services:
  paperless-ngx:
    extends:
      file: ${TEMPLATES_PATH}
      service: default
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    container_name: paperless-ngx
    ports:
      - "4009:8000"
    networks:
      - ip6net
    volumes:
      - ${EXTERNAL_STORAGE}/documents/data:/usr/src/paperless/data
      - ${EXTERNAL_STORAGE}/documents/media:/usr/src/paperless/media
      - ${SERVICE_PATH}/paperless-ngx/data/export:/usr/src/paperless/export
      - ${SERVICE_PATH}/paperless-ngx/data/consume:/usr/src/paperless/consume
    environment:
      # REDIS
      PAPERLESS_REDIS: redis://redis:6379
      # DB
      PAPERLESS_DBHOST: postgres
      PAPERLESS_DBNAME: paperless
      PAPERLESS_DBUSER: paperless
      PAPERLESS_DBPASS: ${PAPERLESS_DB_PASSWORD}
      # Paperless var
      PAPERLESS_URL: https://paperless.${PUBLIC_DOMAIN}
      PAPERLESS_ALLOWED_HOSTS: ${PUBLIC_DOMAIN},192.168.1.38,"2a04:ee41:86:9397:844f:f9ff:fe5c:e416"
      PAPERLESS_OCR_LANGUAGE: fra+eng+deu
      # Admin user when not OIDC
      PAPERLESS_ADMIN_USER: chris
      PAPERLESS_ADMIN_PASSWORD: ${PAPERLESS_ADMIN_PASSWORD}
      # OIDC
      # PAPERLESS_DISABLE_REGULAR_LOGIN: true
      # PAPERLESS_ENABLE_HTTP_REMOTE_USER: true
      # PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME: HTTP_REMOTE_USER
      # PAPERLESS_LOGOUT_REDIRECT_URL: https://auth.crescentec.xyz/logout
      # PAPERLESS_APPS: "allauth.socialaccount.providers.openid_connect"
      # PAPERLESS_SOCIALACCOUNT_PROVIDERS: '{"openid_connect":{"SCOPE":["openid","profile","email"],"OAUTH_PKCE_ENABLED":true,"APPS":[{"provider_id":"authelia","name":"Authelia","client_id":"paperless","secret":"jzO0JYA35oOojGqxFJUaDXdgdXhuACyq4b3lvOx233wtoSyv19prQfCKah1mwyDv","settings":{"server_url":"https://auth.crescentec.xyz","token_auth_method":"client_secret_basic"}}]}}'
    labels:
      # Watchtower
      - "com.centurylinklabs.watchtower.enable=true"
      # Traefik
      - "traefik.enable=true"
      - "traefik.http.routers.paperless.rule=Host(`paperless.${PUBLIC_DOMAIN}`)"
      - "traefik.http.routers.paperless.entrypoints=https"
      - "traefik.http.routers.paperless.tls.certresolver=myresolver"
      - "traefik.http.routers.paperless.tls=true"
      # Middlewares
      - "traefik.http.routers.paperless.middlewares=crowdsec-bouncer@file"