{
  config,
  pkgs,
  lib,
  ...
}: let
  port = 8080;
  user = "miniflux";
  db = "miniflux";
in {
  sops.secrets."miniflux/oidcSecret" = {
    owner = user;
    group = user;
  };

  networking.firewall.allowedTCPPorts = [port];

  services.miniflux = {
    enable = true;
    adminCredentialsFile = pkgs.writeText "minifluxDummyAdminCredentialsFile" '''';
    createDatabaseLocally = false;
    config = {
      DATABASE_URL = "host=/run/postgresql dbname=${db} sslmode=disable";
      LISTEN_ADDR = "0.0.0.0:${toString port}";
      BASE_URL = "https://rss.liljamo.com/";
      DISABLE_LOCAL_AUTH = 1;
      #METRICS_COLLECTOR = 1; # TODO: metrics, disable /metrics path on haproxy like jellyfin

      OAUTH2_PROVIDER = "oidc";
      OAUTH2_CLIENT_ID = "miniflux";
      OAUTH2_CLIENT_SECRET_FILE = config.sops.secrets."miniflux/oidcSecret".path;
      OAUTH2_REDIRECT_URL = "https://rss.liljamo.com/oauth2/oidc/callback";
      # .well-known/openid-configuration is appended to this by the oidc library used by miniflux
      OAUTH2_OIDC_DISCOVERY_ENDPOINT = "https://auth.liljamo.com";
      OAUTH2_USER_CREATION = 1;

      RUN_MIGRATIONS = 1;
      CREATE_ADMIN = lib.mkForce 0;

      FORCE_REFRESH_INTERVAL = 5;
    };
  };

  services.postgresql = {
    ensureDatabases = [db];
    ensureUsers = [
      {
        name = user;
        ensureDBOwnership = true;
      }
    ];
  };

  users.users.${user} = {
    createHome = false;
    group = user;
    isSystemUser = true;
  };
  users.groups.${user} = {};
}