services:
  paperless:
    container_name: paperless
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    restart: unless-stopped
    depends_on:
    - traefik
    - postgres
    - redis
    volumes:
    - $DATA/paperless/data:/usr/src/paperless/data
    - $DATA/paperless/media:/usr/src/paperless/media
    - $DATA/paperless/export:/usr/src/paperless/export
    - $DATA/paperless/consume:/usr/src/paperless/consume
    environment:
    - PAPERLESS_REDIS=redis://redis:6379
    - PAPERLESS_DBENGINE=postgresql
    - PAPERLESS_DBHOST=postgres
    - PAPERLESS_DBNAME=paperless
    - PAPERLESS_DBUSER=postgres
    - PAPERLESS_DBPASS=${POSTGRES_PASSWORD}
    - PAPERLESS_URL=https://paperless.bhasher.com
    - PAPERLESS_SECRET_KEY=${PAPERLESS_SECRET_KEY}
    - PAPERLESS_TIME_ZONE=Europe/Paris
    - PAPERLESS_OCR_LANGUAGE=fra
    - PAPERLESS_USE_X_FORWARD_HOST=true
    - PAPERLESS_USE_X_FORWARD_PORT=true
    - PAPERLESS_PROXY_SSL_HEADER=["HTTP_X_FORWARDED_PROTO", "https"]
    - PAPERLESS_TASK_WORKERS=4
    - PAPERLESS_SOCIALACCOUNT_PROVIDERS=${PAPERLESS_PROVIDERS}
    - PAPERLESS_APPS=allauth.socialaccount.providers.openid_connect
    - PAPERLESS_DISABLE_REGULAR_LOGIN=true
    labels:
    - "traefik.enable=true"
    - "traefik.http.routers.paperless.rule=Host(`paperless.bhasher.com`)"
    - "traefik.http.routers.paperless.entrypoints=internalsecure"
    - "traefik.http.services.paperless.loadbalancer.server.port=8000"
    - "traefik.http.routers.paperless.tls=true"
    - "traefik.http.routers.paperless.tls.certresolver=http"
    networks:
    - auth
    - storage
    - external