diff options
author | Leona Maroni <dev@leona.is> | 2023-10-04 22:03:18 +0200 |
---|---|---|
committer | Leona Maroni <dev@leona.is> | 2023-10-05 12:56:37 +0200 |
commit | 6249a0983d1fba22ff629aaabaea172432f83cf9 (patch) | |
tree | 0d428b97535ca4375b164594ef124850f8d690dd /nixos/modules/services/misc/paperless.nix | |
parent | e0b78ab95b4b23fa4395ff7a93ccff3a14353616 (diff) | |
download | nixpkgs-6249a0983d1fba22ff629aaabaea172432f83cf9.tar nixpkgs-6249a0983d1fba22ff629aaabaea172432f83cf9.tar.gz nixpkgs-6249a0983d1fba22ff629aaabaea172432f83cf9.tar.bz2 nixpkgs-6249a0983d1fba22ff629aaabaea172432f83cf9.tar.lz nixpkgs-6249a0983d1fba22ff629aaabaea172432f83cf9.tar.xz nixpkgs-6249a0983d1fba22ff629aaabaea172432f83cf9.tar.zst nixpkgs-6249a0983d1fba22ff629aaabaea172432f83cf9.zip |
nixos/paperless: fix start with latest systemd
Diffstat (limited to 'nixos/modules/services/misc/paperless.nix')
-rw-r--r-- | nixos/modules/services/misc/paperless.nix | 28 |
1 files changed, 2 insertions, 26 deletions
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix index 74a3b49ac9a..9b8bd62809c 100644 --- a/nixos/modules/services/misc/paperless.nix +++ b/nixos/modules/services/misc/paperless.nix @@ -36,18 +36,7 @@ let # Secure the services defaultServiceConfig = { - TemporaryFileSystem = "/:ro"; - BindReadOnlyPaths = [ - "/nix/store" - "-/etc/resolv.conf" - "-/etc/nsswitch.conf" - "-/etc/hosts" - "-/etc/localtime" - "-/etc/ssl/certs" - "-/etc/static/ssl/certs" - "-/run/postgresql" - ] ++ (optional enableRedis redisServer.unixSocket); - BindPaths = [ + ReadWritePaths = [ cfg.consumptionDir cfg.dataDir cfg.mediaDir @@ -66,11 +55,9 @@ let PrivateUsers = true; ProtectClock = true; # Breaks if the home dir of the user is in /home - # Also does not add much value in combination with the TemporaryFileSystem. # ProtectHome = true; ProtectHostname = true; - # Would re-mount paths ignored by temporary root - #ProtectSystem = "strict"; + ProtectSystem = "strict"; ProtectControlGroups = true; ProtectKernelLogs = true; ProtectKernelModules = true; @@ -319,17 +306,6 @@ in Type = "oneshot"; # Enable internet access PrivateNetwork = false; - # Restrict write access - BindPaths = []; - BindReadOnlyPaths = [ - "/nix/store" - "-/etc/resolv.conf" - "-/etc/nsswitch.conf" - "-/etc/ssl/certs" - "-/etc/static/ssl/certs" - "-/etc/hosts" - "-/etc/localtime" - ]; ExecStart = let pythonWithNltk = pkg.python.withPackages (ps: [ ps.nltk ]); in '' ${pythonWithNltk}/bin/python -m nltk.downloader -d '${nltkDir}' punkt snowball_data stopwords ''; |