feat(stack): add Paperless-ngx document management system

- Add paperless.yml stack (port 8091, documents.schweitz.net)
- Uses shared postgres (DB: paperless) and redis (DB 8)
- ClamAV installed on host for virus scanning (port 3310)
- Add Paperless integration to library-desk stack
- Update CONTAINERS.md with Paperless and ClamAV profiles
- Add Portainer and NPM API documentation to setup-new-host.md
- Update redis-shared.yml and postgres-shared.yml with Paperless refs

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

stacks/library-desk.yml

@@ -35,6 +35,10 @@ services:
       # SearXNG Configuration
       - SEARXNG_URL=http://searxng:8080
 
+      # Paperless Configuration
+      - PAPERLESS_URL=http://paperless:8000
+      - PAPERLESS_TOKEN=${PAPERLESS_TOKEN}
+
       # Ollama Configuration (for embeddings)
       - OLLAMA_URL=http://ollama:11434
       - OLLAMA_MODEL=nomic-embed-text

stacks/paperless.yml

@@ -0,0 +1,110 @@
+version: '3.8'
+
+# Paperless-ngx - Document Management System
+# Port: 8091 (HTTP)
+# GPU: No
+# External: documents.schweitz.net
+# Storage: Configs on SSD (backed up), documents on HDD
+
+services:
+  paperless:
+    image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    container_name: paperless
+    restart: unless-stopped
+    ports:
+      - "8091:8000"
+    volumes:
+      # SSD - configs and database (backed up)
+      - /home/jpmschweitzer/docker-data/paperless/data:/usr/src/paperless/data
+      # HDD - document storage
+      - /mnt/media/paperless/media:/usr/src/paperless/media
+      - /mnt/media/paperless/consume:/usr/src/paperless/consume
+      - /mnt/media/paperless/export:/usr/src/paperless/export
+    environment:
+      # Database (shared PostgreSQL)
+      PAPERLESS_DBENGINE: postgresql
+      PAPERLESS_DBHOST: postgres-shared
+      PAPERLESS_DBPORT: 5432
+      PAPERLESS_DBNAME: paperless
+      PAPERLESS_DBUSER: paperless_user
+      PAPERLESS_DBPASS: ${PAPERLESS_DB_PASSWORD}
+
+      # Redis (shared, DB 8)
+      PAPERLESS_REDIS: redis://redis-shared:6379/8
+
+      # Security
+      PAPERLESS_SECRET_KEY: ${PAPERLESS_SECRET_KEY}
+
+      # URLs
+      PAPERLESS_URL: https://documents.schweitz.net
+      PAPERLESS_ALLOWED_HOSTS: "*"
+      PAPERLESS_CORS_ALLOWED_HOSTS: "http://localhost:8091,https://documents.schweitz.net"
+
+      # OCR Settings
+      PAPERLESS_OCR_LANGUAGE: eng
+      PAPERLESS_OCR_LANGUAGES: nld  # Install Dutch on first startup
+      PAPERLESS_OCR_MODE: skip
+      PAPERLESS_OCR_OUTPUT_TYPE: pdfa
+
+      # Webhooks (for Library Desk integration)
+      PAPERLESS_WEBHOOKS_ALLOW_INTERNAL_REQUESTS: "true"
+
+      # Admin user (created on first run)
+      PAPERLESS_ADMIN_USER: admin
+      PAPERLESS_ADMIN_PASSWORD: ${PAPERLESS_ADMIN_PASSWORD}
+
+      # Timezone
+      TZ: Europe/Amsterdam
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+    deploy:
+      resources:
+        limits:
+          memory: 4G
+        reservations:
+          memory: 512M
+    networks:
+      - docker-dataplane
+
+networks:
+  docker-dataplane:
+    external: true
+    name: docker-dataplane
+
+# =============================================================================
+# DEPLOYMENT INSTRUCTIONS
+# =============================================================================
+#
+# 1. Environment variables required in Portainer:
+#    PAPERLESS_DB_PASSWORD=<openssl rand -hex 32>
+#    PAPERLESS_SECRET_KEY=<openssl rand -base64 32>
+#    PAPERLESS_ADMIN_PASSWORD=<your-admin-password>
+#
+# 2. Database already created in postgres-shared:
+#    Database: paperless
+#    User: paperless_user
+#
+# 3. Redis using shared instance DB 8
+#
+# 4. After deployment, configure NPM:
+#    Domain: documents.schweitz.net
+#    Forward: paperless:8000 or 192.168.86.149:8091
+#    SSL: Let's Encrypt
+#    Websockets: Enable
+#
+# 5. Post-deployment in Paperless UI:
+#    - Create API token (My Profile → API Token)
+#    - Create custom fields: source_url, library_indexed, library_doc_id, collection
+#    - Create webhook workflow to http://library-desk:8089/documents/webhook
+#
+# 6. ClamAV is running on host at 192.168.86.149:3310
+#    Configure Library Desk with:
+#    CLAMAV_HOST=192.168.86.149
+#    CLAMAV_PORT=3310
+#    CLAMAV_ENABLED=true

stacks/postgres-shared.yml

@@ -133,4 +133,5 @@ networks:
 #   - Authentik (identity provider)
 #   - Gitea (git hosting) - migrated from dedicated instance
 #   - Nextcloud (personal cloud storage) - migrated from MariaDB
+#   - Paperless-ngx (document management) - DB: paperless, User: paperless_user
 #   - Future applications as needed

stacks/redis-shared.yml

@@ -63,11 +63,16 @@ networks:
 #
 # Redis supports 16 databases (0-15). Assign one per application:
 #
-#   DB 0: General cache (default, shared lightweight caching)
-#   DB 1: Authentik (sessions, cache, message queue)
-#   DB 2: Gitea (cache, sessions)
-#   DB 3: Nextcloud (file locking, distributed cache, sessions)
-#   DB 4-15: Reserved for future applications
+#   DB 0: Authentik (sessions, cache, message queue)
+#   DB 1: Tatlock (memory)
+#   DB 2: Wiki.js
+#   DB 3: Scheduler
+#   DB 4: Library Desk
+#   DB 5: SearXNG
+#   DB 6: Tatlock (benchmarks)
+#   DB 7: Nextcloud (file locking, distributed cache, sessions)
+#   DB 8: Paperless (task queue, cache)
+#   DB 9-15: Reserved for future applications
 #
 # Connection Examples:
 #