Bring 15 stale entries in line with current private configs

Several of these had drifted so far they were unrecognizable (Nextcloud
was a bare minio stub, Ollama was missing the ollama service entirely,
Immich was missing 2 of 4 services). Also removed a real, exposed
Authentik OAuth client_id/secret that was sitting in Paperless-NGX's
entry (confirmed stale/rotated already, but shouldn't have been public
regardless) and stripped internal Caddy CA trust details from every
file per the same rule applied to nocodb/dashy etc.

Docker/Immich/docker-compose.yaml

@@ -4,76 +4,72 @@ services:
     environment:
       - PUID=${PUID}
       - PGID=${PGID}
-      - TZ=${TZ} 
+      - TZ=${TZ}
     image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
-    command: [ "start.sh", "immich" ]
     volumes:
-      - /path/to/upload:/usr/src/app/upload
+      - /path/to/immich/data:/data
+      - /path/to/immich/upload:/usr/src/app/upload
+      - /path/to/external-library-1:/path/to/external-library-1:ro
+      - /path/to/external-library-2:/path/to/external-library-2:ro
     env_file:
       - .env
     ports:
-      - ${HTTP_PORT}:3001
+      - ${HTTP_PORT}:2283
     depends_on:
       - redis
       - database
-    restart: always
-
-  immich-microservices:
-    container_name: immich_microservices
-    environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ} 
-    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
-    extends:
-      file: hwaccel.yml
-      service: hwaccel
-    command: [ "start.sh", "microservices" ]
-    volumes:
-      - /path/to/upload:/usr/src/app/upload
-    env_file:
-      - .env
-    depends_on:
-      - redis
-      - database
-    restart: always
+    restart: unless-stopped
+    networks:
+      - immich-net
 
   immich-machine-learning:
     container_name: immich_machine_learning
     environment:
       - PUID=${PUID}
       - PGID=${PGID}
-      - TZ=${TZ} 
+      - TZ=${TZ}
     image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
     volumes:
       - /path/to/immich/model-cache:/cache
     env_file:
       - .env
-    restart: always
+    restart: unless-stopped
+    networks:
+      - immich-net
 
   redis:
     container_name: immich_redis
+    image: redis:6.2-alpine
     environment:
       - PUID=${PUID}
       - PGID=${PGID}
-      - TZ=${TZ} 
-    image: redis:6.2-alpine@sha256:70a7a5b641117670beae0d80658430853896b5ef269ccf00d1827427e3263fa3
-    restart: always
+      - TZ=${TZ}
+    volumes:
+      - /path/to/immich/redis:/data
+    restart: unless-stopped
+    networks:
+      - immich-net
 
   database:
     container_name: immich_postgres
-    image: registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
+    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
     env_file:
       - .env
     environment:
       - PUID=${PUID}
       - PGID=${PGID}
-      - TZ=${TZ} 
+      - TZ=${TZ}
       - POSTGRES_PASSWORD=${DB_PASSWORD}
       - POSTGRES_USER=${DB_USERNAME}
       - POSTGRES_DB=${DB_DATABASE_NAME}
+      - POSTGRES_INITDB_ARGS='--data-checksums'
     volumes:
       - /path/to/immich/pgdata:/var/lib/postgresql/data
-    restart: always
+    shm_size: 128mb
+    restart: unless-stopped
+    networks:
+      - immich-net
 
-## there is a known issue with Traefik: see here https://github.com/immich-app/immich/discussions/437#discussioncomment-3609797
+networks:
+  immich-net:
+    external: true