fix: secret key, database migration and private redis (for fjord 0.3.1)

compose.yaml

@@ -12,6 +12,13 @@ x-daemonless:
   mlock: false
   community: "Discord:https://discord.gg/Kb9tkhecZT"
   upstream_binary: true
+  # paperless is the one people open; redis stays on the stack's private
+  # network, where paperless finds it by the name fjord puts in REDIS_HOSTNAME.
+  networking:
+    paperlessngx: default
+    "*": private
+  hostnames:
+    redis: REDIS_HOSTNAME
   # Redis sidecar for the AppJail director bundle; host networking so
   # paperless reaches it on localhost, as under podman.
   appjail:
@@ -20,7 +27,7 @@ x-daemonless:
         - alias:
         - ip4_inherit:
     depends_on:
-      - name: paperless-redis
+      - name: redis
         image: ghcr.io/daemonless/redis:latest
         volumes:
           redis_data: /config
@@ -35,6 +42,10 @@ x-daemonless:
         desc: "Optional separate document store (originals, archive, thumbnails), e.g. its own ZFS filesystem"
         optional: true
       REDIS_DATA_LOCATION: "Path to store the redis data"
+      REDIS_HOSTNAME:
+        desc: "Where paperless finds redis (fjord sets this; localhost on host networking)"
+        level: advanced
+        optional: true
       PAPERLESS_ADMIN_USER:
         desc: "Set name of the admin user on first start"
         optional: true
@@ -94,7 +105,7 @@ services:
       - PUID=1000
       - PGID=1000
       - TZ=${TZ:-UTC}
-      - PAPERLESS_REDIS=redis://localhost:6379
+      - PAPERLESS_REDIS=redis://${REDIS_HOSTNAME:-localhost}:6379
       - PAPERLESS_ADMIN_USER=${PAPERLESS_ADMIN_USER}
       - PAPERLESS_ADMIN_PASSWORD=${PAPERLESS_ADMIN_PASSWORD}
 

root/etc/cont-init.d/20-paperlessngx

@@ -5,14 +5,17 @@
 mkdir -p /config/consume /config/data /config/media
 chown -R bsd:bsd /config
 
+. /etc/paperless-secret-key
+
 # Run a DB migration to make sure the database is initialized
-# and updated to the latest schema.
+# and updated to the latest schema. The venv's python, not `uv run`: uv
+# wants /app/wheels, which the build prunes, and the migration never ran.
 echo [paperlessngx-migration] Running DB migration
-s6-setuidgid bsd cd /app/src/src uv run python manage.py migrate
+s6-setuidgid bsd cd /app/src/src /app/venv/bin/python manage.py migrate
 
 # Create superuser if env variable is defined
 if [ "x${PAPERLESS_ADMIN_USER}" != "x" ]; then
-  s6-setuidgid bsd cd /app/src/src uv run python manage.py manage_superuser
+  s6-setuidgid bsd cd /app/src/src /app/venv/bin/python manage.py manage_superuser
 
   echo "[paperlessngx-superuser] Superuser creation done"
 

root/etc/paperless-secret-key

@@ -0,0 +1,15 @@
+# Sourced by the init script and every service: paperless 3.3 refuses to start
+# without PAPERLESS_SECRET_KEY. Yours wins when set; otherwise one is made on
+# first start and kept with the data, so sessions survive a recreate.
+key_file=/config/data/.secret_key
+if [ -z "${PAPERLESS_SECRET_KEY}" ] || [ "${PAPERLESS_SECRET_KEY}" = "change-me" ]; then
+    if [ ! -s "${key_file}" ]; then
+        mkdir -p /config/data
+        /app/venv/bin/python -c 'import secrets; print(secrets.token_urlsafe(50))' > "${key_file}"
+        chmod 600 "${key_file}"
+        chown bsd:bsd "${key_file}"
+        echo "[paperlessngx] Generated PAPERLESS_SECRET_KEY in ${key_file}"
+    fi
+    PAPERLESS_SECRET_KEY=$(cat "${key_file}")
+fi
+export PAPERLESS_SECRET_KEY

root/etc/services.d/consumer/run

@@ -7,6 +7,7 @@ echo "${log_prefix} Starting consumer..."
 
 HOME=/config; export HOME
 LANG=en_US.UTF-8; export LANG
+. /etc/paperless-secret-key
 
 # Standard start command for consumer
 exec /usr/local/bin/s6-setuidgid bsd cd /app/src/src \

root/etc/services.d/flower/run

@@ -7,6 +7,7 @@ echo "${log_prefix} Starting flower..."
 
 HOME=/config; export HOME
 LANG=en_US.UTF-8; export LANG
+. /etc/paperless-secret-key
 
 # Standard start command for paperless-ngx
 if [ "x${PAPERLESS_ENABLE_FLOWER}" != "x" ]; then

root/etc/services.d/paperlessngx/run

@@ -7,6 +7,7 @@ echo "${log_prefix} Starting paperless-ngx..."
 
 HOME=/config; export HOME
 LANG=en_US.UTF-8; export LANG
+. /etc/paperless-secret-key
 
 # Standard start command for paperless-ngx
 exec /usr/local/bin/s6-notifyoncheck -c /healthz /usr/local/bin/s6-setuidgid bsd \

root/etc/services.d/scheduler/run

@@ -7,6 +7,7 @@ echo "${log_prefix} Starting schduler..."
 
 HOME=/config; export HOME
 LANG=en_US.UTF-8; export LANG
+. /etc/paperless-secret-key
 
 # Standard start command for scheduler
 #/usr/local/bin/s6-notifyoncheck -c /healthz /usr/local/bin/s6-setuidgid bsd

root/etc/services.d/worker/run

@@ -7,6 +7,7 @@ echo "${log_prefix} Starting worker..."
 
 HOME=/config; export HOME
 LANG=en_US.UTF-8; export LANG
+. /etc/paperless-secret-key
 
 # Standard start command for worker
 #/usr/local/bin/s6-notifyoncheck -c /healthz /usr/local/bin/s6-setuidgid bsd