Change:
I want to use but with and residing on an NFS mounted path. My NFS server is secured to only allow access from . I also have enabled on my NFS server, as is the recommended best practice. But the paperless module uses tmpfiles to ensure those directories are created, but root does not have permission to create files in the nfs share. Result: To be clear the nfs mounted path is so and are inside the mount. Notably the paperless service still works, if I ensure those directories exist myself. But the tmpfiles rules setup service still errors out. One workaround I thought might work would be to set and to and then set those env vars myself. However the NixOS module requires those two options to be set. Possible fixes: sub-directories could be created inside a systemd service that is running as the user. this wouldn't work without some shenangiams because if the dir is something like the user won't have permissions to make and optional so the admin can manage setting them this isn't ideal because then the user also has to muck with a flag to bypass the and let the admin manage it themselves. this my favored option I'm happy to open a PR if the maintainers like one of those options. Steps to reproduce the behavior: with and on nfs monts those directories don't exist in the nfs mount should work without error. Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:

Discussion:
config = mkIf cfg.enable { services.redis.servers.paperless.enable = mkIf enableRedis true; <del> systemd.tmpfiles.rules = [ "d '${cfg.dataDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -" "d '${cfg.mediaDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -" (if cfg.consumptionDirIsPublic then "d '${cfg.consumptionDir}' 777 - - - -" else "d '${cfg.consumptionDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -" ) ]; </del> <ins> systemd.tmpfiles.settings."10-paperless" = let defaultRule = { inherit (cfg) user; inherit (config.users.users.${cfg.user}) group; }; in { "${cfg.dataDir}".d = defaultRule; "${cfg.mediaDir}".d = defaultRule; "${cfg.consumptionDir}".d = if cfg.consumptionDirIsPublic then { mode = "777"; } else defaultRule; }; </ins> systemd.services.paperless-scheduler = { description = "Paperless Celery Beat";

User = cfg.user; ExecStart = "${pkg}/bin/celery --app paperless beat --loglevel INFO"; Restart = "on-failure"; <ins> LoadCredential = lib.optionalString (cfg.passwordFile != null) "PAPERLESS_ADMIN_PASSWORD:${cfg.passwordFile}"; </ins> }; environment = env;

'' + optionalString (cfg.passwordFile != null) '' export PAPERLESS_ADMIN_USER="''${PAPERLESS_ADMIN_USER:-admin}" <del> export PAPERLESS_ADMIN_PASSWORD=$(cat "${cfg.dataDir}/superuser-password") </del> <ins> export PAPERLESS_ADMIN_PASSWORD=$(cat $CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD) </ins> superuserState="$PAPERLESS_ADMIN_USER:$PAPERLESS_ADMIN_PASSWORD" superuserStateFile="${cfg.dataDir}/superuser-state"

environment = env; }; <del> # Reading the user-provided password file requires root access systemd.services.paperless-copy-password = mkIf (cfg.passwordFile != null) { requiredBy = [ "paperless-scheduler.service" ]; before = [ "paperless-scheduler.service" ]; serviceConfig = { ExecStart = '' ${pkgs.coreutils}/bin/install --mode 600 --owner '${cfg.user}' --compare  '${cfg.passwordFile}' '${cfg.dataDir}/superuser-password' ''; Type = "oneshot"; }; }; </del> systemd.services.paperless-consumer = { description = "Paperless document consumer"; # Bind to `paperless-scheduler` so that the consumer never runs