Commit Graph

11 Commits

Author SHA1 Message Date
Maximilian Bosch
48459567ae nixos/postgresql: drop ensurePermissions, fix ensureUsers for postgresql15
Closes #216989

First of all, a bit of context: in PostgreSQL, newly created users don't
have the CREATE privilege on the public schema of a database even with
`ALL PRIVILEGES` granted via `ensurePermissions` which is how most of
the DB users are currently set up "declaratively"[1]. This means e.g. a
freshly deployed Nextcloud service will break early because Nextcloud
itself cannot CREATE any tables in the public schema anymore.

The other issue here is that `ensurePermissions` is a mere hack. It's
effectively a mixture of SQL code (e.g. `DATABASE foo` is relying on how
a value is substituted in a query. You'd have to parse a subset of SQL
to actually know which object are permissions granted to for a user).

After analyzing the existing modules I realized that in every case with
a single exception[2] the UNIX system user is equal to the db user is
equal to the db name and I don't see a compelling reason why people
would change that in 99% of the cases. In fact, some modules would even
break if you'd change that because the declarations of the system user &
the db user are mixed up[3].

So I decided to go with something new which restricts the ways to use
`ensure*` options rather than expanding those[4]. Effectively this means
that

* The DB user _must_ be equal to the DB name.
* Permissions are granted via `ensureDBOwnerhip` for an attribute-set in
  `ensureUsers`. That way, the user is actually the owner and can
  perform `CREATE`.
* For such a postgres user, a database must be declared in
  `ensureDatabases`.

For anything else, a custom state management should be implemented. This
can either be `initialScript`, doing it manual, outside of the module or
by implementing proper state management for postgresql[5], but the
current state of `ensure*` isn't even declarative, but a convergent tool
which is what Nix actually claims to _not_ do.

Regarding existing setups: there are effectively two options:

* Leave everything as-is (assuming that system user == db user == db
  name): then the DB user will automatically become the DB owner and
  everything else stays the same.

* Drop the `createDatabase = true;` declarations: nothing will change
  because a removal of `ensure*` statements is ignored, so it doesn't
  matter at all whether this option is kept after the first deploy (and
  later on you'd usually restore from backups anyways).

  The DB user isn't the owner of the DB then, but for an existing setup
  this is irrelevant because CREATE on the public schema isn't revoked
  from existing users (only not granted for new users).

[1] not really declarative though because removals of these statements
    are simply ignored for instance: https://github.com/NixOS/nixpkgs/issues/206467
[2] `services.invidious`: I removed the `ensure*` part temporarily
    because it IMHO falls into the category "manage the state on your
    own" (see the commit message). See also
    https://github.com/NixOS/nixpkgs/pull/265857
[3] e.g. roundcube had `"DATABASE ${cfg.database.username}" = "ALL PRIVILEGES";`
[4] As opposed to other changes that are considered a potential fix, but
    also add more things like collation for DBs or passwords that are
    _never_ touched again when changing those.
[5] As suggested in e.g. https://github.com/NixOS/nixpkgs/issues/206467
2023-11-13 17:16:25 +01:00
Leona Maroni
65209cbc21
nixosTests.paperless: add additional test using postgresql as db
With that test we also test, that paperless can connect to the outside
postgresql socket.

Co-Authored-By: Erik Arvstedt <erik.arvstedt@gmail.com>
2023-10-05 12:58:09 +02:00
Gregor Godbersen
540a20546a nixos/paperless: add test for plaintext document 2023-08-05 22:06:27 +02:00
Florian Brandes
5b6881f4a0 nixos/paperless-ngx: fix startup order
The nixOS test failed sporadically with a timeout.
This is due to a race condition in the startup  of
the scheduler vs the task-queue.

The scheduler runs the migration scripts in "pre-start" and
celery isn't available, yet. The celery worker (paperless-task-queue)
was already started by systemd but was unable to connect
(as the migration scripts from "pre-start" still ran).

This fix adds the necessary "after" condition in the systemd
worker unit and adds a test to "paperless"

Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
2023-01-02 15:21:45 +01:00
Andre-Patrick Bubel
8a9ffb1b0b nixosTests.paperless: check if /metadata/ can be accessed
Detects issues like #190850, when gunicorn python version doesn't match
that of paperless.
2022-09-14 16:20:47 +02:00
Erik Arvstedt
1a32663efc
treewide: rename maintainer earvstedt -> erikarvstedt
The maintainer name now matches the Github username, which simplifies
maintainer notifications.
2022-06-26 19:12:18 +02:00
Erik Arvstedt
0977227b86
nixos/paperless-ng: rename to paperless, use paperless-ngx package
Use this opportunity to rename `paperless-(ng)-server` to `paperless-scheduler`.
This follows the naming scheme in the paperless repo and docs.
2022-04-12 18:15:44 +02:00
Andreas Rammhold
6e1421013a
paperless: remove package & module as it has been superseded by paperless-ng
The paperless project has moved on to paperless-ng and the original
paperless package in Nixpkgs has stopped working recently (due to
version incompatibility with the providede Django package).

Instead of investing more time into the old module we should migrate all
users to the new module instead.
2021-08-14 10:10:44 +02:00
Scott Worley
4fc64f27c7 nixos/tests/paperless: Use curl --fail 2020-10-25 11:01:30 +01:00
Christian Kampka
229a0afb28
nixosTests.paperless: Port tests to python 2019-12-15 20:10:57 +01:00
Erik Arvstedt
80c3ddbad8
paperless service: init 2019-05-08 09:26:32 +02:00