fix: Parameterize paperless-ngx-postgres image tags and fix version mismatch

Postgres was set to 16 but data directory was initialized with 13, causing
crash loop. Gotenberg was pinned at 7.4 but paperless 2.17.1 requires 8.x.
All three supporting service tags (postgres, gotenberg, redis) are now
configurable via paperless-ngx-postgres.env with safe defaults.

Author: crack-kitty

SERVICES.md

@@ -82,10 +82,10 @@
 - [dashdot](https://github.com/MauriceNino/dashdot) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/dashdot.yml)): Dashboard for monitoring docker containers
 - [dashy](https://github.com/Lissy93/dashy) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/dashy.yml)): Customizable dashboard for displaying information
 - [dawarich](https://github.com/Freika/dawarich) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/dawarich.yml)): Self-hostable alternative to Google Location History (Google Maps Timeline)
-- [dockerizalo](https://github.com/undernightcore/dockerizalo) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/dockerizalo.yml)): Docker build and deployment platform
 - [docker-mirror](https://hub.docker.com/_/registry) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/docker-mirror.yml)): docker mirror / registry for caching docker images
 - [docker-proxy](https://github.com/Tecnativa/docker-socket-proxy) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/docker-proxy.yml)): Proxy for docker containers
 - [docker-registry](https://hub.docker.com/_/registry) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/docker-registry.yml)): Registry for storing and distributing container images
+- [dockerizalo](https://github.com/undernightcore/dockerizalo) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/dockerizalo.yml)): Docker build and deployment platform
 - [dockpeek-socket-proxy](https://github.com/dockpeek/dockpeek) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/dockpeek-socket-proxy.yml)): Proxy service for Dockpeek
 - [dockpeek](https://github.com/dockpeek/dockpeek) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/dockpeek.yml)): Docker Port Dashboard for Easy Container Access
 - [docling](https://github.com/docling-project/docling-serve) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/docling.yml)): AI-powered document parsing and processing service with GPU acceleration
@@ -105,8 +105,8 @@
 
 ## F
 - [feishin](https://github.com/jeffvli/feishin) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/feishin.yml)): A modern self-hosted music player.
-- [firefly3](https://github.com/firefly-iii/firefly-iii/tree/main) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/firefly3.yml)): Manages personal finances and budgets
 - [firefly-data-importer](https://github.com/firefly-iii/firefly-iii/tree/main) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/firefly-data-importer.yml)): Imports data into firefly iii, a personal finance manager
+- [firefly3](https://github.com/firefly-iii/firefly-iii/tree/main) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/firefly3.yml)): Manages personal finances and budgets
 - [firefox](https://github.com/linuxserver/docker-firefox) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/firefox.yml)): Runs mozilla firefox browser in a container
 - [flame](https://github.com/pawelmalak/flame) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/flame.yml)): homepage/dashboard for docker containers and services
 - [fooocus](https://github.com/lllyasviel/Fooocus) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/fooocus.yml)): Focus on prompting and generating | a generative image generator
@@ -129,8 +129,8 @@
 - [gitea](https://github.com/go-gitea/gitea) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/gitea.yml)): Lightweight git service similar to github
 - [github-backup](https://github-backup.sierrasoftworks.com/) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/github-backup.yml)): Runs GitHub Backup to periodically archive GitHub repositories and releases
 - [gitlab](https://docs.gitlab.com/ee/install/docker.html) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/gitlab.yml)): Self-hosted git repository management system
-- [glances](https://github.com/nicolargo/glances) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/glances.yml)): System monitoring tool
 - [glance](https://github.com/glanceapp/glance) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/glance.yml)): A self-hosted dashboard that puts all your feeds in one place
+- [glances](https://github.com/nicolargo/glances) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/glances.yml)): System monitoring tool
 - [gluetun](https://github.com/qdm12/gluetun) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/gluetun.yml)): VPN Client for Docker Containers and More
 - [go2rtc](https://github.com/AlexxIT/go2rtc) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/go2rtc.yml)): Webrtc gateway for camera restreaming 
 - [gotify](https://github.com/gotify/server) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/gotify.yml)): Self-hosted push notification service
@@ -335,8 +335,8 @@
 
 ## V
 - [valkey](https://valkey.io) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/valkey.yml)): Shared Valkey cache server for multiple services
-- [vaultwarden](https://github.com/dani-garcia/vaultwarden) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/vaultwarden.yml)): Self-hosted bitwarden password manager
 - [vault](https://github.com/hashicorp/vault) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/vault.yml)): A tool for secrets management, encryption as a service, and privileged access management
+- [vaultwarden](https://github.com/dani-garcia/vaultwarden) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/vaultwarden.yml)): Self-hosted bitwarden password manager
 - [vert](https://github.com/VERT-sh/VERT) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/vert.yml)): 
 - [vikunja](https://vikunja.io/docs/full-docker-example/) ([yml](https://github.com/traefikturkey/onramp/tree/main/services-available/vikunja.yml)): Task and time management app
 

services-available/paperless-ngx-postgres.yml

@@ -9,16 +9,13 @@ networks:
 # https://hub.docker.com/r/linuxserver/paperless-ngx
 # https://docs.paperless-ngx.com/
 #
-# IMPORTANT: Upgraded from postgres:13 to postgres:16
-# If you get "PostgreSQL 14 or later is required" error after upgrade:
-# 1. make stop-service paperless-ngx-postgres
-# 2. sudo rm -rf /apps/onramp/etc/paperless-ngx-postgres/pgdata/*
-# 3. make start-service paperless-ngx-postgres
-# (This recreates the database - only do this if data is not important)
+# IMPORTANT: Postgres data directory must match the image version.
+# To upgrade postgres, do a pg_dump on the old version, update the tag,
+# then restore. Never change the tag without migrating data first.
 
 services:
   broker:
-    image: docker.io/library/redis:6.0 #pinned for kitty
+    image: docker.io/library/redis:${PAPERLESS_REDIS_TAG:-7}
     env_file:
       - ./services-enabled/paperless-ngx-postgres.env
     restart: unless-stopped
@@ -28,7 +25,7 @@ services:
       - ./etc/paperless-ngx-postgres/redisdata:/data
 
   db:
-    image: postgres:16
+    image: postgres:${PAPERLESS_POSTGRES_TAG:-13}
     env_file:
       - ./services-enabled/paperless-ngx-postgres.env
     restart: unless-stopped
@@ -42,7 +39,7 @@ services:
       POSTGRES_PASSWORD: paperless
 
   gotenberg:
-    image: docker.io/gotenberg/gotenberg:7.4 #pinned for kitty
+    image: docker.io/gotenberg/gotenberg:${PAPERLESS_GOTENBERG_TAG:-8}
     env_file:
       - ./services-enabled/paperless-ngx-postgres.env
     restart: unless-stopped