnv}.tmp
95 mv ${oidcEnv}.tmp ${oidcEnv}
96 '';
97 };
98
99 services.nginx.virtualHosts.${domain} = {
100 enableACME = true;
101 forceSSL = true;
102 locations."/" = {
103 proxyPass = "http://${cfg.address}:${toString cfg.port}";
104 recommendedProxySettings = true;
105 proxyWebsockets = true;
106 extraConfig = ''
107 client_max_body_size 100M;
108 '';
109 };
110 };
111}