How do I use SSL (https) with granian (since paperless v2.15.0)?

[stevie6969]

I am used to access my server through SSL (https) in my local environment (to get rid of the "not safe" message in the browsers). My server is its own CA (made trustworthy to the local machines) and the www subdomain served by Apache works fine. Now I want to do the same with paperless which uses granian since v2.15.0.

I have created a key/cert pair for my subdomain "paperless" and I already tried to install it "the old way" from the cocumentation: save the cert and key as "ssl.cert" and "ssl.key" to paperless' data folder and set PAPERLESS_USE_SSL=true. To be sure, I also tried 1 instead of true and also changed the "http" to "https" in PAPERLESS_URL, which actually does nothing at all. Accessing paperless with http://... continued to work but https://... told me the site can not establish a secure communication. Yes, I have restarted the containers and checked the environment variables to be set as configured. I use the latest paperless 2.15.3 version.

So as expected, SSL configuration no longer works as stated in the pre-Granian documentation.

I find zero info on how to configure SSL for Granian in paperless. Just the changelog of 2.15.0 which says Granian is "very configurable" and "lets people set an SSL cert path". How do I tell Granian I want SSL connections for paperless and where it has to look for the cert path?

[stumpylog]

PAPERLESS_USE_SSL

This isn't a setting, no idea where it came from.

Have you tried reading the Granian documentation? It lists all the options: https://github.com/emmett-framework/granian

[stevie6969]

PAPERLESS_USE_SSL

This isn't a setting, no idea where it came from.

Oh my, after a while I seem to have lost my way -- this is from a 2021 paperless (without "-ngx") documentation...

Have you tried reading the Granian documentation? It lists all the options: https://github.com/emmett-framework/granian

I have actually missed the info right there and was lookinf for separate docs. It seems I really got lost...

I have now set the granian environment variables to point the 2 paths to the data folder where I already had the files:

GRANIAN_SSL_KEYFILE=../data/ssl.key
GRANIAN_SSL_CERTIFICATE=../data/ssl.cert

This in fact lets me access paperless via https://paperless.stevie.private:8000

I see the login screen and the browser tells me it is a safe connection and lets me see the certificate info. BUT...

When I log in, I get the infamous "Forbidden (403) CSRF verification failed ..."
(#6216)

As I already have set PAPERLESS_URL=https://paperless.stevie.private this should work according to those who had this problem (back then, using SSL with their reverse proxies and not granian of course).

I have also tried to set these:

PAPERLESS_CSRF_TRUSTED_ORIGINS=https://paperless.stevie.private
PAPERLESS_ALLOWED_HOSTS=https://paperless.stevie.private

which had the same result -- login screen but CSRF error afterwards. And if I try to remove the https:// (since technically with that protocol info that's not even a host but an URL) or set the parameters to * or make them a comma separated list as outlined in the paperless-ngx docs, adding localhost and/or the local IP number, I do not even get the login screen... The same happens (no login screen) if I try to set GRANIAN_HOST and GRANIAN_PORT.

I am a bit lost now on how to proceed... The only parameter related to CSRF either does nothing or breaks the communication...

If I remove the granian variables and access paperless with http://paperless.stevie.private:8000 , everything works since 4 weeks and several updates... Even with PAPERLESS_URL=https://paperless.stevie.private -- the protocol in that variable (or the variable altogether) seems to be ignored.

[stumpylog]

PAPERLESS_CSRF_TRUSTED_ORIGINS and PAPERLESS_ALLOWED_HOSTS are both comma separated lists. If you want to access your server from several locations, you will need to put them all in one or both

[stevie6969]

I want to access paperless from a single Windows PC which is in the same private network. Do I have to give the IP address of that client PC in these variables? Else I don't understand the "several locations". The examples in earlier issues just repeated the PAPERLESS_URL entry there and some added localhost and/or the server (I guess) IP number. I tried that but then I don't even get the login page. See above, repeating only the content of the PAPERLESS_URL in these two changed nothing (onlöy login page) and using "*" or giving a list broke it (no login page). And if these two must be set, why does it all work without them if I don't use SSL?

[wwwutz]

Had the same issue, finally fixed it by disabling HTTP/2 in granian. I have my own startup-scripts without docker, so I don't now exactly where you would change it in your case, but this works for me:

granian 
      --host 141.14.19.4 # granian does not allow names... wtf ? DNS for paperless.molgen.mpg.de and certs
      --port 8443
      --ssl-certificate /home/paperless/certs/fullchain.pem
      --ssl-keyfile /home/paperless/certs/privkey.pem
      --workers 1
      --interface asginl
      --pid-file "/dev/shm/safetypr/2.16.3/granian.pid"
      --ws
      --loop uvloop
      --access-log
      --workers-kill-timeout 1
      --http 1
     paperless.asgi:application

and paperless.conf has the URL

PAPERLESS_URL=https://paperless.molgen.mpg.de

uh, and almost forgot I have port mapping from 8443 to 443 to allow non-root startup.

[stevie6969]

Hey Peter,
thanks so much for sharing your successful approach, your help is appreciated! Will definitely play with this again next week and share my results.

[stevie6969]

Hey again, @wwwutz , YOU ARE OFFICIALLY MY HERO!!!

After a bit of fiddling, I have now stripped down my docker-compose.env to this:

PAPERLESS_URL=https://paperless.stevie.private
PAPERLESS_TIME_ZONE=Europe/Berlin
PAPERLESS_OCR_LANGUAGE=deu+eng
PAPERLESS_CONSUMER_INOTIFY_DELAY=10
GRANIAN_SSL_CERTIFICATE=../data/ssl.cert
GRANIAN_SSL_KEYFILE=../data/ssl.key
GRANIAN_PORT=8000
GRANIAN_HTTP=1
PAPERLESS_SECRET_KEY='well, secret...'

And this works for https!

If I set GRANIAN_HTTP (which corresponds to your "-- http") to 2 (or don't set it at all, which defaults to "auto" and I guess that also sets it to 2) then it breaks the login. Which means you successfully see the login form but then logging in gives the CSFR error screen. Exactly like you said, this is the single adjustment that makes it (HTTP/1) or breaks it (HTTP/2).

BUT:

As you see, I do not set the GRANIAN_HOST (the "--host" in your granian section) at all, also I don't set any of the three PAPERLESS_CSRF_TRUSTED_ORIGINS, PAPERLESS_ALLOWED_HOSTS, or PAPERLESS_CORS_ALLOWED_HOSTS -- I use their defaults.

I tried various settings for the PAPERLESS_CSRF_TRUSTED_ORIGINS in combination with HTTP/2 and that either changes nothing (login form but then error on loggin in) or leads to a non-responsive server (where you do not even get the login form as the server refuses the connection).

I have a gut feeling that setting PAPERLESS_CSRF_TRUSTED_ORIGINS to the correct value should repair everything also for HTTP/2 but I can't get it to work. I tried all different combinations of 127.0.0.1, the private network IP# of the Linux machine running paperless, and the IP# of my Windows PC (on the same private network). Nothing. Only HTTP/1 works as it most likely does not bother checking the CSRF cookie at all...

Ideas anybody? ... Bueller? .... Bueller?

PS: it took me a while (and a few panic moments) to relize that restarting paperless (i.e. recreating the docker image) after doing a change in the config file tells you it is completed, but it sometimes takes more than 30 seconds before the URL is responsive and does not give you the refused connection message! So if somebody plays with this: after you applied a change and restarted paperless, wait a good minute to be sure you really see the result of your change, and not just a sleepy granian webserver which did not have its coffee yet.

[github-actions[bot]]

This discussion has been automatically closed because it was marked as answered. Please see our contributing guidelines for more details.

[github-actions[bot]]

This discussion has been automatically locked since there has not been any recent activity after it was closed. Please open a new discussion for related concerns. See our contributing guidelines for more details.