docker-compose.yml

services:
  broker:
    image: redis:7-alpine
    restart: unless-stopped
    volumes:
      - redis_data:/data
    networks:
      app_cache:

  db:
    image: postgres:17-alpine
    restart: unless-stopped
    volumes:
      - db_data:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: paperless
      POSTGRES_USER: paperless
      POSTGRES_PASSWORD: paperless
    networks:
      app_database:
    labels:
      ofelia.restart: "true"
      ofelia.enabled: "true"
      ofelia.job-exec.paperlessdbbackup.schedule: "0 0 1 * * *"
      ofelia.job-exec.paperlessdbbackup.command: "sh -c 'pg_dumpall -U paperless -f /var/lib/postgresql/data/backup.sql'"

  app:
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    restart: unless-stopped
    depends_on:
      - db
      - broker
      - gotenberg
      - tika
      - sftp
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000"]
      interval: 30s
      timeout: 10s
      retries: 5
    volumes:
      - app_data:/usr/src/paperless/data
      - app_media:/usr/src/paperless/media
      - app_export:/usr/src/paperless/export
      - sftp_data:/usr/src/paperless/consume
      - $PWD/scripts/decrypt-pdf:/usr/local/bin/scripts/decrypt-pdf
    environment:
      PAPERLESS_REDIS: redis://broker:6379
      PAPERLESS_DBHOST: db
      PAPERLESS_TIKA_ENABLED: 1
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
      PAPERLESS_ENABLE_UPDATE_CHECK: true
      PAPERLESS_TIMEZONE:
      PAPERLESS_SECRET_KEY:
      PAPERLESS_OCR_LANGUAGE:
      PAPERLESS_FILENAME_FORMAT:
      PAPERLESS_URL:
      PAPERLESS_CONSUMER_ENABLE_BARCODES:
      PAPERLESS_EMAIL_TASK_CRON: "*/2 * * * *"
      PAPERLESS_TRAIN_TASK_CRON: "*/15 * * * *"
      PAPERLESS_INDEX_TASK_CRON: "0 * * * *"
      PAPERLESS_TASK_WORKERS: 2
      PAPERLESS_THREADS_PER_WORKER: 2
      PAPERLESS_TIME_ZONE: "Europe/Berlin"
      PAPERLESS_FILENAME_FORMAT_REMOVE_NONE: true
      PAPERLESS_DECRYPT_PASSWORD:
      PAPERLESS_PRE_CONSUME_SCRIPT: "/usr/local/bin/scripts/decrypt-pdf"
    networks:
      default:
      app_database:
      app_cache:
      proxy_apps:

  sftp:
    image: ghcr.io/hueske-digital/sftp:latest
    restart: unless-stopped
    volumes:
      - sftp_keys:/etc/ssh
      - sftp_data:/home/${SFTP_USERNAME}/documents
      - $PWD/publickeys:/home/${SFTP_USERNAME}/.ssh/keys:ro
    ports:
      - "2222:22"
    networks:
      sftp:
    command: ${SFTP_USERNAME}:${SFTP_PASSWORD}:1000
    ulimits:
      nofile:
        soft: 65536
        hard: 65536

  gotenberg:
    image: gotenberg/gotenberg:8
    restart: unless-stopped
    command:
      - "gotenberg"
      - "--chromium-disable-javascript=true"
      - "--chromium-allow-list=file:///tmp/.*"
      - "--chromium-disable-routes=true"
    networks:
      default:

  tika:
    image: apache/tika
    restart: unless-stopped
    networks:
      default:

networks:
  app_database:
  app_cache:
  sftp:
  proxy_apps:
    name: proxy_apps
    external: true

volumes:
  app_data:
  app_media:
  db_data:
  redis_data:
  sftp_data:
  sftp_keys:
  app_export: