# Miniflux — minimal self-hosted RSS reader (Go single-binary, ~30 MB image).
# Apache 2.0. https://miniflux.app/
#
# Use case: unified inbox across tech blogs, Hacker News, lobste.rs,
# and selected subreddits (Reddit serves an .rss feed for any sub at
# https://reddit.com/r/<sub>/.rss). Subreddits with score-spoiler
# headlines (e.g. r/nba) get a per-feed block-list rule — see README.
#
# Architecture: this stack bundles its own Postgres rather than using
# the shared pfi-postgres at 10.250.50.80. Single-user RSS DB is tiny
# (~MB scale per year) and the bundle reduces cross-host coupling.
# Backup: postgres data lives in the named volume miniflux-db-data;
# capture via `docker exec miniflux-db pg_dump -U miniflux miniflux`
# in restic's pre-backup hook (separate stack — TODO).
#
# All tunables live in .env — edit that, not this file.

services:
  miniflux:
    image: miniflux/miniflux:${MINIFLUX_VERSION}
    container_name: miniflux
    restart: unless-stopped
    depends_on:
      miniflux-db:
        condition: service_healthy
    ports:
      - "${MINIFLUX_BIND:-0.0.0.0}:${MINIFLUX_PORT}:8080"
    environment:
      - DATABASE_URL=postgres://miniflux:${MINIFLUX_DB_PASSWORD}@miniflux-db/miniflux?sslmode=disable
      - RUN_MIGRATIONS=1
      - CREATE_ADMIN=1
      - ADMIN_USERNAME=${MINIFLUX_ADMIN_USERNAME}
      - ADMIN_PASSWORD=${MINIFLUX_ADMIN_PASSWORD}
      - LOG_LEVEL=${MINIFLUX_LOG_LEVEL:-info}
      - HTTPS=0
      - LISTEN_ADDR=0.0.0.0:8080
    healthcheck:
      # Miniflux ships with a built-in healthcheck command.
      test: ["CMD", "/usr/bin/miniflux", "-healthcheck", "auto"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    networks:
      - tnet
    labels:
      - homepage.group=Daily
      - homepage.name=Miniflux
      - homepage.icon=mdi-rss
      - homepage.description=RSS reader (subreddits, blogs, HN)
      - homepage.href=http://10.250.50.70:${MINIFLUX_PORT}

  miniflux-db:
    image: postgres:16
    container_name: miniflux-db
    restart: unless-stopped
    environment:
      - POSTGRES_USER=miniflux
      - POSTGRES_PASSWORD=${MINIFLUX_DB_PASSWORD}
      - POSTGRES_DB=miniflux
      - POSTGRES_INITDB_ARGS=--encoding=UTF-8 --lc-collate=C --lc-ctype=C
    volumes:
      - miniflux-db-data:/var/lib/postgresql/data
    networks:
      - tnet
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U miniflux"]
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  miniflux-db-data:

networks:
  # Both containers share traefik-net. Earlier attempt to put the DB
  # on a private internal network plus miniflux on both nets failed
  # at create-time with "Container cannot be connected to network
  # endpoints: miniflux-net, traefik-net" — the docker engine balks
  # at joining multiple networks (one brand-new, one external) in a
  # single create step. The DB password still protects miniflux-db,
  # and traefik-net is internal-LAN-only, so co-locating is fine.
  tnet:
    name: traefik-net
    external: true