services:
  broker:
    image: ${DOCKER_REGISTRY:-}docker.io/library/redis:8
    volumes:
    - redisdata:/data
    deploy:
      replicas: 1
      placement:
        constraints:
        - node.role == manager
  webserver:
    image: ${DOCKER_REGISTRY:-}ghcr.io/paperless-ngx/paperless-ngx:latest
    ports:
    - target: 8000
      published: 8001
      protocol: tcp
      mode: ingress
    volumes:
    - data:/usr/src/paperless/data
    - media:/usr/src/paperless/media
    - export:/usr/src/paperless/export
    - consume:/usr/src/paperless/consume
    - scripts:/opt/scripts
    env_file: stack.env
    environment:
      PAPERLESS_REDIS: redis://broker:6379
      PAPERLESS_APPS: allauth.socialaccount.providers.openid_connect
      PAPERLESS_URL: https://paperless.sectorq.eu
      PAPERLESS_CSRF_TRUSTED_ORIGINS: https://paperless.sectorq.eu
      PAPERLESS_POST_CONSUME_SCRIPT: /opt/scripts/post-consumption.sh
      PAPERLESS_SOCIALACCOUNT_PROVIDERS: >
        {
            "openid_connect": {
              "APPS": [
                {
                  "provider_id": "authentik",
                  "name": "Authentik",
                  "client_id": "B4NM614bqWkvDqGDAmR823qUm8n4ZNlG3XtvkI51",
                  "secret": "7FFRdLWOUHlDxkhc86xR2yhxRn8BmDfTtfX9aTVY1XbRY197zy3UXPs51IMIkIjwjp6uijtpIQDDJDpR7LNInJt0F5hEXGMEcTfJxYyfNv2ytKFO58tCN5UD2EnzbCmN",
                  "settings": {
                    "server_url": "https://auth.sectorq.eu/application/o/paperless/.well-known/openid-configuration"
                  }
                }
              ],
              "OAUTH_PKCE_ENABLED": "True"
            }
          }
    deploy:
      labels:
        homepage.container: paperless-ngx_webserver
        homepage.description: PDF server
        homepage.group: Utils
        homepage.href: https://paperless.sectorq.eu
        homepage.icon: ${APPNAME}.png
        homepage.name: Paperless
        homepage.server: my-docker-swarm
        wud.watch: 'true'
        wud.watch.digest: 'true'
      replicas: 1
      placement:
        constraints:
        - node.role == manager
volumes:
  data:
  media:
  export:
  consume:
  scripts:
  redisdata: