first commit

k8s/miniflux/bootstrap-feeds-job.yaml

@@ -0,0 +1,35 @@
+# Runs miniflux-initializer (see /miniflux-initializer) to create the
+# categories/feeds from feeds.yaml via the Miniflux REST API. Idempotent,
+# safe to re-run: delete the Job then re-apply after editing feeds.yaml.
+#   kubectl delete job bootstrap-feeds -n watch --ignore-not-found
+#   kubectl apply -f k8s/miniflux/bootstrap-feeds-job.yaml
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: bootstrap-feeds
+  namespace: watch
+spec:
+  backoffLimit: 3
+  template:
+    spec:
+      restartPolicy: Never
+      containers:
+        - name: bootstrap-feeds
+          image: docker.io/library/miniflux-initializer:latest
+          imagePullPolicy: Never
+          env:
+            - name: MINIFLUX_URL
+              # Trailing dot makes this an absolute FQDN: musl's resolver
+              # (Alpine base image) mishandles ndots-relative lookups here
+              # and fails with EAI_AGAIN otherwise.
+              value: http://miniflux.watch.svc.cluster.local.
+            - name: MINIFLUX_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: miniflux-credentials
+                  key: ADMIN_USERNAME
+            - name: MINIFLUX_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: miniflux-credentials
+                  key: ADMIN_PASSWORD

k8s/miniflux/create-db-job.yaml

@@ -0,0 +1,28 @@
+# One-off Job to create the "miniflux" database on the shared Postgres
+# instance. Re-run (delete + kubectl apply) whenever a new app needs a
+# database, with a copy of this Job using a different DB name.
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: create-db-miniflux
+  namespace: postgres
+spec:
+  backoffLimit: 3
+  template:
+    spec:
+      restartPolicy: Never
+      containers:
+        - name: create-db
+          image: postgres:18-alpine
+          envFrom:
+            - secretRef:
+                name: postgres-admin
+          command:
+            - sh
+            - -c
+            - |
+              set -e
+              psql "postgres://$POSTGRES_USER:$POSTGRES_PASSWORD@postgres-postgresql:5432/postgres" \
+                -tc "SELECT 1 FROM pg_database WHERE datname = 'miniflux'" | grep -q 1 \
+                || psql "postgres://$POSTGRES_USER:$POSTGRES_PASSWORD@postgres-postgresql:5432/postgres" \
+                     -c "CREATE DATABASE miniflux"

k8s/miniflux/deployment.yaml

@@ -0,0 +1,52 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: miniflux
+  namespace: watch
+  labels:
+    app.kubernetes.io/name: miniflux
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: miniflux
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: miniflux
+    spec:
+      containers:
+        - name: miniflux
+          image: miniflux/miniflux:latest
+          ports:
+            - name: http
+              containerPort: 8080
+          envFrom:
+            - secretRef:
+                name: miniflux-credentials
+          env:
+            - name: RUN_MIGRATIONS
+              value: "1"
+            - name: CREATE_ADMIN
+              value: "1"
+            - name: BASE_URL
+              value: https://miniflux.sttlab.pc
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 1000m
+              memory: 768Mi
+          readinessProbe:
+            httpGet:
+              path: /healthcheck
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthcheck
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 20

k8s/miniflux/gateway.yaml

@@ -0,0 +1,20 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: miniflux
+  namespace: watch
+spec:
+  gatewayClassName: envoy
+  listeners:
+    - name: https
+      protocol: HTTPS
+      port: 443
+      hostname: miniflux.sttlab.pc
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - kind: Secret
+            name: sttlab-pc-tls

k8s/miniflux/httproute.yaml

@@ -0,0 +1,21 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: miniflux
+  namespace: watch
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: miniflux
+  hostnames:
+    - miniflux.sttlab.pc
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - kind: Service
+          name: miniflux
+          port: 80

k8s/miniflux/secret.example.yaml

@@ -0,0 +1,15 @@
+# Copy to secret.yaml, fill in real values, and apply with:
+#   kubectl apply -f secret.yaml
+# Never commit the filled-in secret.yaml to git.
+#
+# POSTGRES_USER/POSTGRES_PASSWORD must match k8s/postgres/secret.yaml.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: miniflux-credentials
+  namespace: watch
+type: Opaque
+stringData:
+  DATABASE_URL: postgres://postgres:changeme@postgres-postgresql.postgres.svc.cluster.local:5432/miniflux?sslmode=disable
+  ADMIN_USERNAME: admin
+  ADMIN_PASSWORD: changeme

k8s/miniflux/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: miniflux
+  namespace: watch
+  labels:
+    app.kubernetes.io/name: miniflux
+spec:
+  selector:
+    app.kubernetes.io/name: miniflux
+  ports:
+    - name: http
+      port: 80
+      targetPort: 8080