Repository: paperless-ngx/paperless-ngx

Issue:
[BUG] Healthcheck error with 1.7.0-rc1
### Description

After upgrade to 1.7.0-rc1 the docker healthcheck is no longer working

    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000"]

I assume this is connected to https://github.com/paperless-ngx/paperless-ngx/pull/674

### Expected behavior

Healthcheck working, to see that container is alive

### Steps to reproduce

Update to 1.7.0-rc1 using healthcheck as documented in https://github.com/paperless-ngx/paperless-ngx/blob/main/docker/compose/docker-compose.portainer.yml

    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000"]
      interval: 30s
      timeout: 10s
      retries: 5

### Webserver logs

```bash
[2022-04-12 10:36:56,641] [ERROR] [django.security.DisallowedHost] Invalid HTTP_HOST header: 'localhost:8000'. You may need to add 'localhost' to ALLOWED_HOSTS.
[2022-04-12 10:36:56,673] [WARNING] [django.request] Bad Request: /
```


### Screenshots

_No response_

### Paperless-ngx version

1.7.0-rc1

### Host OS

Synology DSM 7.1

### Installation method

Docker

### Browser

Edge

### Configuration changes

No changes in docker compose regarding healthcheck, using standard healthcheck configuration as documented

### Other

_No response_


Discussion:
Cannot reproduce. 

docker-compose.env:
```
PAPERLESS_DEBUG=true
PAPERLESS_CONSUMER_ENABLE_BARCODES=True
```
docker-compose.yml:
```
version: "3.4"
services:
  broker:
    image: redis:6.0
    restart: unless-stopped

  webserver:
    image: ghcr.io/paperless-ngx/paperless-ngx:beta
    restart: unless-stopped
    depends_on:
      - broker
    ports:
      - 8000:8000
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000"]
      interval: 30s
      timeout: 10s
      retries: 5
    volumes:
      - data:/usr/src/paperless/data
      - media:/usr/src/paperless/media
      - ./export:/usr/src/paperless/export
      - ./consume:/usr/src/paperless/consume
    env_file: docker-compose.env
    environment:
      PAPERLESS_REDIS: redis://broker:6379

volumes:
  data:
  media:

networks:
  default:
    driver: bridge
    ipam:
      config:
        - subnet: 172.16.57.0/24
```
Notice: The network is due to OpenVPN and overlapping subnets. Shoudn't have any influence on the healthcheck.

Output of docker ps:
```
docker ps
CONTAINER ID   IMAGE                                      COMMAND                  CREATED         STATUS                   PORTS                                       NAMES
71a1cc80155e   ghcr.io/paperless-ngx/paperless-ngx:beta   "/sbin/docker-entryp…"   3 minutes ago   Up 3 minutes (healthy)   0.0.0.0:8000->8000/tcp, :::8000->8000/tcp   paperless-webserver-1
e73a6f385a98   redis:6.0                                  "docker-entrypoint.s…"   3 minutes ago   Up 3 minutes             6379/tcp                                    paperless-broker-1
```

Maybe you have `PAPERLESS_URL`, `PAPERLESS_CSRF_TRUSTED_ORIGINS`, `PAPERLESS_CORS_ALLOWED_HOSTS` or `PAPERLESS_ALLOWED_HOSTS` set somewhere?
Yes, I have set PAPERLESS_URL to the URL I am using for access in my internal network (using https://aaa.bbb.ccc format), since I otherwise could not logon at all. Without setting PAPERLESS_URL I receive a CSRF verification failed error, as described here: https://github.com/paperless-ngx/paperless-ngx/issues/670
That is the only change I did after updating to 1.7.0-rc1, and health check was working fine before

Update:
Just checked again the logs after removing PAPERLESS_URL again, and running 1.7.0-rc1 with same settings as 1.6.0 before
I get this error in browser
![image](https://user-images.githubusercontent.com/1678124/162950552-09880efa-ef27-43f7-bde5-29c87fb2203d.png)

and the following is shown in logs
[2022-04-12 13:27:05,860] [WARNING] [django.security.csrf] Forbidden (Origin checking failed - https://xxx.xxxx.de does not match any trusted origins.): /accounts/login/

But healthcheck is running fine in that case, so it is somehow linked

Ok. did you set any of the others?
If not, I suggest:

1. Set PAPERLESS_URL to your https://aaa.bbb.ccc/ format
2. Set `PAPERLESS_ALLOWED_HOSTS` to `localhost`

`PAPERLESS_URL` will append itself to `PAPERLESS_ALLOWED_HOSTS` 

If no PAPERLESS_URL would've been set, `ALLOWED_HOSTS` would default to `"*"`. If this helps, we should add `localhost`to the default `ALLOWED_HOSTS`
No, I did not set any of the others so far
Did as you suggested (PAPERLESS_URL set to the URL I am using, PAPERLESS_ALLOWED_HOSTS set to localhost) and now everything looks good again =)

Resolving patch:
diff --git a/src/paperless/settings.py b/src/paperless/settings.py
--- a/src/paperless/settings.py
+++ b/src/paperless/settings.py
@@ -251,7 +251,8 @@ def __get_int(key: str, default: int) -> int:
     if _allowed_hosts:
         ALLOWED_HOSTS.append(_paperless_uri.hostname)
     else:
-        ALLOWED_HOSTS = [_paperless_uri.hostname]
+        # always allow localhost. Necessary e.g. for healthcheck in docker.
+        ALLOWED_HOSTS = [_paperless_uri.hostname] + ["localhost"]
 
 # The secret key has a default that should be fine so long as you're hosting
 # Paperless on a closed network.  However, if you're putting this anywhere


Test patch: