deskutils/py-paperless-ngx: Update to 2.7.2

Also, improve paperless-webui rc script to automatically generate
PAPERLESS_SECRET_KEY if not configured.

(cherry picked from commit 9b805ead545890c572cff44fee8e53ffa78ce980)

4 files changed, 59 insertions, 17 deletions

diff --git a/deskutils/py-paperless-ngx/Makefile b/deskutils/py-paperless-ngx/Makefile
index fb18f61f76c9..347baff5bc06 100644
--- a/deskutils/py-paperless-ngx/Makefile
+++ b/deskutils/py-paperless-ngx/Makefile
@@ -1,5 +1,5 @@
 PORTNAME=	paperless-ngx
-PORTVERSION=	2.6.3
+PORTVERSION=	2.7.2
 DISTVERSIONPREFIX=	v
 CATEGORIES=	deskutils python
 MASTER_SITES=	https://github.com/${PORTNAME}/${PORTNAME}/releases/download/${DISTVERSIONPREFIX}${DISTVERSION}/:webui \
@@ -73,12 +73,8 @@ RUN_DEPENDS+=	gpg2:security/gnupg \
 USES=		python shebangfix tar:xz
 USE_GITHUB=	yes
 GH_ACCOUNT=	paperless-ngx
-USE_RC_SUBR=	paperless-beat \
-		paperless-consumer \
-		paperless-flower \
-		paperless-migrate \
-		paperless-webui \
-		paperless-worker
+USE_RC_SUBR=	paperless-beat paperless-consumer paperless-flower \
+		paperless-migrate paperless-webui paperless-worker
 
 SHEBANG_FILES=	${WRKSRC}/src/manage.py
 
diff --git a/deskutils/py-paperless-ngx/distinfo b/deskutils/py-paperless-ngx/distinfo
index 25ab2feb24f9..682166856576 100644
--- a/deskutils/py-paperless-ngx/distinfo
+++ b/deskutils/py-paperless-ngx/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1711805770
-SHA256 (paperless-ngx-v2.6.3.tar.xz) = 0c74c7d6ba35b576c47481021322d7f5e8847f89c489eed47f5399588aad6d19
-SIZE (paperless-ngx-v2.6.3.tar.xz) = 61884952
-SHA256 (paperless-ngx-paperless-ngx-v2.6.3_GH0.tar.gz) = 06fc9b9deb0b65389edb2413a3e991913141b45d5d0ae4d8d79187ae6b39168c
-SIZE (paperless-ngx-paperless-ngx-v2.6.3_GH0.tar.gz) = 48389230
+TIMESTAMP = 1712653647
+SHA256 (paperless-ngx-v2.7.2.tar.xz) = b6508e2f96c9c5c6d9005d0005a30a920f131f2e07dbc8e634b87226f1976f44
+SIZE (paperless-ngx-v2.7.2.tar.xz) = 64558580
+SHA256 (paperless-ngx-paperless-ngx-v2.7.2_GH0.tar.gz) = 2fb3b0c7a504a06eb610643d5fe0ea61ee3c85de5a82c1181bed6262baf9ae45
+SIZE (paperless-ngx-paperless-ngx-v2.7.2_GH0.tar.gz) = 48444291
diff --git a/deskutils/py-paperless-ngx/files/paperless-webui.in b/deskutils/py-paperless-ngx/files/paperless-webui.in
index 1ef8477b58ee..19330fe57996 100755
--- a/deskutils/py-paperless-ngx/files/paperless-webui.in
+++ b/deskutils/py-paperless-ngx/files/paperless-webui.in
@@ -20,6 +20,16 @@
 # paperless_webui_restart_delay(int):	Set to "5" by default.
 #					WebUI automatic restart delay in
 #					seconds.
+# paperless_webui_secret_key(str):	Set to
+#					"%%PREFIX%%/etc/paperless_secret_key"
+#					by default. Load PAPERLESS_SECRET_KEY
+#					from this file from start, in case it
+#					is not in the environment already.
+#					Will be created on start in case it
+#					does not exist.
+#					Content of PAPERLESS_SECRET_KEY can be
+#					overridden in
+#					%%PREFIX%%/etc/paperless.conf.
 
 . /etc/rc.subr
 
@@ -35,12 +45,15 @@ paperless_webui_log_tag=${paperless_webui_log_tag:-"paperless-webui"}
 paperless_webui_listen_address=${paperless_webui_listen_address:-"127.0.0.1"}
 paperless_webui_listen_port=${paperless_webui_listen_port:-"8000"}
 paperless_webui_restart_delay=${paperless_webui_restart_delay:-"5"}
+paperless_webui_secret_key=${\
+paperless_webui_secret_key:-"%%PREFIX%%/etc/paperless_secret_key"}
 
 paperless_webui_env="LANG=en_US.UTF-8 PATH=$PATH:%%PREFIX%%/bin\
   PYTHONPATH=%%PYTHONPREFIX_SITELIBDIR%%/paperless \
   PAPERLESS_BIND_ADDR=${paperless_webui_listen_address} \
   PAPERLESS_PORT=${paperless_webui_listen_port}"
 
+start_precmd="paperless_webui_prestart"
 pidfile="/var/run/paperless/webui.pid"
 command="/usr/sbin/daemon"
 command_args="-cS -u ${paperless_webui_daemon_user} \
@@ -54,5 +67,25 @@ command_args="-cS -u ${paperless_webui_daemon_user} \
 	-c %%PYTHONPREFIX_SITELIBDIR%%/paperless/gunicorn.conf.py \
 	paperless.asgi:application"
 
+paperless_webui_prestart()
+{
+	if [ -z "$PAPERLESS_SECRET_KEY" ]; then
+		if [ ! -s "$paperless_webui_secret_key" ]; then
+			echo "Creating $paperless_webui_secret_key"
+			(
+				set -eo pipefail; umask 077
+				uuidgen -crn 10 | xargs | tr ' ' 'x' \
+				>"$paperless_webui_secret_key"
+			) || return 1
+		fi
+		PAPERLESS_SECRET_KEY=$(cat "$paperless_webui_secret_key")
+		export PAPERLESS_SECRET_KEY
+	fi
+	if [ "${#PAPERLESS_SECRET_KEY}" -lt "128" ]; then
+		>&2 echo "PAPERLESS_SECRET_KEY is shorter than 128 chars"
+		return 1
+	fi
+}
+
 load_rc_config ${name}
 run_rc_command "$1"
diff --git a/deskutils/py-paperless-ngx/files/patch-paperless.conf.example b/deskutils/py-paperless-ngx/files/patch-paperless.conf.example
index b034917c50bd..12cc2465a4b0 100644
--- a/deskutils/py-paperless-ngx/files/patch-paperless.conf.example
+++ b/deskutils/py-paperless-ngx/files/patch-paperless.conf.example
@@ -1,6 +1,6 @@
---- paperless.conf.example.orig	2024-03-18 03:45:09 UTC
+--- paperless.conf.example.orig	2024-04-08 01:44:14 UTC
 +++ paperless.conf.example
-@@ -17,11 +17,16 @@
+@@ -17,17 +17,29 @@
  
  # Paths and folders
  
@@ -21,7 +21,20 @@
  #PAPERLESS_FILENAME_FORMAT=
  #PAPERLESS_FILENAME_FORMAT_REMOVE_NONE=
  
-@@ -40,6 +45,7 @@
+ # Security and hosting
+ 
++# The paperless-webui rc script automatically generates
++# PAPERLESS_SECRET_KEY and places it in the environment, so this
++# actually can stay commented out. If set, it overrides
++# what is set by the rc script. See
++# https://docs.paperless-ngx.com/configuration/#PAPERLESS_SECRET_KEY
++# for more information.
+ #PAPERLESS_SECRET_KEY=change-me
++
+ #PAPERLESS_URL=https://example.com
+ #PAPERLESS_CSRF_TRUSTED_ORIGINS=https://example.com # can be set using PAPERLESS_URL
+ #PAPERLESS_ALLOWED_HOSTS=example.com,www.example.com # can be set using PAPERLESS_URL
+@@ -40,6 +52,7 @@
  
  # OCR settings
  
@@ -29,7 +42,7 @@
  #PAPERLESS_OCR_LANGUAGE=eng
  #PAPERLESS_OCR_MODE=skip
  #PAPERLESS_OCR_SKIP_ARCHIVE_FILE=never
-@@ -56,6 +62,7 @@
+@@ -56,6 +69,7 @@
  
  # Software tweaks
  
@@ -37,7 +50,7 @@
  #PAPERLESS_TASK_WORKERS=1
  #PAPERLESS_THREADS_PER_WORKER=1
  #PAPERLESS_TIME_ZONE=UTC
-@@ -92,3 +99,9 @@
+@@ -92,3 +106,9 @@
  
  #PAPERLESS_CONVERT_BINARY=/usr/bin/convert
  #PAPERLESS_GS_BINARY=/usr/bin/gs