---
secrets:
  miniflux_postgres_connection:
    file: ../secrets/miniflux_postgres_connection
  miniflux_oauth2_client_id:
    file: ../secrets/miniflux_oauth2_client_id
  miniflux_oauth2_client_secret:
    file: ../secrets/miniflux_oauth2_client_secret

services:
  miniflux:
    image: miniflux/miniflux:2.2.16
    container_name: miniflux
    depends_on:
      - authentik-server
      - postgres
    networks:
      public:
        ipv4_address: 192.168.240.35
    labels:
      caddy: miniflux.${DOMAIN}
      caddy.reverse_proxy: "{{ upstreams 8080 }}"
    secrets:
      - miniflux_postgres_connection
      - miniflux_oauth2_client_id
      - miniflux_oauth2_client_secret
    environment:
      - BASE_URL=https://miniflux.${DOMAIN}
      - DATABASE_URL_FILE=/run/secrets/miniflux_postgres_connection
      - RUN_MIGRATIONS=1
      - CLEANUP_ARCHIVE_READ_DAYS=3650 # remove after 10 years
      - CLEANUP_ARCHIVE_UNREAD_DAYS=-1 # never remove unread entries
      - DISABLE_LOCAL_AUTH=TRUE
      - OAUTH2_PROVIDER=oidc
      - OAUTH2_CLIENT_ID_FILE=/run/secrets/miniflux_oauth2_client_id
      - OAUTH2_CLIENT_SECRET_FILE=/run/secrets/miniflux_oauth2_client_secret
      - OAUTH2_REDIRECT_URL=https://miniflux.${DOMAIN}/oauth2/oidc/callback
      - OAUTH2_OIDC_DISCOVERY_ENDPOINT=https://authentik.${DOMAIN}/application/o/miniflux/
      - OAUTH2_USER_CREATION=1
      - OAUTH2_OIDC_PROVIDER_NAME=authentik
    restart: unless-stopped