Change:
My paperless-ngx install has been broken for some time; it looks like paperless-scheduler.service fails to start, which means that paperless-consumer.service and paperless-web.service can't run: I don't have any idea at all how to debug this, sorry. Steps to reproduce the behavior: paperless should work! <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --paperless-ngx maintainers: nixos/paperless maintainers: Please run and paste the result.
+1 habe die selbe fehlermeldung
Here's the .
Will try to find this later, or do you want to do that
Probably caused by the latest systemd update and something in the mount-sandboxing does not work as expected anymore.
The more invasive fix is to set . I actually don't know whether this a regression in systemd or intented. Also there's surely a better fix (maybe with the new systemd option ?), so what should we do?

Discussion:
# Secure the services defaultServiceConfig = { <del> TemporaryFileSystem = "/:ro"; BindReadOnlyPaths = [ "/nix/store" "-/etc/resolv.conf" "-/etc/nsswitch.conf" "-/etc/hosts" "-/etc/localtime" "-/etc/ssl/certs" "-/etc/static/ssl/certs" "-/run/postgresql" ] ++ (optional enableRedis redisServer.unixSocket); BindPaths = [ </del> <ins> ReadWritePaths = [ </ins> cfg.consumptionDir cfg.dataDir cfg.mediaDir

PrivateUsers = true; ProtectClock = true; # Breaks if the home dir of the user is in /home <del> # Also does not add much value in combination with the TemporaryFileSystem. </del> # ProtectHome = true; ProtectHostname = true; <del> # Would re-mount paths ignored by temporary root #ProtectSystem = "strict"; </del> <ins> ProtectSystem = "strict"; </ins> ProtectControlGroups = true; ProtectKernelLogs = true; ProtectKernelModules = true;

Type = "oneshot"; # Enable internet access PrivateNetwork = false; <del> # Restrict write access BindPaths = []; BindReadOnlyPaths = [ "/nix/store" "-/etc/resolv.conf" "-/etc/nsswitch.conf" "-/etc/ssl/certs" "-/etc/static/ssl/certs" "-/etc/hosts" "-/etc/localtime" ]; </del> ExecStart = let pythonWithNltk = pkg.python.withPackages (ps: [ ps.nltk ]); in '' ${pythonWithNltk}/bin/python -m nltk.downloader -d '${nltkDir}' punkt snowball_data stopwords '';

name = "paperless"; meta.maintainers = with lib.maintainers; [ erikarvstedt Flakebi ]; <del> nodes.machine = { pkgs, ... }: { environment.systemPackages = with pkgs; [ imagemagick jq ]; services.paperless = { enable = true; passwordFile = builtins.toFile "password" "admin"; </del> <ins> nodes = let self = { simple = { pkgs, ... }: { environment.systemPackages = with pkgs; [ imagemagick jq ]; services.paperless = { enable = true; passwordFile = builtins.toFile "password" "admin"; }; </ins> }; <del> }; </del> <ins> postgres = { config, pkgs, ... }: { imports = [ self.simple ]; services.postgresql = { enable = true; ensureDatabases = [ "paperless" ]; ensureUsers = [ { name = config.services.paperless.user; ensurePermissions = { "DATABASE "paperless"" = "ALL PRIVILEGES"; }; } ]; }; services.paperless.extraConfig = { PAPERLESS_DBHOST = "/run/postgresql"; }; }; }; in self; </ins> testScript = '' import json <del> machine.wait_for_unit("paperless-consumer.service") </del> <ins> def test_paperless(node): node.wait_for_unit("paperless-consumer.service") </ins> <del> with subtest("Add a document via the file system"): machine.succeed( "convert -size 400x40 xc:white -font 'DejaVu-Sans' -pointsize 20 -fill black " "-annotate +5+20 'hello world 16-10-2005' /var/lib/paperless/consume/doc.png" </del> <ins> with subtest("Add a document via the file system"): node.succeed( "convert -size 400x40 xc:white -font 'DejaVu-Sans' -pointsize 20 -fill black " "-annotate +5+20 'hello world 16-10-2005' /var/lib/paperless/consume/doc.png" </ins> ) <del> with subtest("Web interface gets ready"): machine.wait_for_unit("paperless-web.service") </del> <ins> with subtest("Web interface gets ready"): node.wait_for_unit("paperless-web.service") </ins> # Wait until server accepts connections <del> machine.wait_until_succeeds("curl -fs localhost:28981") </del> <ins> node.wait_until_succeeds("curl -fs localhost:28981") </ins> <del> # Required for consuming documents via the web interface with subtest("Task-queue gets ready"): machine.wait_for_unit("paperless-task-queue.service") </del> <ins> # Required for consuming documents via the web interface with subtest("Task-queue gets ready"): node.wait_for_unit("paperless-task-queue.service") </ins> <del> with subtest("Add a png document via the web interface"): machine.succeed( "convert -size 400x40 xc:white -font 'DejaVu-Sans' -pointsize 20 -fill black " "-annotate +5+20 'hello web 16-10-2005' /tmp/webdoc.png" </del> <ins> with subtest("Add a png document via the web interface"): node.succeed( "convert -size 400x40 xc:white -font 'DejaVu-Sans' -pointsize 20 -fill black " "-annotate +5+20 'hello web 16-10-2005' /tmp/webdoc.png" </ins> ) <del> machine.wait_until_succeeds("curl -u admin:admin -F document=@/tmp/webdoc.png -fs localhost:28981/api/documents/post_document/") </del> <ins> node.wait_until_succeeds("curl -u admin:admin -F document=@/tmp/webdoc.png -fs localhost:28981/api/documents/post_document/") </ins> <del> with subtest("Add a txt document via the web interface"): machine.succeed( "echo 'hello web 16-10-2005' > /tmp/webdoc.txt" </del> <ins> with subtest("Add a txt document via the web interface"): node.succeed( "echo 'hello web 16-10-2005' > /tmp/webdoc.txt" </ins> ) <del> machine.wait_until_succeeds("curl -u admin:admin -F document=@/tmp/webdoc.txt -fs localhost:28981/api/documents/post_document/") </del> <ins> node.wait_until_succeeds("curl -u admin:admin -F document=@/tmp/webdoc.txt -fs localhost:28981/api/documents/post_document/") </ins> <del> with subtest("Documents are consumed"): machine.wait_until_succeeds( "(($(curl -u admin:admin -fs localhost:28981/api/documents/ | jq .count) == 3))" </del> <ins> with subtest("Documents are consumed"): node.wait_until_succeeds( "(($(curl -u admin:admin -fs localhost:28981/api/documents/ | jq .count) == 3))" </ins> ) <del> docs = json.loads(machine.succeed("curl -u admin:admin -fs localhost:28981/api/documents/"))['results'] </del> <ins> docs = json.loads(node.succeed("curl -u admin:admin -fs localhost:28981/api/documents/"))['results'] </ins> assert "2005-10-16" in docs[0]['created'] assert "2005-10-16" in docs[1]['created'] assert "2005-10-16" in docs[2]['created'] <del> # Detects gunicorn issues, see PR #190888 with subtest("Document metadata can be accessed"): metadata = json.loads(machine.succeed("curl -u admin:admin -fs localhost:28981/api/documents/1/metadata/")) </del> <ins> # Detects gunicorn issues, see PR #190888 with subtest("Document metadata can be accessed"): metadata = json.loads(node.succeed("curl -u admin:admin -fs localhost:28981/api/documents/1/metadata/")) </ins> assert "original_checksum" in metadata <del> metadata = json.loads(machine.succeed("curl -u admin:admin -fs localhost:28981/api/documents/2/metadata/")) </del> <ins> metadata = json.loads(node.succeed("curl -u admin:admin -fs localhost:28981/api/documents/2/metadata/")) </ins> assert "original_checksum" in metadata <del> metadata = json.loads(machine.succeed("curl -u admin:admin -fs localhost:28981/api/documents/3/metadata/")) </del> <ins> metadata = json.loads(node.succeed("curl -u admin:admin -fs localhost:28981/api/documents/3/metadata/")) </ins> assert "original_checksum" in metadata <ins> test_paperless(simple) simple.send_monitor_command("quit") simple.wait_for_shutdown() test_paperless(postgres) </ins> ''; })