services:
  broker:
    image: ${DOCKER_REGISTRY:-}docker.io/library/redis:8
    restart: unless-stopped
    volumes:
      - /share/docker_data/paperless/redisdata:/data
  webserver:
    image: ${DOCKER_REGISTRY:-}ghcr.io/paperless-ngx/paperless-ngx:latest
    restart: unless-stopped
    depends_on:
      - broker
    ports:
      - "8001:8000"
    volumes:
      - /share/docker_data/paperless/data:/usr/src/paperless/data
      - /share/docker_data/paperless/media:/usr/src/paperless/media
      - /share/docker_data/paperless/export:/usr/src/paperless/export
      - /share/docker_data/paperless/consume:/usr/src/paperless/consume
      - /share/docker_data/paperless/scripts:/opt/scripts
    env_file: stack.env
    environment:
      PAPERLESS_REDIS: redis://broker:6379
      PAPERLESS_APPS: allauth.socialaccount.providers.openid_connect
      PAPERLESS_URL: https://paperless.sectorq.eu
      PAPERLESS_CSRF_TRUSTED_ORIGINS: https://paperless.sectorq.eu
      PAPERLESS_POST_CONSUME_SCRIPT: /opt/scripts/post-consumption.sh
      PAPERLESS_SOCIALACCOUNT_PROVIDERS: >
          {
            "openid_connect": {
              "APPS": [
                {
                  "provider_id": "authentik",
                  "name": "Authentik",
                  "client_id": "B4NM614bqWkvDqGDAmR823qUm8n4ZNlG3XtvkI51",
                  "secret": "7FFRdLWOUHlDxkhc86xR2yhxRn8BmDfTtfX9aTVY1XbRY197zy3UXPs51IMIkIjwjp6uijtpIQDDJDpR7LNInJt0F5hEXGMEcTfJxYyfNv2ytKFO58tCN5UD2EnzbCmN",
                  "settings": {
                    "server_url": "https://auth.sectorq.eu/application/o/paperless/.well-known/openid-configuration"
                  }
                }
              ],
              "OAUTH_PKCE_ENABLED": "True"
            }
          }
    labels:
      homepage.container: paperless-webserver-1
      homepage.description: PDF server
      homepage.group: Utils
      homepage.href: https://paperless.sectorq.eu
      homepage.icon: ${APPNAME}.png
      homepage.name: Paperless
      homepage.server: my-docker
      wud.watch: true
      wud.watch.digest: true