Paperless: Support for SSL

[fdw]

When using the docker-compose file, I can't find any setting to enable SSL, neither in the readme.
Is this already supported?

If not, I would like to request this feature.

[ddddavidmartin]

AFAIK there is no support for SSL. From what I have seen people usually don't expose Paperless to the internet. I have all my personal documents and scans in there and I don't trust myself or this project to keep it secure. I use an SSH tunnel to access Paperless from outside my network.

[lbischof]

Or use a reverse proxy like nginx or traefik

[fdw]

I don't have it connected to the internet, either. However, all other internal services I use do support SSL natively without the need for a reverse proxy. Since Paperless also has more private data, I think it makes sense to offer this functionality as well.

[danielquinn]

In order to support SSL, Paperless would have to implement SSL in Python, which is so uncommon in Python web development that I've never heard of it in my 12 years doing it. The common "best practise" way to support this is usually to setup an Nginx proxy to your Gunicorn server (which Paperless can use) running on a Unix socket and then setup Nginx do handle SSL.

Like @ddddavidmartin, I wouldn't host Paperless on the open internet either, so I too access it via an SSH tunnel.

If you really want to do this with SSL, I recommend adding an nginx container to the docker-compose setup by using your own docker-compose.override.yml file. There you can have something like this:

version: "3"
services:
  nginx:
    image: "nginx"

The Docker Hub page will include information on how to customise Nginx to do what you need, and the Paperless documentation has a section on setting it up with Nginx which you can use as a reference for what you need.

I hope that's enough to get you on the right path!

[MasterofJOKers]

It looks like we could support this in Paperless' docker container, if we wanted to, as gunicorn supports ssl. We would have to generate some cert and key, though.

[fdw]

@MasterofJOKers Sounds fine to me :) I don't even think that the cert/key should be generated, but just a configuration for the user.

[MasterofJOKers]

I haven't tested this, but somethin along the lines of this should work. You would have to set PAPERLESS_USE_SSL=true in the docker-compose.env, I guess. Never used docker-compose.
I've hardcoded the paths to the cert/key file here, because we somehow need to get them into the container anyways.

diff --git a/scripts/docker-entrypoint.sh b/scripts/docker-entrypoint.sh
index 14f431b..b09b420 100644
--- a/scripts/docker-entrypoint.sh
+++ b/scripts/docker-entrypoint.sh
@@ -101,8 +101,14 @@ if [[ "$1" != "/"* ]]; then

     if [[ "$1" = "gunicorn" ]]; then
         shift
+        EXTRA_PARAMS=""
+        SSL_KEY_PATH="/usr/src/paperless/data/ssl.key"
+        SSL_CERT_PATH="/usr/src/paperless/data/ssl.cert"
+        if [ "${PAPERLESS_USE_SSL}" = "true" ] && [ -f "${SSL_KEY_PATH}" ] && [ -f "${SSL_CERT_PATH}" ]; then
+            EXTRA_PARAMS="--certfile='${SSL_CERT_PATH}' --keyfile='${SSL_KEY_PATH}'"
+        fi
         cd /usr/src/paperless/src/ && \
-            exec sudo -HEu paperless /usr/bin/gunicorn -c /usr/src/paperless/gunicorn.conf "$@" paperless.wsgi
+            exec sudo -HEu paperless /usr/bin/gunicorn -c /usr/src/paperless/gunicorn.conf ${EXTRA_PARAMS} "$@" paperless.wsgi
     else
         exec sudo -HEu paperless "/usr/src/paperless/src/manage.py" "$@"
     fi

[sbrunner]

But if we see the Gunicorn documentation
https://gunicorn.org/#deployment
he should be behind an HTTP proxy server, they recommend nginx.
For me for a personal usage it's not needed, but I think that for an intranet it's recommended :-)

[MasterofJOKers]

My stand on this is: while it's not the best setup, it might as well work and doesn't add much complexity on developer- or user-side. I only fear, that django needs some hint that it should generate https links. But maybe @fdw can test that and report back. It would also be interesting to hear about gunicorn's performance with ssl enabled.

[fdw]

Unfortunately, I couldn't get it to work. While I seem to have managed to push the certificate and key into Docker, I am always greeted with PR_END_OF_FILE_ERROR when opening paperless.

[MasterofJOKers]

So I tested it. The patch doesn't work as above. One has to change this line:
EXTRA_PARAMS="--certfile=${SSL_CERT_PATH} --keyfile=${SSL_KEY_PATH}"
After that, I built a docker-image, generated a cert/key and copied them into my data dir:

~/src/paperless$ ls data/
db.sqlite3  ssl.cert  ssl.key

Running gunicorn in docker then works:

~/src/paperless$ docker run -e PAPERLESS_USE_SSL=true -v $(pwd)/data:/usr/src/paperless/data paperless-ssl-test:latest gunicorn -b 0.0.0.0:8771
Operations to perform:
  Apply all migrations: admin, auth, contenttypes, documents, reminders, sessions
Running migrations:
  No migrations to apply.
[2019-11-01 20:08:56 +0000] [1] [INFO] Starting gunicorn 19.9.0
[2019-11-01 20:08:56 +0000] [1] [INFO] Listening at: https://0.0.0.0:8771 (1)
[2019-11-01 20:08:56 +0000] [1] [INFO] Using worker: sync
[2019-11-01 20:08:56 +0000] [1] [INFO] Server is ready. Spawning workers
[2019-11-01 20:08:56 +0000] [32] [INFO] Booting worker with pid: 32

Django also generates the Links as https, so from my point of view, it's working.

[fdw]

Thank you, that worked! 🙂

Do you think that could become part of paperless instead of a patch I have to apply manually?

[MasterofJOKers]

Well, if you're using docker-compose, you could just change the command in there to add --keyfile and --certfile. But yeah, feel free to open a Pull-Request for this patch. You should also extend the docs and maybe the example docker-compose.env. If you don't feel comfortable with that, let me know.

[fdw]

Thanks. As you can see, I have opened a PR. Please tell if you want more documentation :)