---
version: '3'
services:
  miniflux:
    image: miniflux/miniflux:latest
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      - DATABASE_URL=postgres://{{ miniflux.db.user }}:{{ miniflux.db.password }}@db/{{ miniflux.db.name }}?sslmode=disable
      - RUN_MIGRATIONS=1
      - CREATE_ADMIN=1
      - ADMIN_USERNAME={{ miniflux.admin.user }}
      - ADMIN_PASSWORD={{ miniflux.admin.password }}
      - BASE_URL=https://rss.tobiasmanske.de
      - OAUTH2_CLIENT_ID={{ miniflux.oauth.client_id }}
      - OAUTH2_CLIENT_SECRET={{ miniflux.oauth.client_secret }}
      - OAUTH2_OIDC_DISCOVERY_ENDPOINT={{ miniflux.oauth.discovery_endpoint }}
      - OAUTH2_PROVIDER=oidc
      - OAUTH2_REDIRECT_URL={{ miniflux.oauth.redirect_url }}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.miniflux.rule=Host(`rss.tobiasmanske.de`)"
      - "traefik.http.routers.miniflux.entryPoints=websecure"
      - "traefik.http.services.miniflux.loadbalancer.server.port=8080"
      - "com.centurylinklabs.watchtower.scope=update"
    networks:
      - backend
      - gateway

  db:
    image: postgres:13
    restart: unless-stopped
    environment:
      - POSTGRES_USER={{ miniflux.db.user }}
      - POSTGRES_PASSWORD={{ miniflux.db.password }}
    labels:
      - "com.centurylinklabs.watchtower.scope=update"
    volumes:
      - database:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "miniflux"]
      interval: 10s
      start_period: 30s
    networks:
      - backend

volumes:
  database:

networks:
  backend:
    internal: true
  gateway:
    external: true
    name: gateway
...