services:
  redis:
    image: docker.io/library/redis:8
    command:
      - /bin/sh
      - -c
      - redis-server --requirepass redispass
    container_name: PaperlessNGX-REDIS
    hostname: paper-redis
    security_opt:
      - no-new-privileges:true
    read_only: true
    user: 1026:100
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
    volumes:
      - /volume1/docker/paperlessngx/redis:/data:rw
    environment:
      TZ: America/Los_Angeles
    restart: on-failure:5
    networks:
      - paperless-ngx_default
    deploy:
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 256M

  gotenberg:
    image: docker.io/gotenberg/gotenberg:8.25
    container_name: PaperlessNGX-GOTENBERG
    hostname: gotenberg
    security_opt:
      - no-new-privileges:true
    user: 1026:100
    command:
      - "gotenberg"
      - "--chromium-disable-javascript=true"
      - "--chromium-allow-list=file:///tmp/.*"
    restart: on-failure:5
    networks:
      - paperless-ngx_default
    deploy:
      resources:
        limits:
          memory: 2G
        reservations:
          memory: 1G

  tika:
    image: docker.io/apache/tika:latest
    container_name: PaperlessNGX-TIKA
    hostname: tika
    security_opt:
      - no-new-privileges:true
    user: 1026:100
    restart: on-failure:5
    environment:
      JAVA_OPTS: "-Xmx2g -Xms1g"
    networks:
      - paperless-ngx_default
    deploy:
      resources:
        limits:
          memory: 3G
        reservations:
          memory: 1.5G

  paperless:
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    container_name: PaperlessNGX
    hostname: paperless-ngx
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "curl", "-fs", "-S", "--max-time", "2", "http://localhost:8000"]
      interval: 30s
      timeout: 10s
      retries: 5
    ports:
      - 8777:8000
    volumes:
      - /volume1/docker/paperlessngx/data:/usr/src/paperless/data:rw
      - /volume1/docker/paperlessngx/media:/usr/src/paperless/media:rw
      - /volume1/docker/paperlessngx/export:/usr/src/paperless/export:rw
      - /volume1/docker/paperlessngx/consume:/usr/src/paperless/consume:rw
      - /volume1/docker/paperlessngx/trash:/usr/src/paperless/trash:rw
    environment:
      PAPERLESS_REDIS: redis://:redispass@paper-redis:6379
      PAPERLESS_DBENGINE: postgresql
      PAPERLESS_DBHOST: PgBouncer
      PAPERLESS_DBPORT: 6432
      PAPERLESS_DBNAME: paperless
      PAPERLESS_DBUSER: paperless
      PAPERLESS_DBPASS: ${PAPERLESS_DBPASS}
      PAPERLESS_EMPTY_TRASH_DIR: ../trash
      PAPERLESS_FILENAME_FORMAT: '{created_year}/{correspondent}/{document_type}/{title}'
      PAPERLESS_OCR_ROTATE_PAGES_THRESHOLD: 6
      PAPERLESS_OCR_PAGES: 0  # Process all pages (current default)
      PAPERLESS_OCR_MODE: skip  # Skip OCR on already-OCRed docs (current default)
      PAPERLESS_TASK_WORKERS: 2
      PAPERLESS_THREADS_PER_WORKER: 2  # For OCR parallelization
      PAPERLESS_WEBSERVER_WORKERS: 1  # Keep at 1 for 4-core system
      USERMAP_UID: 1026
      USERMAP_GID: 100
      PAPERLESS_TIME_ZONE: America/Los_Angeles
      PAPERLESS_ADMIN_USER: stray
      PAPERLESS_ADMIN_PASSWORD: ${PAPERLESS_ADMIN_PASSWORD}
      PAPERLESS_URL: https://paperlessngx.straymoog.xyz
      PAPERLESS_CSRF_TRUSTED_ORIGINS: https://paperlessngx.straymoog.xyz
      PAPERLESS_OCR_LANGUAGE: eng
      PAPERLESS_TIKA_ENABLED: 1
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
      PAPERLESS_OCR_USER_ARGS: '{"invalidate_digital_signatures": true}'
      PAPERLESS_DB_READ_CACHE_ENABLED: true
      PAPERLESS_READ_CACHE_TTL: 3600  # 1 hour cache
      PAPERLESS_DB_POOLSIZE: 4
    restart: on-failure:5
    depends_on:
      redis:
        condition: service_healthy
      tika:
        condition: service_started
      gotenberg:
        condition: service_started
    networks:
      - paperless-ngx_default
      - paperless_shared
    deploy:
      resources:
        limits:
          memory: 5G
        reservations:
          memory: 2.5G

networks:
  paperless-ngx_default:
    driver: bridge
  paperless_shared:
    external: true
    name: paperless_shared