Bring 15 stale entries in line with current private configs

Several of these had drifted so far they were unrecognizable (Nextcloud
was a bare minio stub, Ollama was missing the ollama service entirely,
Immich was missing 2 of 4 services). Also removed a real, exposed
Authentik OAuth client_id/secret that was sitting in Paperless-NGX's
entry (confirmed stale/rotated already, but shouldn't have been public
regardless) and stripped internal Caddy CA trust details from every
file per the same rule applied to nocodb/dashy etc.

Docker/Paperless-NGX/docker-compose.yaml

@@ -1,14 +1,16 @@
 services:
   broker:
-    image: docker.io/library/redis:latest
+    image: docker.io/library/redis:7
+    container_name: paperless-redis
     restart: unless-stopped
     volumes:
       - /path/to/paperless/redisdata:/data
     networks:
-      paperless:
+      - paperless-net
 
   db:
-    image: docker.io/library/postgres:latest
+    image: docker.io/library/postgres:15
+    container_name: paperless-postgres
     restart: unless-stopped
     volumes:
       - /path/to/paperless/pgdata:/var/lib/postgresql/data
@@ -17,10 +19,11 @@ services:
       POSTGRES_USER: ${POSTGRES_USER}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
     networks:
-      paperless:
+      - paperless-net
 
   webserver:
     image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    container_name: paperless
     restart: unless-stopped
     depends_on:
       - db
@@ -28,7 +31,7 @@ services:
       - gotenberg
       - tika
     ports:
-      - "8005:8000"
+      - "${HTTP_PORT}:8000"
     volumes:
       - /path/to/paperless/data:/usr/src/paperless/data
       - /path/to/paperless/media:/usr/src/paperless/media
@@ -45,16 +48,13 @@ services:
       PAPERLESS_URL: ${PAPERLESS_URL}
       PAPERLESS_ADMIN_USER: ${PAPERLESS_ADMIN_USER}
       PAPERLESS_ADMIN_PASSWORD: ${PAPERLESS_ADMIN_PASSWORD}
-      PAPERLESS_APPS: "allauth.socialaccount.providers.openid_connect"
-      # Find out how to configure Authentik: https://youtu.be/enwFWELCYJo
-      PAPERLESS_SOCIALACCOUNT_PROVIDERS: '{"openid_connect": {"APPS": [{"provider_id": "authentik","name": "Authentik SSO","client_id": "0gGOZHjx1iJAlh5wN8m1b7uZKwWnPaClGJNKhQDV","secret": "oqskOOlJ1TJzedWZR9WmcVKmxn1HFqGIroi6oiB5xh03qCofuyIDh2DDaf8OnlTybOMiBQkz9rLNO17s4Bx1aG8aGIErp1n6ly0WwQJOk38Tbq3ctOyZGFagEvysp6o2","settings": { "server_url": "https://authentik.local.thesabear.net/application/o/paperless/.well-known/openid-configuration"}}]}}'
     networks:
-      paperless:
+      - paperless-net
 
   gotenberg:
-    image: docker.io/gotenberg/gotenberg:latest
+    image: docker.io/gotenberg/gotenberg:7.10
+    container_name: paperless-gotenberg
     restart: unless-stopped
-
     # The gotenberg chromium route is used to convert .eml files. We do not
     # want to allow external content like tracking pixels or even javascript.
     command:
@@ -62,14 +62,15 @@ services:
       - "--chromium-disable-javascript=true"
       - "--chromium-allow-list=file:///tmp/.*"
     networks:
-      paperless:
+      - paperless-net
 
   tika:
-    image: ghcr.io/paperless-ngx/tika:latest
+    image: docker.io/apache/tika:latest
+    container_name: paperless-tika
     restart: unless-stopped
     networks:
-      paperless:
+      - paperless-net
 
 networks:
-  paperless:
+  paperless-net:
     external: true