From 38be6c13f76e893cf47636257071b440dec0c5b2 Mon Sep 17 00:00:00 2001
From: Robert Günzler <r@gnzler.io>
Date: Sun, 7 Sep 2025 17:32:13 +0200
Subject: initial commit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Robert Günzler <r@gnzler.io>
---
 bundles/miniflux/files/kube.yaml   | 84 ++++++++++++++++++++++++++++++++++++++
 bundles/miniflux/files/secret.yaml | 10 +++++
 2 files changed, 94 insertions(+)
 create mode 100644 bundles/miniflux/files/kube.yaml
 create mode 100644 bundles/miniflux/files/secret.yaml

(limited to 'bundles/miniflux/files')

diff --git a/bundles/miniflux/files/kube.yaml b/bundles/miniflux/files/kube.yaml
new file mode 100644
index 0000000..83b7edf
--- /dev/null
+++ b/bundles/miniflux/files/kube.yaml
@@ -0,0 +1,84 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: miniflux
+data:
+  BASE_URL: https://rss.gzr.im
+  CREATE_ADMIN: on
+  RUN_MIGRATIONS: on
+  METRICS_COLLECTOR: 1
+  METRICS_REFRESH_INTERVAL: 600
+  METRICS_ALLOWED_NETWORKS: 127.0.0.1/8,10.89.0.0/24
+  # use authelia
+  AUTH_PROXY_HEADER: 'Remote-User'
+  AUTH_PROXY_USER_CREATION: 0
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: miniflux
+  labels:
+    traefik.enable: true
+    traefik.http.routers.miniflux.tls: true
+    traefik.http.routers.miniflux.tls.certresolver: le
+    traefik.http.routers.miniflux.entrypoints: http,https
+    traefik.http.routers.miniflux.rule: Host(`rss.gzr.im`)
+    traefik.http.routers.miniflux.service: miniflux
+    traefik.http.routers.miniflux.middlewares: authelia@docker
+    traefik.http.services.miniflux.loadbalancer.server.port: 8080
+    # metrics
+    traefik.http.routers.miniflux-metrics.entrypoints: metrics
+    traefik.http.routers.miniflux-metrics.rule: Path(`/metrics/miniflux`)
+    traefik.http.routers.miniflux-metrics.middlewares: replacepath-metrics
+spec:
+  # NOTE: we need to compensate for the lack of healthcheck-based retries
+  restartPolicy: Always
+  dnsPolicy: Default
+  containers:
+    - name: miniflux
+      image: docker.io/miniflux/miniflux:2.2.10
+      ports:
+        - containerPort: 8080
+          protocol: TCP
+      envFrom:
+      - configMapRef:
+          name: miniflux
+      - secretRef:
+          name: miniflux
+      livenessProbe:
+        exec:
+          command:
+          - /usr/bin/miniflux
+          - -healthcheck
+          - auto
+      resources:
+        requests:
+          cpu: 10m
+          memory: 60Mi
+        limits:
+          cpu: 100m
+          memory: 128Mi
+    - name: postgres
+      image: docker.io/library/postgres:15-alpine
+      volumeMounts:
+      - name: pg-data
+        mountPath: /var/lib/postgresql/data
+      envFrom:
+      - secretRef:
+          name: miniflux
+      livenessProbe:
+        exec:
+          command: ["pg_isready", "-U", "miniflux"]
+        initialDelaySeconds: 5
+      resources:
+        requests:
+          cpu: 10m
+          memory: 6Mi
+        limits:
+          cpu: 100m
+          memory: 128Mi
+  volumes:
+  - name: pg-data
+    hostPath:
+      path: /var/lib/miniflux
+      type: DirectoryOrCreate
diff --git a/bundles/miniflux/files/secret.yaml b/bundles/miniflux/files/secret.yaml
new file mode 100644
index 0000000..7a958c2
--- /dev/null
+++ b/bundles/miniflux/files/secret.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: miniflux
+data:
+    ADMIN_PASSWORD: ${repo.vault.password_for("miniflux_admin_pw").b64encode().value}
+    ADMIN_USERNAME: ${repo.vault.password_for("miniflux_admin_user").b64encode().value}
+    DATABASE_URL: ${repo.libs.util.base64(f"user=miniflux password={repo.vault.password_for("miniflux_db_pw")} dbname=miniflux sslmode=disable host=localhost")}
+    POSTGRES_USER:  ${repo.libs.util.base64("miniflux")}
+    POSTGRES_PASSWORD: ${repo.vault.password_for("miniflux_db_pw").b64encode().value}
-- 
cgit 1.4.1