feat: add miniflux rss reader

clusters/homelab/apps/miniflux.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: miniflux
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./clusters/homelab/apps/miniflux
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age

clusters/homelab/apps/miniflux/helmrelease.yaml

@@ -0,0 +1,84 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: miniflux
+  namespace: miniflux
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: miniflux
+      version: ">=0.9.0"
+      sourceRef:
+        kind: HelmRepository
+        name: gabe565
+        namespace: miniflux
+      interval: 12h
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    image:
+      repository: ghcr.io/miniflux/miniflux
+      tag: "2.2.5"
+      pullPolicy: IfNotPresent
+
+    controller:
+      strategy: RollingUpdate
+      replicas: 1
+
+    env:
+      TZ: "Europe/Berlin"
+      CREATE_ADMIN: "1"
+      RUN_MIGRATIONS: "1"
+      # Werte kommen aus miniflux-secret (envFrom unten)
+
+    envFrom:
+      - secretRef:
+          name: miniflux-secret
+
+    # DATABASE_URL wird aus Secret zusammengebaut
+    # Format: postgres://user:password@host:5432/miniflux?sslmode=disable
+    # Wird via postgresql.auth.existingSecret gesetzt (siehe postgresql unten)
+
+    service:
+      main:
+        ports:
+          http:
+            port: 8080
+
+    ingress:
+      main:
+        enabled: false   # Routing läuft über HTTPRoute (Cilium Gateway)
+
+    persistence:
+      # Miniflux selbst ist stateless (PostgreSQL hält die Daten)
+      # Kein PVC für den App-Container nötig
+      config:
+        enabled: false
+
+    postgresql:
+      enabled: true
+      auth:
+        username: miniflux
+        database: miniflux
+        existingSecret: miniflux-secret
+        secretKeys:
+          adminPasswordKey: DATABASE_PASSWORD
+          userPasswordKey: DATABASE_PASSWORD
+      primary:
+        persistence:
+          enabled: true
+          storageClass: longhorn
+          size: 2Gi
+
+    resources:
+      requests:
+        cpu: 50m
+        memory: 64Mi
+      limits:
+        cpu: 200m
+        memory: 256Mi

clusters/homelab/apps/miniflux/helmrepository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: gabe565
+  namespace: miniflux
+spec:
+  interval: 12h
+  url: https://charts.gabe565.com

clusters/homelab/apps/miniflux/httproute.yaml

@@ -0,0 +1,19 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: miniflux
+  namespace: miniflux
+spec:
+  parentRefs:
+    - name: homelab-gateway
+      namespace: gateway
+  hostnames:
+    - "miniflux.net-scope.org"   # TODO: ggf. anpassen
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: miniflux
+          port: 8080

clusters/homelab/apps/miniflux/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helmrepository.yaml
+  - secret.sops.yaml
+  - helmrelease.yaml
+  - httproute.yaml

clusters/homelab/apps/miniflux/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: miniflux

clusters/homelab/apps/miniflux/secret.sops.yaml

@@ -0,0 +1,37 @@
+# Encrypt with: sops -e -i clusters/homelab/apps/miniflux/secret.sops.yaml
+# Decrypt with: sops -d -i clusters/homelab/apps/miniflux/secret.sops.yaml
+#
+# Before encrypting, fill in the plaintext values below, then run:
+#   sops -e -i secret.sops.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+    name: miniflux-secret
+    namespace: miniflux
+type: Opaque
+stringData:
+    ADMIN_USERNAME: ENC[AES256_GCM,data:3vLlJ4c=,iv:dJoUkO0manOtsRzCyhhtF7lj7YBOgZ/MYaMaoIYIkPM=,tag:H3l+Bh9tIYD8rqjcFncLKQ==,type:str]
+    #ENC[AES256_GCM,data:rmTNp02mx/ZRTVLPRTBxoR9dkFJDPL0VWX387nG2IQ==,iv:QzoAflNvjkk2Zlr+2/hGXBoGNrFusXcYvvAD34QnT5s=,tag:5e2s2pOgkYvwcyYHFrMxww==,type:comment]
+    ADMIN_PASSWORD: ENC[AES256_GCM,data:xxsZRX0qfAg=,iv:Dir2n0v/TXDDBZY/O17rERyTKQ8qyhQ8qIL/dNqlA9g=,tag:GFdLLxux/xj7kx4YbAKdxg==,type:str]
+    #ENC[AES256_GCM,data:7kxSfAyLBwhiQwO6WRGiRcMomHVsOYUIOfjRC6aM4A==,iv:ZlLbdGzZHIh/s5VBGtTqBhJow6pY9Was6IAOmvNHtKA=,tag:SlFyoJD0R4NT8GOeFN0w7A==,type:comment]
+    DATABASE_PASSWORD: ENC[AES256_GCM,data:rTdisnC8WcA=,iv:R0U0RPCOaYBRkdAwZjYw7cH3DsdNFyUCJj4mnhUHMLQ=,tag:r1VRQ0Elye4Oznzt6IChYw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpR0NubDFyVk84Y21NcitO
+            NlJtTHJ6Z05rZStOcTIydjJwZFRWWXlsY1hNCm9wS3NjQmh4Y214YWpIb29NSnM1
+            aXBrckZSSTVoMU1sbDlPSHI2QXhydzAKLS0tIGt4dTlWK2dyTVYzZFE3UHg1Wlo4
+            endLYUZkRmE2RUJldHhoZGdiZFB6OTQK6ygQ8lVpscia4TDvDGU04PglddUSoVkF
+            Mm6lf9fF3gl2QAYtabmQtoKbAx5ObirhHQ5vWFLlSeXsBSkdU1s+VQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-06-14T00:42:37Z"
+    mac: ENC[AES256_GCM,data:wIbdB/9kXf62P44w3iMMtUCmL3efiJD3Zv7TsCiBewTTQJHrczSDShdQmNqKxvYME9g2PQmMz3IoZxUPWVyw2Ze8b2aM3rck1M/mcCzuz+LZt+pMQgQQ+Ntp9Ipf4MgveoL6EDbg5s/pi6i9oTQ5WLkvjiylVSQ62tQ8i8U6fIc=,iv:xs+uhpV2GD/ZJRzT4XLMPY/d5HcEr3REP4Ow29miVUk=,tag:HIRU3w6rWVKCUz/LHbtYLw==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.4