networks:
  proxy:
    external: true
  paperless:
    external: false
    name: paperless

volumes:
  paperless-redis:
  paperless-db:
  paperless-data:
  paperless-media:
  paperless-export:

services:
  broker:
    image: redis:8
    restart: unless-stopped
    volumes:
      - paperless-redis:/data
    networks:
      - paperless

  db:
    image: postgres:17
    restart: unless-stopped
    volumes:
      - paperless-db:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: paperless
      POSTGRES_USER: paperless
      POSTGRES_PASSWORD: paperless
    networks:
      - paperless

  webserver:
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    restart: unless-stopped
    depends_on:
      - db
      - broker
      - gotenberg
      - tika
    volumes:
      - paperless-data:/usr/src/paperless/data
      - paperless-media:/usr/src/paperless/media
      - paperless-export:/usr/src/paperless/export
      - /media/backup/paperless-consume:/usr/src/paperless/consume
    env_file: docker-compose.env
    environment:
      PAPERLESS_REDIS: redis://broker:6379
      PAPERLESS_DBHOST: db
      PAPERLESS_TIKA_ENABLED: 1
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
    networks:
      - proxy
      - paperless
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.paperless.entrypoints=web"
      - "traefik.http.routers.paperless.rule=Host(`paperless.fam-steinle.de`)"
      - "traefik.http.routers.paperless.middlewares=paperless"
      - "traefik.http.middlewares.paperless.redirectscheme.scheme=https"
      - "traefik.http.routers.paperless-secure.entrypoints=websecure"
      - "traefik.http.routers.paperless-secure.rule=Host(`paperless.fam-steinle.de`)"
      - "traefik.http.routers.paperless-secure.middlewares=paperless-secure"
      - "traefik.http.middlewares.paperless-secure.headers.addvaryheader=true"
      - "traefik.http.middlewares.paperless-secure.headers.accesscontrolalloworiginlist=https://homer.fam-steinle.de"
      - "traefik.http.middlewares.paperless-secure.headers.accesscontrolallowheaders=authorization"
      - "traefik.http.routers.paperless-secure.service=paperless-secure"
      - "traefik.http.routers.paperless-secure.tls=true"
      - "traefik.http.routers.paperless-secure.tls.certresolver=myresolver"
      - "traefik.http.services.paperless-secure.loadbalancer.server.port=8000"


  gotenberg:
    image: gotenberg/gotenberg:8.22
    restart: unless-stopped
    command:
      - "gotenberg"
      - "--chromium-disable-javascript=true"
      - "--chromium-allow-list=file=///tmp/.*"
    networks:
      - paperless

  tika:
    image: apache/tika:latest
    restart: unless-stopped
    networks:
      - paperless