alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

nixos/paperless-ng: fix /proc access for service

Browse source 
This allows django-q to set the number of workers according to the CPU
core count and to show memory stats via `manage.py qmonitor`.
This also fixes a non-critical psutil error in paperless-ng-server.
This commit is contained in:
Erik Arvstedt 2022-04-11 17:06:03 +02:00
parent 308c4bf0f7
commit 69319ee4a6
No known key found for this signature in database
GPG key ID: 33312B944DD97846
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
nixos/modules/services/misc/paperless-ng.nix
View file

@ -53,7 +53,6 @@ let
PrivateNetwork = true;
PrivateTmp = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
# Breaks if the home dir of the user is in /home
# Also does not add much value in combination with the TemporaryFileSystem.
@ -66,6 +65,10 @@ let
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
# Don't restrict ProcSubset because django-q requires read access to /proc/stat
# to query CPU and memory information.
# Note that /proc only contains processes of user `paperless`, so this is safe.
# ProcSubset = "pid";
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;