Commit 91a226d891da

Vincent Demeester <vincent@sbr.pm>
2026-01-30 23:03:52
fix(paperless): use module options for custom data paths
Switch from environment variables to NixOS module options (dataDir, mediaDir, consumptionDir) for paperless custom paths. This ensures the paths are added to systemd ReadWritePaths, fixing "Read-only file system" errors caused by ProtectSystem=strict sandboxing. Also add explicit ReadWritePaths for the trash directory. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
main
1 parent 70f1ef4
Changed files (1)
systems
sakhalin
extra.nix
systems/sakhalin/extra.nix
@@ -134,12 +134,11 @@ in
       enable = true;
       address = "0.0.0.0"; # Listen on all interfaces for access via LAN and VPN
       port = 8000;
+      dataDir = "/mnt/gaia/paperless/data";
+      mediaDir = "/mnt/gaia/paperless/media";
+      consumptionDir = "/mnt/gaia/paperless/consume";
       settings = {
-        # Temporary sakhalin storage.
         PAPERLESS_URL = "https://paperless.sbr.pm";
-        PAPERLESS_CONSUMPTION_DIR = "/mnt/gaia/paperless/consume";
-        PAPERLESS_DATA_DIR = "/mnt/gaia/paperless/data";
-        PAPERLESS_MEDIA_ROOT = "/mnt/gaia/paperless/media";
         PAPERLESS_EMPTY_TRASH_DIR = "/mnt/gaia/paperless/trash";
         PAPERLESS_FILENAME_FORMAT = "{{ created_year }}/{{ document_type }}/{{ created }} - {{ correspondent }} - {{ title }} - {{ asn }} ({{ doc_pk }})";
         PAPERLESS_FILENAME_FORMAT_REMOVE_NONE = "true";
@@ -392,6 +391,12 @@ in
     "C /var/lib/grafana/dashboards/ollama-performance.json 0644 grafana grafana - ${../../tools/ollama-exporter/grafana-dashboard-custom.json}"
   ];
 
+  # Add trash directory to paperless services ReadWritePaths
+  systemd.services.paperless-scheduler.serviceConfig.ReadWritePaths = [ "/mnt/gaia/paperless/trash" ];
+  systemd.services.paperless-task-queue.serviceConfig.ReadWritePaths = [ "/mnt/gaia/paperless/trash" ];
+  systemd.services.paperless-consumer.serviceConfig.ReadWritePaths = [ "/mnt/gaia/paperless/trash" ];
+  systemd.services.paperless-web.serviceConfig.ReadWritePaths = [ "/mnt/gaia/paperless/trash" ];
+
   # Set Grafana admin password from secret file
   systemd.services.grafana-set-admin-password = {
     description = "Set Grafana admin password from secret file";