Portainer/paperless/docker-compose.yml

services:
  paperless-db:
    image: postgres:18
    container_name: paperless-db
    restart: unless-stopped
    labels:
      prune.protect: "true"
    environment:
      TZ: ${TZ}
      POSTGRES_DB: ${PAPERLESS_DBNAME}
      POSTGRES_USER: ${PAPERLESS_DBUSER}
      POSTGRES_PASSWORD: ${PAPERLESS_DBPASS}
    volumes:
      - /opt/paperless/pgdata:/var/lib/postgresql:Z
    networks:
      - paperless_internal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${PAPERLESS_DBUSER} -d ${PAPERLESS_DBNAME}"]
      interval: 5s
      timeout: 5s
      retries: 10

  paperless-redis:
    image: redis:8
    container_name: paperless-redis
    restart: unless-stopped
    labels:
      prune.protect: "true"
    volumes:
      - /opt/paperless/redis:/data:Z
    networks:
      - paperless_internal
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 10

  paperless-gotenberg:
    image: gotenberg/gotenberg:8.27
    container_name: paperless-gotenberg
    restart: unless-stopped
    labels:
      prune.protect: "true"
    command:
      - "gotenberg"
      - "--chromium-disable-javascript=true"
      - "--chromium-allow-list=file:///tmp/.*"
    networks:
      - paperless_internal
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 5s
      timeout: 5s
      retries: 10

  paperless-tika:
    image: apache/tika@sha256:c0154cb95587cde64be74f35ada1a2bd7892219f3f0ac3c9dc6cab34046b3573
    container_name: paperless-tika
    restart: unless-stopped
    labels:
      prune.protect: "true"
    networks:
      - paperless_internal
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'exec 3<>/dev/tcp/localhost/9998'"]
      interval: 5s
      timeout: 5s
      retries: 10

  paperless:
    image: ghcr.io/paperless-ngx/paperless-ngx@sha256:6c86cad803970ea782683a8e80e7403444c5bf3cf70de63b4d3c8e87500db92f
    container_name: paperless
    restart: unless-stopped
    depends_on:
      paperless-db:
        condition: service_healthy
      paperless-redis:
        condition: service_healthy
      paperless-gotenberg:
        condition: service_healthy
      paperless-tika:
        condition: service_healthy
    environment:
      TZ: ${TZ}

      PAPERLESS_REDIS: redis://paperless-redis:6379
      PAPERLESS_DBHOST: paperless-db
      PAPERLESS_DBENGINE: postgresql
      PAPERLESS_DBNAME: ${PAPERLESS_DBNAME}
      PAPERLESS_DBUSER: ${PAPERLESS_DBUSER}
      PAPERLESS_DBPASS: ${PAPERLESS_DBPASS}

      PAPERLESS_URL: https://${PAPERLESS_DOMAIN}
      PAPERLESS_SECRET_KEY: ${PAPERLESS_SECRET_KEY}
      PAPERLESS_ALLOWED_HOSTS: ${PAPERLESS_ALLOWED_HOSTS}
      PAPERLESS_CSRF_TRUSTED_ORIGINS: https://${PAPERLESS_DOMAIN}
      PAPERLESS_TRUSTED_PROXIES: ${TRUSTED_PROXIES}

      PAPERLESS_ADMIN_USER: ${PAPERLESS_ADMIN_USER}
      PAPERLESS_ADMIN_PASSWORD: ${PAPERLESS_ADMIN_PASSWORD}
      PAPERLESS_ADMIN_MAIL: ${PAPERLESS_ADMIN_MAIL}

      PAPERLESS_TIKA_ENABLED: 1
      PAPERLESS_TIKA_ENDPOINT: http://paperless-tika:9998
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://paperless-gotenberg:3000

      PAPERLESS_EMAIL_HOST: ${PAPERLESS_EMAIL_HOST}
      PAPERLESS_EMAIL_PORT: ${PAPERLESS_EMAIL_PORT}
      PAPERLESS_EMAIL_USE_TLS: ${PAPERLESS_EMAIL_USE_TLS}
      PAPERLESS_EMAIL_USE_SSL: ${PAPERLESS_EMAIL_USE_SSL}
      PAPERLESS_EMAIL_FROM: ${PAPERLESS_EMAIL_FROM}
      PAPERLESS_EMAIL_HOST_USER: ${PAPERLESS_EMAIL_HOST_USER}
      PAPERLESS_EMAIL_HOST_PASSWORD: ${PAPERLESS_EMAIL_HOST_PASSWORD}

      # Más robusto cuando los ficheros llegan por sync/mount y no por inotify puro
      PAPERLESS_CONSUMER_POLLING: ${PAPERLESS_CONSUMER_POLLING}
    volumes:
      - /opt/paperless/data:/usr/src/paperless/data:Z
      - /opt/paperless/media:/usr/src/paperless/media:Z
      - /opt/paperless/export:/usr/src/paperless/export:Z
      - /opt/paperless/consume:/usr/src/paperless/consume:Z
    networks:
      - paperless_internal
      - proxy
      - mail_internal
    labels:
      prune.protect: "true"




  paperless-ai:
    image: admonstrator/paperless-ai-next:v2026.07.03
    container_name: paperless-ai
    restart: unless-stopped
    depends_on:
      paperless:
        condition: service_healthy
    environment:
      TZ: ${TZ}
      TRUST_PROXY: "true"
    volumes:
      - /opt/paperless-ai/data:/app/data:Z
    networks:
      - paperless_internal
      - proxy
    labels:
      - prune.protect=true



      - homepage.group=Productividad
      - homepage.name=Paperless AI
      - homepage.icon=https://media.sys.truenas.net/apps/paperless-ai/icons/icon.png
      - homepage.description=Complemento IA para Paperless
      - homepage.href=https://${PAPERLESS_AI_DOMAIN}
      - homepage.siteMonitor=https://${PAPERLESS_AI_DOMAIN}

  # Sync unidireccional: Nextcloud/Paperless-Inbox -> paperless/consume
  paperless-inbox-sync:
    image: rclone/rclone@sha256:8a17d9b5cd5ce71bbb42e49e92ee83575d7fb03f6233d949d328e9d029b9376d
    container_name: paperless-inbox-sync
    restart: unless-stopped
    labels:
      prune.protect: "true"
    depends_on:
      paperless:
        condition: service_healthy
    entrypoint:
      - /bin/sh
      - /rclone-sync.sh
    environment:
      TZ: ${TZ}

      RCLONE_CONFIG_NC_TYPE: webdav
      RCLONE_CONFIG_NC_URL: https://${NC_DOMAIN}/remote.php/dav/files/${NC_WEBDAV_USER}
      RCLONE_CONFIG_NC_VENDOR: nextcloud
      RCLONE_CONFIG_NC_USER: ${NC_WEBDAV_USER}
      RCLONE_CONFIG_NC_PASS: ${NC_WEBDAV_PASS}

      RCLONE_SYNC_INTERVAL: ${RCLONE_SYNC_INTERVAL}
      PAPERLESS_INBOX_DIR: ${PAPERLESS_INBOX_DIR}
    volumes:
      - /opt/paperless/consume:/consume:Z
      - /opt/rclone:/config/rclone:Z
      - /opt/paperless/rclone-sync.sh:/rclone-sync.sh:ro,Z
    networks:
      - paperless_internal

networks:
  paperless_internal:
    driver: bridge

  proxy:
    external: true

  mail_internal:
    external: true