From e607c6fd98e6e4965055c8954618168588c5d212 Mon Sep 17 00:00:00 2001 From: Michael Johnson Date: Sat, 10 Oct 2026 19:19:45 -0400 Subject: [PATCH] fix: secret key, database migration and private redis (for fjord 0.3.1) --- compose.yaml | 15 +++++++++++++-- root/etc/cont-init.d/20-paperlessngx | 9 ++++++--- root/etc/paperless-secret-key | 15 +++++++++++++++ root/etc/services.d/consumer/run | 1 + root/etc/services.d/flower/run | 1 + root/etc/services.d/paperlessngx/run | 1 + root/etc/services.d/scheduler/run | 1 + root/etc/services.d/worker/run | 1 + 8 files changed, 39 insertions(+), 5 deletions(-) create mode 100644 root/etc/paperless-secret-key diff --git a/compose.yaml b/compose.yaml index 58b8c2b..afcdbc2 100644 --- a/compose.yaml +++ b/compose.yaml @@ -12,6 +12,13 @@ x-daemonless: mlock: false community: "Discord:https://discord.gg/Kb9tkhecZT" upstream_binary: true + # paperless is the one people open; redis stays on the stack's private + # network, where paperless finds it by the name fjord puts in REDIS_HOSTNAME. + networking: + paperlessngx: default + "*": private + hostnames: + redis: REDIS_HOSTNAME # Redis sidecar for the AppJail director bundle; host networking so # paperless reaches it on localhost, as under podman. appjail: @@ -20,7 +27,7 @@ x-daemonless: - alias: - ip4_inherit: depends_on: - - name: paperless-redis + - name: redis image: ghcr.io/daemonless/redis:latest volumes: redis_data: /config @@ -35,6 +42,10 @@ x-daemonless: desc: "Optional separate document store (originals, archive, thumbnails), e.g. its own ZFS filesystem" optional: true REDIS_DATA_LOCATION: "Path to store the redis data" + REDIS_HOSTNAME: + desc: "Where paperless finds redis (fjord sets this; localhost on host networking)" + level: advanced + optional: true PAPERLESS_ADMIN_USER: desc: "Set name of the admin user on first start" optional: true @@ -94,7 +105,7 @@ services: - PUID=1000 - PGID=1000 - TZ=${TZ:-UTC} - - PAPERLESS_REDIS=redis://localhost:6379 + - PAPERLESS_REDIS=redis://${REDIS_HOSTNAME:-localhost}:6379 - PAPERLESS_ADMIN_USER=${PAPERLESS_ADMIN_USER} - PAPERLESS_ADMIN_PASSWORD=${PAPERLESS_ADMIN_PASSWORD} diff --git a/root/etc/cont-init.d/20-paperlessngx b/root/etc/cont-init.d/20-paperlessngx index f985a36..58875e8 100644 --- a/root/etc/cont-init.d/20-paperlessngx +++ b/root/etc/cont-init.d/20-paperlessngx @@ -5,14 +5,17 @@ mkdir -p /config/consume /config/data /config/media chown -R bsd:bsd /config +. /etc/paperless-secret-key + # Run a DB migration to make sure the database is initialized -# and updated to the latest schema. +# and updated to the latest schema. The venv's python, not `uv run`: uv +# wants /app/wheels, which the build prunes, and the migration never ran. echo [paperlessngx-migration] Running DB migration -s6-setuidgid bsd cd /app/src/src uv run python manage.py migrate +s6-setuidgid bsd cd /app/src/src /app/venv/bin/python manage.py migrate # Create superuser if env variable is defined if [ "x${PAPERLESS_ADMIN_USER}" != "x" ]; then - s6-setuidgid bsd cd /app/src/src uv run python manage.py manage_superuser + s6-setuidgid bsd cd /app/src/src /app/venv/bin/python manage.py manage_superuser echo "[paperlessngx-superuser] Superuser creation done" diff --git a/root/etc/paperless-secret-key b/root/etc/paperless-secret-key new file mode 100644 index 0000000..e9de791 --- /dev/null +++ b/root/etc/paperless-secret-key @@ -0,0 +1,15 @@ +# Sourced by the init script and every service: paperless 3.3 refuses to start +# without PAPERLESS_SECRET_KEY. Yours wins when set; otherwise one is made on +# first start and kept with the data, so sessions survive a recreate. +key_file=/config/data/.secret_key +if [ -z "${PAPERLESS_SECRET_KEY}" ] || [ "${PAPERLESS_SECRET_KEY}" = "change-me" ]; then + if [ ! -s "${key_file}" ]; then + mkdir -p /config/data + /app/venv/bin/python -c 'import secrets; print(secrets.token_urlsafe(50))' > "${key_file}" + chmod 600 "${key_file}" + chown bsd:bsd "${key_file}" + echo "[paperlessngx] Generated PAPERLESS_SECRET_KEY in ${key_file}" + fi + PAPERLESS_SECRET_KEY=$(cat "${key_file}") +fi +export PAPERLESS_SECRET_KEY diff --git a/root/etc/services.d/consumer/run b/root/etc/services.d/consumer/run index 31ebe39..2b96af3 100644 --- a/root/etc/services.d/consumer/run +++ b/root/etc/services.d/consumer/run @@ -7,6 +7,7 @@ echo "${log_prefix} Starting consumer..." HOME=/config; export HOME LANG=en_US.UTF-8; export LANG +. /etc/paperless-secret-key # Standard start command for consumer exec /usr/local/bin/s6-setuidgid bsd cd /app/src/src \ diff --git a/root/etc/services.d/flower/run b/root/etc/services.d/flower/run index e0fe22b..298da8a 100644 --- a/root/etc/services.d/flower/run +++ b/root/etc/services.d/flower/run @@ -7,6 +7,7 @@ echo "${log_prefix} Starting flower..." HOME=/config; export HOME LANG=en_US.UTF-8; export LANG +. /etc/paperless-secret-key # Standard start command for paperless-ngx if [ "x${PAPERLESS_ENABLE_FLOWER}" != "x" ]; then diff --git a/root/etc/services.d/paperlessngx/run b/root/etc/services.d/paperlessngx/run index 068cf82..2ee29cb 100644 --- a/root/etc/services.d/paperlessngx/run +++ b/root/etc/services.d/paperlessngx/run @@ -7,6 +7,7 @@ echo "${log_prefix} Starting paperless-ngx..." HOME=/config; export HOME LANG=en_US.UTF-8; export LANG +. /etc/paperless-secret-key # Standard start command for paperless-ngx exec /usr/local/bin/s6-notifyoncheck -c /healthz /usr/local/bin/s6-setuidgid bsd \ diff --git a/root/etc/services.d/scheduler/run b/root/etc/services.d/scheduler/run index e7f851e..52e078b 100644 --- a/root/etc/services.d/scheduler/run +++ b/root/etc/services.d/scheduler/run @@ -7,6 +7,7 @@ echo "${log_prefix} Starting schduler..." HOME=/config; export HOME LANG=en_US.UTF-8; export LANG +. /etc/paperless-secret-key # Standard start command for scheduler #/usr/local/bin/s6-notifyoncheck -c /healthz /usr/local/bin/s6-setuidgid bsd diff --git a/root/etc/services.d/worker/run b/root/etc/services.d/worker/run index 7ac2fa3..4ced708 100644 --- a/root/etc/services.d/worker/run +++ b/root/etc/services.d/worker/run @@ -7,6 +7,7 @@ echo "${log_prefix} Starting worker..." HOME=/config; export HOME LANG=en_US.UTF-8; export LANG +. /etc/paperless-secret-key # Standard start command for worker #/usr/local/bin/s6-notifyoncheck -c /healthz /usr/local/bin/s6-setuidgid bsd