{% import 'macro/postgres.j2' as pg with context %}
---
version: '3'
services:
  miniflux:
    image: miniflux/miniflux:latest
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      - FETCH_YOUTUBE_WATCH_TIME=1
      - DATABASE_URL=postgres://{{ miniflux.db.user }}:{{ miniflux.db.password }}@db/{{ miniflux.db.name }}?sslmode=disable
      - RUN_MIGRATIONS=1
      - CREATE_ADMIN=1
      - ADMIN_USERNAME={{ miniflux.admin.user }}
      - ADMIN_PASSWORD={{ miniflux.admin.password }}
      - BASE_URL=https://rss.tobiasmanske.de
      - CLEANUP_ARCHIVE_READ_DAYS=-1
      - OAUTH2_CLIENT_ID={{ miniflux.oauth.client_id }}
      - OAUTH2_CLIENT_SECRET={{ miniflux.oauth.client_secret }}
      - OAUTH2_OIDC_DISCOVERY_ENDPOINT={{ miniflux.oauth.discovery_endpoint }}
      - OAUTH2_PROVIDER=oidc
      - OAUTH2_REDIRECT_URL={{ miniflux.oauth.redirect_url }}
      - OAUTH2_USER_CREATION=1
      - METRICS_COLLECTOR=1
      - METRICS_ALLOWED_NETWORKS=0.0.0.0/0
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=${COMPOSE_PROJECT_NAME}_default"
      - "traefik.http.routers.miniflux.rule=Host(`rss.tobiasmanske.de`)"
      - "traefik.http.routers.miniflux.entryPoints=websecure"
      - "traefik.http.routers.miniflux.middlewares=deny-metrics@file"
      - "traefik.http.services.miniflux.loadbalancer.server.port=8080"
      - "prometheus-scrape.enabled=true"
      - "prometheus-scrape.port=8080"
    networks:
      - backend
      - pantalaimon
      - default
      - metrics

{{ pg.postgres("db", miniflux.db.user, miniflux.db.password, miniflux.db.user, ["backend"], version="13") }}

volumes:
  db_data:

networks:
  backend:
    internal: true
  pantalaimon:
    external: true
  metrics:
    external: true
  postgres:
    internal: true
...