Support for self signed certificates for local usage

[foxriver76]

It seems like the environment variable PAPERLESS_USE_SSL which was present in the past (https://paperless.readthedocs.io/en/latest/setup.html) is not working with paperless-ngx.

It would be nice if we have the ability to somehow pass certificates to gunicorn when running in Docker.

Maybe there is already a suitable solution and I just need a hint? ;-)

Thanks for your great work.

[stumpylog]

Looks like that support was removed in paperless-ng 0.9.0. The suggestion from that changelog (and probably now) is to use a reverse proxy for SSL functionality.

[foxriver76]

Thank you for your response. I think that is totally fine solution for exposing a server to the internet. In my case the goal is to use https in the local network, without internet access to paperless.

[tribut]

Setting up a reverse proxy using docker should be more or less the same amount of configuration, but without us having to maintain the feature. We have had discussions about improving the documentation because obviously not everyone has experience doing it.

A popular and straight-forward choice is Caddy. In your docker-compose.yml you would add:

services:
  [...]
  proxy:
    image: caddy
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
    ports:
      - 9000:443
volumes:
  [...]
  caddy_data:

and then you create Caddyfile with the following contents:

localhost

reverse_proxy webserver:8000

Your paperless instance is now available (with a self-signed cert) on https://localhost:9000

Does this work for you?

[foxriver76]

Thank you very much for your profound answer. I have managed to get this setup working. The only downside is, that I am no longer able to use the rare IP address of the server running paperless. I guess I can live with it if there is no solution to that.

For anyone interested, following the answer work perfectly for running + access from same host. If Paperless is running on another server in the home setup this worked for me (using the DNS server provided by my "router" to get a domain name):

Full Caddyfile:

docker-host.fritz.box

reverse_proxy webserver:8000
tls internal

docker-compose.env adaption (see #712)

PAPERLESS_URL=https://docker-host.fritz.box:9000

Then the https version of Paperless is accessible on https://docker-host.fritz.box:9000

[tribut]

Great to hear you got it working. Accessing via IP should also work, but maybe needs some adjusting of PAPERLESS_ALLOWED_HOSTS etc.

[nosebeggar]

Hi all, just throwing my 2 cents in here.

Since 1.7.0 added the requirement to set PAPERLESS_URL (see here) I'm not aware of any way how you'd be able to get a second URL working.

[shamoon]

Since 1.7.0 added the requirement to set PAPERLESS_URL (see here) I'm not aware of any way how you'd be able to get a second URL working.

PAPERLESS_URL is just an alias for three other variables, all of which can still be set directly and accept more than one value. See https://paperless-ngx.readthedocs.io/en/latest/configuration.html#hosting-security

[stevenengland]

Hi, I just stumbled over this thread. I think it is not a very good idea to not support TLS encryption at all. Yes, reverse proxies are good and fine. But zero trust is even better ;) As long as it is not that much effort to support TLS encryption (and maybe trust as well) I would be a fan of supporting it. As far as I overlook this issue so far: At a bare minimum pngx would have to set the values like this for

# gunicorn.conf.py
certfile = os.getenv("PAPERLESS_TLS_CERTFILE", None)
keyfile = os.getenv("PAPERLESS_TLS_KEYFILE", None)

That could even be paths to volumes in case of docker containers or normal paths on bare metal installations. Should not be that big deal to support a minimum of encryption, does it? Would love to create a PR if you think that might be a thing to go for...

[kneip68]

Just installed paperless-ngx in a proxmox container, and looks great (thx for the effort put into it), then when looking for how to secure the container, stumbled on this thread:

I do agree, I am trying to not have any unencrypted traffic in my network, specifically not anything running on either my Proxmox Environment nor my Synology, which are typical installation targets for Paperless-NGX. I do accept to have unencrypted traffic in a docker internal network (so I will now try to go down the caddy route), but in general I prefer security by design, so on gunicorn level.

Either way, I do believe security should be incorporated into any software, specifically as I see a lot of "novice" home lab administrators implementing unsecure stacks, why not at least incorporating Caddy into the docker-compose template for installation and exposing only the TLS port to outside of docker?

[Randy-Blancett]

I was looking at the suggestion to add the information to gunicorn.conf.py does anyone have any idea how to test this. It seems like running the manage.py runserver does not trigger the file.

Looking at the Usage.md file it seems like you should be able to do

$ cd /path/to/paperless/src/
$ gunicorn -c ../gunicorn.conf.py paperless.wsgi

If I try this it does trigger the config file, however it does not seem to work.

I have tried exporting PAPERLESS_BIND_ADDR as 0.0.0.0 or 127.0.0.1 and the server seems to start fine, however when i go to http://127.0.0.1:8000/api I get "Internal Server Error" but no error messages on the command line.