---
version: '3'
services:
  miniflux:
    image: miniflux/miniflux:latest
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      - FETCH_YOUTUBE_WATCH_TIME=1
      - DATABASE_URL=postgres://{{ miniflux.db.user }}:{{ miniflux.db.password }}@db/{{ miniflux.db.name }}?sslmode=disable
      - RUN_MIGRATIONS=1
      - CREATE_ADMIN=1
      - ADMIN_USERNAME={{ miniflux.admin.user }}
      - ADMIN_PASSWORD={{ miniflux.admin.password }}
      - BASE_URL=https://rss.tobiasmanske.de
      - CLEANUP_ARCHIVE_READ_DAYS=-1
      - OAUTH2_CLIENT_ID={{ miniflux.oauth.client_id }}
      - OAUTH2_CLIENT_SECRET={{ miniflux.oauth.client_secret }}
      - OAUTH2_OIDC_DISCOVERY_ENDPOINT={{ miniflux.oauth.discovery_endpoint }}
      - OAUTH2_PROVIDER=oidc
      - OAUTH2_REDIRECT_URL={{ miniflux.oauth.redirect_url }}
      - OAUTH2_USER_CREATION=1
      - METRICS_COLLECTOR=1
      - METRICS_ALLOWED_NETWORKS=0.0.0.0/0
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=${COMPOSE_PROJECT_NAME}_default"
      - "traefik.http.routers.miniflux.rule=Host(`rss.tobiasmanske.de`)"
      - "traefik.http.routers.miniflux.entryPoints=websecure"
      - "traefik.http.routers.miniflux.middlewares=deny-metrics@file"
      - "traefik.http.services.miniflux.loadbalancer.server.port=8080"
      - "prometheus-scrape.enabled=true"
      - "prometheus-scrape.port=8080"
    networks:
      - backend
      - pantalaimon
      - default
      - metrics

  db:
    image: postgres:13
    restart: unless-stopped
    environment:
      - POSTGRES_USER={{ miniflux.db.user }}
      - POSTGRES_PASSWORD={{ miniflux.db.password }}
    volumes:
      - database:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "{{ miniflux.db.user }}"]
      interval: 10s
      start_period: 30s
    networks:
      - backend

volumes:
  database:

networks:
  backend:
    internal: true
  pantalaimon:
    external: true
  metrics:
    external: true
...