Repository: paperless-ngx/paperless-ngx

Issue:
[BUG] ALLOWED_HOSTS set to [PAPERLESS_URL, "localhost"] despite PAPERLESS_ALLOWED_HOSTS=* causing K8s healthchecks from Pod IP to fail
### Description

## Problem
My deployment of `paperless-ngx` runs on Kubernetes with the following health check configuration:
```yaml
        startupProbe:
          tcpSocket:
            port: http
          failureThreshold: 6
        livenessProbe:
          httpGet:
            port: http
        readinessProbe:
          httpGet:
            port: http
```

However, upon upgrading to `1.14.0`, the health `livenessProbes` started failing, with the logs throwing this message:

```
django.core.exceptions.DisallowedHost: Invalid HTTP_HOST header: '10.42.8.201:8000'. You may need to add '10.42.8.201' to ALLOWED_HOSTS.
```

### Context
Pod IP is NOT resolved to `localhost` but rather resolved to the pod name.

## Root cause
On inspecting the settings with:
```bash
python manage.py diffsettings --all
```

I see the following:
```python
ALLOWED_HOSTS = ['paperless.example.com', 'localhost']
```

But running the `env` command, I have this relevant line:
```bash
PAPERLESS_ALLOWED_HOSTS=*
```

### Digging into the code

https://github.com/paperless-ngx/paperless-ngx/blob/6c658a676e9b5697a408355f964e526b17692ddb/src/paperless/settings.py#L406-L414

has changed to:

https://github.com/paperless-ngx/paperless-ngx/blob/7f74a854001b9362eac27a4c9cfce3e1ed59516e/src/paperless/settings.py#L421-L429

This means that if both `PAPERLESS_URL` is defined and `PAPERLESS_ALLOWED_HOSTS` were to be set to the default of `["*"]`, this block will be **skipped**:
https://github.com/paperless-ngx/paperless-ngx/blob/7f74a854001b9362eac27a4c9cfce3e1ed59516e/src/paperless/settings.py#L425-L426

and the `else` block is invoked instead, where `ALLOWED_HOSTS` is enforced to [`PAPERLESS_URL`, `localhost`], ignoring the `"*"` value:
https://github.com/paperless-ngx/paperless-ngx/blob/7f74a854001b9362eac27a4c9cfce3e1ed59516e/src/paperless/settings.py#L427-L429

## Solution
I think the correct logic is to unindent the entire block from the `if paperless_url`:
1. If `ALLOWED_HOSTS` = ["*"], don't need to conditionally set it any further
2. If `ALLOWED_HOST` != ["*"]: Append localhost
3. If `ALLOWED_HOSTS` != ["*"], and `PAPERLESS_URL` is defined: Append [`PAPERLESS_URL`, `localhost`] to `ALLOWED_HOSTS`





### Steps to reproduce

1. Set PAPERLESS_ALLOWED_HOSTS=* environment variable
2. Set livenessProbe to the container port with `httpGet` as type
3. Pod restarts infinitely as liveness probe will always fail

### Webserver logs

```bash
django.core.exceptions.DisallowedHost: Invalid HTTP_HOST header: '10.42.8.201:8000'. You may need to add '10.42.8.201' to ALLOWED_HOSTS.
```
```


### Browser logs

_No response_

### Paperless-ngx version

1.14.1

### Host OS

Docker container

### Installation method

Docker - official image

### Browser

_No response_

### Configuration changes

_No response_

### Other

_No response_


Discussion:
I can open a PR for this later today to propose the logic changes.
Sure, if you can open a PR, we'll probably have a .2 coming soon

Resolving patch:
diff --git a/src/paperless/settings.py b/src/paperless/settings.py
--- a/src/paperless/settings.py
+++ b/src/paperless/settings.py
@@ -422,11 +422,12 @@ def _parse_beat_schedule() -> Dict:
     _paperless_uri = urlparse(_paperless_url)
     CSRF_TRUSTED_ORIGINS.append(_paperless_url)
     CORS_ALLOWED_ORIGINS.append(_paperless_url)
-    if ["*"] != ALLOWED_HOSTS:
+
+if ["*"] != ALLOWED_HOSTS:
+    # always allow localhost. Necessary e.g. for healthcheck in docker.
+    ALLOWED_HOSTS.append("localhost")
+    if _paperless_url:
         ALLOWED_HOSTS.append(_paperless_uri.hostname)
-    else:
-        # always allow localhost. Necessary e.g. for healthcheck in docker.
-        ALLOWED_HOSTS = [_paperless_uri.hostname] + ["localhost"]
 
 # For use with trusted proxies
 TRUSTED_PROXIES = __get_list("PAPERLESS_TRUSTED_PROXIES")


Test patch: