From 5707e2124c37519e9579993d9c1f3f00945cc29c Mon Sep 17 00:00:00 2001
From: Morten Olsen <fbtijfdq@void.black>
Date: Mon, 8 Sep 2025 11:24:32 +0200
Subject: [PATCH] disable ssl on pg

---
 charts/apps/miniflux/Chart.yaml               |  3 +
 charts/apps/miniflux/templates/client.yaml    | 10 +++
 charts/apps/miniflux/templates/database.yaml  |  6 ++
 .../apps/miniflux/templates/deployment.yaml   | 70 +++++++++++++++++++
 .../templates/external-http-service.yaml      | 11 +++
 charts/apps/miniflux/templates/pvc.yaml       | 11 +++
 charts/apps/miniflux/templates/service.yaml   | 15 ++++
 charts/apps/miniflux/values.yaml              |  9 +++
 .../patches}/@kubernetes__client-node.patch   |  0
 .../postgres-database/postgres-database.ts    |  2 +-
 10 files changed, 136 insertions(+), 1 deletion(-)
 create mode 100644 charts/apps/miniflux/Chart.yaml
 create mode 100644 charts/apps/miniflux/templates/client.yaml
 create mode 100644 charts/apps/miniflux/templates/database.yaml
 create mode 100644 charts/apps/miniflux/templates/deployment.yaml
 create mode 100644 charts/apps/miniflux/templates/external-http-service.yaml
 create mode 100644 charts/apps/miniflux/templates/pvc.yaml
 create mode 100644 charts/apps/miniflux/templates/service.yaml
 create mode 100644 charts/apps/miniflux/values.yaml
 rename {patches => images/operator/patches}/@kubernetes__client-node.patch (100%)

diff --git a/charts/apps/miniflux/Chart.yaml b/charts/apps/miniflux/Chart.yaml
new file mode 100644
index 0000000..7503208
--- /dev/null
+++ b/charts/apps/miniflux/Chart.yaml
@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: miniflux
diff --git a/charts/apps/miniflux/templates/client.yaml b/charts/apps/miniflux/templates/client.yaml
new file mode 100644
index 0000000..35bf730
--- /dev/null
+++ b/charts/apps/miniflux/templates/client.yaml
@@ -0,0 +1,10 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  redirectUris:
+    - path: oauth2/oidc/callback
+      subdomain: "{{ .Values.subdomain }}"
+      matchingMode: strict
diff --git a/charts/apps/miniflux/templates/database.yaml b/charts/apps/miniflux/templates/database.yaml
new file mode 100644
index 0000000..6a30b53
--- /dev/null
+++ b/charts/apps/miniflux/templates/database.yaml
@@ -0,0 +1,6 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: PostgresDatabase
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
diff --git a/charts/apps/miniflux/templates/deployment.yaml b/charts/apps/miniflux/templates/deployment.yaml
new file mode 100644
index 0000000..5316efc
--- /dev/null
+++ b/charts/apps/miniflux/templates/deployment.yaml
@@ -0,0 +1,70 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}"
+    spec:
+      containers:
+        - name: "{{ .Release.Name }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: "{{ .Values.image.pullPolicy }}"
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+          volumeMounts:
+            - mountPath: /data
+              name: data
+          env:
+            - name: TZ
+              value: "{{ .Values.globals.timezone }}"
+            - name: RUN_MIGRATIONS
+              value: "1"
+            - name: OAUTH2_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientId
+            - name: OAUTH2_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientSecret
+            - name: OAUTH2_OIDC_DISCOVERY_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: configuration
+            - name: OAUTH2_OIDC_PROVIDER_NAME
+              value: Authentik
+            - name: OAUTH2_PROVIDER
+              value: oidc
+            - name: OAUTH2_REDIRECT_URL
+              value: https://{{ .Values.subdomain }}.{{ .Values.globals.domain }}/oauth2/oidc/callback
+            - name: OAUTH2_USER_CREATION
+              value: "1"
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-pg-connection"
+                  key: url
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: "{{ .Release.Name }}-data"
diff --git a/charts/apps/miniflux/templates/external-http-service.yaml b/charts/apps/miniflux/templates/external-http-service.yaml
new file mode 100644
index 0000000..e28916d
--- /dev/null
+++ b/charts/apps/miniflux/templates/external-http-service.yaml
@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80
diff --git a/charts/apps/miniflux/templates/pvc.yaml b/charts/apps/miniflux/templates/pvc.yaml
new file mode 100644
index 0000000..bc1d0a6
--- /dev/null
+++ b/charts/apps/miniflux/templates/pvc.yaml
@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ .Release.Name }}-data'
+spec:
+  accessModes:
+    - 'ReadWriteOnce'
+  resources:
+    requests:
+      storage: '1Gi'
+  storageClassName: '{{ .Values.globals.environment }}'
diff --git a/charts/apps/miniflux/templates/service.yaml b/charts/apps/miniflux/templates/service.yaml
new file mode 100644
index 0000000..b759568
--- /dev/null
+++ b/charts/apps/miniflux/templates/service.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 3000
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}"
diff --git a/charts/apps/miniflux/values.yaml b/charts/apps/miniflux/values.yaml
new file mode 100644
index 0000000..50e46d3
--- /dev/null
+++ b/charts/apps/miniflux/values.yaml
@@ -0,0 +1,9 @@
+globals:
+  environment: prod
+  timezone: Europe/Amsterdam
+  domain: olsen.cloud
+image:
+  repository: ghcr.io/miniflux/miniflux
+  tag: latest
+  pullPolicy: IfNotPresent
+subdomain: miniflux
diff --git a/patches/@kubernetes__client-node.patch b/images/operator/patches/@kubernetes__client-node.patch
similarity index 100%
rename from patches/@kubernetes__client-node.patch
rename to images/operator/patches/@kubernetes__client-node.patch
diff --git a/images/operator/src/resources/homelab/postgres-database/postgres-database.ts b/images/operator/src/resources/homelab/postgres-database/postgres-database.ts
index 62d677e..0dbf789 100644
--- a/images/operator/src/resources/homelab/postgres-database/postgres-database.ts
+++ b/images/operator/src/resources/homelab/postgres-database/postgres-database.ts
@@ -97,7 +97,7 @@ class PostgresDatabase extends CustomResource<typeof specSchema> {
       port: clusterSecret.port,
     };
 
-    const url = `postgresql://${expected.user}:${expected.password}@${expected.host}:${expected.port}/${expected.database}`;
+    const url = `postgresql://${expected.user}:${expected.password}@${expected.host}:${expected.port}/${expected.database}?sslmode=disable`;
 
     await this.#secret.set(
       {