From fd2215b20c295a5c914822599a50533439d39880 Mon Sep 17 00:00:00 2001
From: Martin Wurm <martin.wurm@mart-w.de>
Date: Thu, 17 Mar 2022 19:35:20 +0100
Subject: nixos/paperless-ng: fix #164615

Add an exception to the `paperless-ng-server` service's
`SystemCallFilter` as the `mbind` syscall is needed when consuming a
document while having a classification model present.
---
 nixos/modules/services/misc/paperless-ng.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/services/misc/paperless-ng.nix b/nixos/modules/services/misc/paperless-ng.nix
index 44efc234a2b..11e44f5ece5 100644
--- a/nixos/modules/services/misc/paperless-ng.nix
+++ b/nixos/modules/services/misc/paperless-ng.nix
@@ -214,6 +214,8 @@ in
         User = cfg.user;
         ExecStart = "${cfg.package}/bin/paperless-ng qcluster";
         Restart = "on-failure";
+        # The `mbind` syscall is needed for running the classifier.
+        SystemCallFilter = defaultServiceConfig.SystemCallFilter ++ [ "mbind" ];
       };
       environment = env;
       wantedBy = [ "multi-user.target" ];
-- 
cgit 1.4.1