From 516cbd4ae70a93865f24f1963e058f495c0ff748 Mon Sep 17 00:00:00 2001
From: Antoine Martin <antoine@alarsyo.net>
Date: Wed, 22 Dec 2021 19:17:16 +0100
Subject: [PATCH] services: paperless: switch from docker to nixos

---
 secrets/default.nix                      |   1 +
 secrets/paperless/admin-password.secret  | Bin 0 -> 87 bytes
 secrets/paperless/default.nix            |   5 ++
 secrets/paperless/secret-key-file.secret | Bin 0 -> 151 bytes
 services/paperless.nix                   |  66 +++++++++++++++++++----
 5 files changed, 61 insertions(+), 11 deletions(-)
 create mode 100644 secrets/paperless/admin-password.secret
 create mode 100644 secrets/paperless/default.nix
 create mode 100644 secrets/paperless/secret-key-file.secret

diff --git a/secrets/default.nix b/secrets/default.nix
index 59df0a1..4b7baca 100644
--- a/secrets/default.nix
+++ b/secrets/default.nix
@@ -17,6 +17,7 @@ with lib;
     gandiKey = lib.fileContents ./gandi-api-key.secret;
 
     borg-backup = import ./borg-backup { inherit lib; };
+    paperless = import ./paperless { inherit lib; };
     restic-backup = import ./restic-backup { inherit lib; };
 
     matrixEmailConfig = import ./matrix-email-config.nix;
diff --git a/secrets/paperless/admin-password.secret b/secrets/paperless/admin-password.secret
new file mode 100644
index 0000000000000000000000000000000000000000..e8111fc9ea28556e37773cbec45b9a3f61b4118f
GIT binary patch
literal 87
zcmV-d0I2@}M@dveQdv+`00A9Baq((8KdvUdH2<VCw0=Qem<DM2J+J?dR)<jdd8HWw
tly`rTrhu>**?KY^P;ZVk>*pmd>$YVT`QwN;;SeOg8=l)G@{d_g@SZquC#nDd

literal 0
HcmV?d00001

diff --git a/secrets/paperless/default.nix b/secrets/paperless/default.nix
new file mode 100644
index 0000000..968404d
--- /dev/null
+++ b/secrets/paperless/default.nix
@@ -0,0 +1,5 @@
+{ lib }:
+{
+  secretKey = lib.fileContents ./secret-key-file.secret;
+  adminPassword = lib.fileContents ./admin-password.secret;
+}
diff --git a/secrets/paperless/secret-key-file.secret b/secrets/paperless/secret-key-file.secret
new file mode 100644
index 0000000000000000000000000000000000000000..1f447d4d4e63202dfa9a7aa672ec3da4e9608db2
GIT binary patch
literal 151
zcmV;I0BHXJM@dveQdv+`0JGs>o5k!=WhU&LHozG%$M={|C_KH;@e4!KlFx20way@g
zD~LI{4wb>gBXDPrTo*9If%F_u$UeAuSUGWV^(NyDtv3*7oL2VxK<?~@{e*(PwS+2M
zbc@6{P5f%bF&~Q8O__*SN|R_(g!<gt*((eFHyP)V02he>z{U2;E&A<?^|Gm?Z$DFs
FXxL?aOQHY(

literal 0
HcmV?d00001

diff --git a/services/paperless.nix b/services/paperless.nix
index 5a970b4..d358a6a 100644
--- a/services/paperless.nix
+++ b/services/paperless.nix
@@ -6,6 +6,8 @@ let
   cfg = config.my.services.paperless;
   my = config.my;
   domain = config.networking.domain;
+  paperlessDomain = "paperless.${domain}";
+  secretKeyFile = pkgs.writeText "paperless-secret-key-file.env" my.secrets.paperless.secretKey;
 in
 {
   options.my.services.paperless = {
@@ -20,16 +22,59 @@ in
   };
 
   config = mkIf cfg.enable {
-    # HACK: see https://github.com/NixOS/nixpkgs/issues/111852
-    networking.firewall.extraCommands = ''
-      iptables -N DOCKER-USER || true
-      iptables -F DOCKER-USER
-      iptables -A DOCKER-USER -i eno1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-      iptables -A DOCKER-USER -i eno1 -j DROP
-    '';
+    services.paperless-ng = {
+      enable = true;
+      port = cfg.port;
+      passwordFile = pkgs.writeText "paperless-password-file.txt" config.my.secrets.paperless.adminPassword;
+      extraConfig = {
+        # Postgres settings
+        PAPERLESS_DBHOST = "/run/postgresql";
+        PAPERLESS_DBUSER = "paperless";
+        PAPERLESS_DBNAME = "paperless";
+
+        PAPERLESS_ALLOWED_HOSTS = paperlessDomain;
+        PAPERLESS_CORS_ALLOWED_HOSTS = "https://${paperlessDomain}";
+
+        PAPERLESS_OCR_LANGUAGE = "fra+eng";
+
+        PAPERLESS_TIME_ZONE = config.time.timeZone;
+
+        PAPERLESS_ADMIN_USER = "alarsyo";
+      };
+    };
+
+    systemd.services = {
+      paperless-ng-server.serviceConfig = {
+        EnvironmentFile = secretKeyFile;
+      };
+
+      paperless-ng-consumer.serviceConfig = {
+        EnvironmentFile = secretKeyFile;
+      };
+
+      paperless-ng-web.serviceConfig = {
+        EnvironmentFile = secretKeyFile;
+      };
+    };
+
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = [ "paperless" ];
+      ensureUsers = [
+        {
+          name = "paperless";
+          ensurePermissions."DATABASE paperless" = "ALL PRIVILEGES";
+        }
+      ];
+    };
+
+    systemd.services.paperless-ng-server = {
+      # Make sure the DB is available
+      after = [ "postgresql.service" ];
+    };
 
     services.nginx.virtualHosts = {
-      "paperless.${domain}" = {
+      "${paperlessDomain}" = {
         forceSSL = true;
         useACMEHost = domain;
 
@@ -56,9 +101,8 @@ in
 
     my.services.restic-backup = mkIf cfg.enable {
       paths = [
-        "/var/lib/docker/volumes/paperless_data"
-        "/var/lib/docker/volumes/paperless_media"
-        "/home/alarsyo/paperless-ng/backups"
+        config.services.paperless-ng.dataDir
+        config.services.paperless-ng.mediaDir
       ];
     };
   };