version: "3"

services:
  miniflux:
    image: miniflux/miniflux:latest
    container_name: miniflux
    restart: unless-stopped
    depends_on:
      - postgres
    environment:
      - DATABASE_URL=postgres://miniflux:YOUR_POSTGRES_PASSWORD@postgres/miniflux?sslmode=disable
      - RUN_MIGRATIONS=1
      - CREATE_ADMIN=1
      - ADMIN_USERNAME=admin
      - ADMIN_PASSWORD=changeme
    networks:
      - miniflux
      - postgres
    user: nobody
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

  postgres:
    image: postgres:15-alpine
    container_name: postgres
    restart: unless-stopped
    environment:
      - POSTGRES_USER=miniflux
      - POSTGRES_PASSWORD=YOUR_POSTGRES_PASSWORD
    volumes:
      - postgres:/var/lib/postgresql/data
    networks:
      - postgres
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "miniflux"]
      interval: 15s
      timeout: 5s
    user: "70:70"
    read_only: true
    tmpfs:
      - /var/run/postgresql:size=50M,mode=0770,uid=70,gid=70,noexec,nosuid,nodev
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

  swag:
    image: ghcr.io/linuxserver/swag
    container_name: swag
    restart: unless-stopped
    environment:
      - PUID=1000
      - PGID=1000
      - URL=yourdomain.tld
      - SUBDOMAINS=rss
      - VALIDATION=http
      - EMAIL=contact@tommytran.io
      - ONLY_SUBDOMAINS=true
    volumes:
      - ./swag:/config:Z
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - 443:443
      - 80:80
    networks:
      - miniflux
    security_opt:
      - no-new-privileges:true
    cap_add:
      - NET_ADMIN

networks:
  miniflux:
  postgres:

volumes:
  postgres: