fix: DATABASE_URL als Secret-Key, kein Shell-Substitution

clusters/homelab/apps/miniflux/helmrelease.yaml

@@ -25,22 +25,18 @@ spec:
       repository: ghcr.io/miniflux/miniflux
       tag: "2.2.5"
       pullPolicy: IfNotPresent
-
     controller:
       strategy: RollingUpdate
       replicas: 1
-
     env:
       TZ: "Europe/Berlin"
       CREATE_ADMIN: "1"
       RUN_MIGRATIONS: "1"
       DATABASE_URL:
-        value: "postgres://miniflux:$(DATABASE_PASSWORD)@miniflux-db-rw.miniflux.svc.cluster.local/miniflux?sslmode=disable"
-      DATABASE_PASSWORD:
         valueFrom:
           secretKeyRef:
             name: miniflux-secret
-            key: DATABASE_PASSWORD
+            key: DATABASE_URL
       ADMIN_USERNAME:
         valueFrom:
           secretKeyRef:
@@ -51,24 +47,19 @@ spec:
           secretKeyRef:
             name: miniflux-secret
             key: ADMIN_PASSWORD
-
     service:
       main:
         ports:
           http:
             port: 8080
-
     ingress:
       main:
         enabled: false
-
     persistence:
       config:
         enabled: false
-
     postgresql:
       enabled: false
-
     resources:
       requests:
         cpu: 50m

clusters/homelab/apps/miniflux/secret.sops.yaml

@@ -5,11 +5,12 @@ metadata:
     namespace: miniflux
 type: Opaque
 stringData:
-    ADMIN_USERNAME: ENC[AES256_GCM,data:JgKPGKY=,iv:3pMpb2KK3e5TLjnW6hepetFtRZV/mjiEmTV6DGd5J6Y=,tag:FHVPWXU0g+gkbJEPoxRyVw==,type:str]
-    #ENC[AES256_GCM,data:SjLoj8TH8MnBD3JTRD1UPoKPiBF1dSiYkz+xA8fWfQ==,iv:WKw7OaLJcAd0xNR0cje+CzS6endjgfIZXujl7ueyLLM=,tag:fddKHu+J0686cZ/J3WMz9A==,type:comment]
-    ADMIN_PASSWORD: ENC[AES256_GCM,data:oU+Tr3X7Uh8=,iv:VAzcNm53kVNFkn5LGzMO0aWfcPdH9RqihcrwyMKd4xs=,tag:LR/SjrIy8zE8qMOCXfoWSg==,type:str]
-    #ENC[AES256_GCM,data:eKjJifmqO0rsqsLu7BgfLHqF7E5o0Fh4PO5YOkl0Sw==,iv:2JZH/WRcYYRMVm12khnxsrTEBq/mVuea9xdJ9N3STh8=,tag:ewhAbZs3a5E/oUUZ4TdrTw==,type:comment]
-    DATABASE_PASSWORD: ENC[AES256_GCM,data:JI3ItljhR04=,iv:tXDkYmIThEYcJA7wTxnpLdYdWOzTqSdHZIHVEFNaakI=,tag:k+t09jcZxwT2N1Xg4Qqd9Q==,type:str]
+    ADMIN_USERNAME: ENC[AES256_GCM,data:wElYKCc=,iv:Oj5kRGjCOgdHpBqVjv1G3p2Zbpla4isdw/pxnSKiTwc=,tag:OGqAyGHEMnQa0jRT+6LkpQ==,type:str]
+    #ENC[AES256_GCM,data:XNPAEVjINhA7w52XdhAyupWph/SqjZZLTg8bsCG26A==,iv:IzXbagALEBY4R61rDZwT7CpkvF59uI81Mw8+98EZOlQ=,tag:BmoJRAk0xPB3Pe0otIYwvQ==,type:comment]
+    ADMIN_PASSWORD: ENC[AES256_GCM,data:fyGDCA9Baj4=,iv:TLptW48MChqm8t8ApcMwFlH1cqIoPrWlAO4TeEqYMeA=,tag:NPylBZRVoj7gOTHKtRb+Xw==,type:str]
+    #ENC[AES256_GCM,data:UDCAW/ohhDA/DoyvtEvv5UkHOo7ZLDAncba8bTjqhg==,iv:Hrxro4SuXXa0fM9VBBVmFAae3VlKa7KyxJMyWvj3MjM=,tag:F0ihh2wrbvHX3jwCEuFMMQ==,type:comment]
+    DATABASE_PASSWORD: ENC[AES256_GCM,data:dXf3Ugy4E3Y=,iv:rWkGyMaM1Bsil/Ty3z5t5z7ZoNRrjunNp85gQSvijzw=,tag:VLXpTq9n2NC/IOpXOduKyw==,type:str]
+    DATABASE_URL: ENC[AES256_GCM,data:whf0xZUjEmoow7AHKCw0Z1TXeGRRDjew7JNnR5D0rx3AmqQvbasue+Wg07EuO1141Vr7IoxLbAeumLpIFnuRjVgCMQqJFRD5DND7,iv:LbCmAyrAZ9dXP2KwCUr1ttsAICI6OLhJnaqAtPCcvX0=,tag:YuEMmfVYezIIfyV19jCuyw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -19,14 +20,14 @@ sops:
         - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDcFpuU0xCczhLalNqcncx
-            KzZLcFk1TGRKRzgwMzdDZjQ3c3VoaDIvWTJNCkFiME1VZ0V5aDM4MlkyeWtJTTZm
-            L3JGYi9XbE5DOTMwcEw4U0ZUNTFzUVkKLS0tIGVYVDErWGxUbDFta04yKzg3RjNG
-            MXI0YnMxQXRkQkpGMzRwNStJR1N2cWcKIG7CiAiFoyNqkBrG3qbLAm9z211JAEuS
-            9mTxhBZWxf5cv0ZjGtF3WcWbLPu1SBivY56+Ru/MHx7BX3ucz7/hlw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1M1k0eGhxdEZBV1JQcU1E
+            dlVzemE2VXFTZ3UzSHJmTDNxMkpDSlcyYkhVCmlrd2dHZGFBYVhUVE40NHVsWHhW
+            dTBTbjRJYVdXdFV0cGZyUlJUYkNCcTgKLS0tIE0vVjcrWDZyMVBnUWhvRGp0aGVh
+            ZjBkbnZWaUNLMlNyK1I1K0FBRFlsQjgK6PZHDzGPFQGl1bykwALwEIQbC+Lefcgr
+            ipsp2B1D9lsQu5soc+C8gokyUXktsKMr86lttm23mnZXn+3THCjjcQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-06-14T21:59:56Z"
-    mac: ENC[AES256_GCM,data:sXpM/tQFRqPAQ73BbENV5z9cE4TABx0yD3mFXAG5tzoJtZCNAi4vRJ4wIEQZ+CHwJnlx1MAbwesJr8woKMjryWRtn9zMtc5veDmMj6pnY2zEP3xAQrOFBqXV4UQvOzNDOzp9xBuR0WgLyEYWbnUrZ+uVtiXjvjYO7D/7z5yGvs0=,iv:ke8NSMQmbhjeVSOs5TcfT8L3n8AAsmTP6L733BNaeLA=,tag:YS8NojwgSDvr0Kqv5J+n4w==,type:str]
+    lastmodified: "2026-06-14T22:22:04Z"
+    mac: ENC[AES256_GCM,data:QfWHCA5iAyCIUMb0uCt+OclzTZ2W58iysZoumAyl7WeNWX4lXFt2V9Io4OCbTac7ymsDLzk96PTdkrr7IbAqCONwPYt3YMvIZ0DcQZhKbPiMJEexvGhU0GQtFkGN/ua4dds2Iv1Hp+6Pw6G9s37WUjYOQeC+CBYmP0fFUQ5WuNQ=,iv:TQ+pbiuabUrwRYEC6Ov1Gw4soqz0pmnHze0pIurQQp8=,tag:cgyTkT7bVBf5BFOcEo+n0w==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.9.4