version: '3.9'

services:
  paperless:
    image: paperlessngx/paperless-ngx:2.10.3
    environment:
      PAPERLESS_REDIS: redis://redis_redis_master:6379
      PAPERLESS_DBHOST: postgresql_postgresql_primary
      PAPERLESS_DBNAME: paperless
      PAPERLESS_DBUSER: postgres
      PAPERLESS_DBPASS_FILE: /run/secrets/pg_root_password
      # CSRF and reverse proxy configuration
      PAPERLESS_URL: https://paperless.pressmess.duckdns.org
      PAPERLESS_CSRF_TRUSTED_ORIGINS: https://paperless.pressmess.duckdns.org
      PAPERLESS_ALLOWED_HOSTS: paperless.pressmess.duckdns.org
      # Security settings for reverse proxy
      PAPERLESS_USE_X_FORWARDED_HOST: true
      PAPERLESS_USE_X_FORWARDED_PORT: true
      PAPERLESS_SECURE_SSL_REDIRECT: true
      # Additional security headers
      PAPERLESS_SECURE_BROWSER_XSS_FILTER: true
      PAPERLESS_SECURE_CONTENT_TYPE_NOSNIFF: true
      PAPERLESS_SECURE_HSTS_INCLUDE_SUBDOMAINS: true
      PAPERLESS_SECURE_HSTS_SECONDS: 31536000
    secrets:
      - pg_root_password
    volumes:
      - paperless_data:/usr/src/paperless/data
      - paperless_media:/usr/src/paperless/media
    networks:
      - caddy-public
      - monitoring-network
    ports:
      - "8000:8000"
    deploy:
      labels:
        - caddy.enable=true
        - caddy.http.routers.paperless.rule=Host(`paperless.pressmess.duckdns.org`)
        - caddy.http.routers.paperless.entrypoints=websecure
        - caddy.http.routers.paperless.tls=true
        - caddy.http.services.paperless.loadbalancer.server.port=8000

volumes:
  paperless_data:
    driver: local
    driver_opts:
      type: nfs
      o: addr=omv800.local,nolock,soft,rw
      device: :/export/paperless
  paperless_media:
    driver: local
    driver_opts:
      type: nfs
      o: addr=omv800.local,nolock,soft,rw
      device: :/srv/mergerfs/DataPool/pdfs

secrets:
  pg_root_password:
    external: true

networks:
  caddy-public:
    external: true
  monitoring-network:
    external: true
