87 lines
No EOL
2.9 KiB
Text
87 lines
No EOL
2.9 KiB
Text
|
|
|
|
[Unit]
|
|
Description=FreshRSS
|
|
Wants=network-online.target
|
|
Wants=traefik.service
|
|
After=network-online.target
|
|
|
|
|
|
[Container]
|
|
ContainerName=freshrss
|
|
Image=docker.io/freshrss/freshrss:latest
|
|
Volume=/etc/localtime:/etc/localtime:ro
|
|
Volume=/var/opt/freshrss:/var/www/FreshRSS/data:z,U
|
|
Volume=/var/opt/freshrss-extensions:/var/www/FreshRSS/extensions:z,U
|
|
Volume=/etc/freshrss/conf-enabled:/etc/apache2/conf-enabled:ro
|
|
AutoUpdate=registry
|
|
Network=web.network
|
|
|
|
# allow many file descriptors for rocksdb
|
|
Ulimit=nofile=1048567:1048567
|
|
|
|
Label="traefik.enable=true"
|
|
Label="traefik.http.routers.freshrss.rule=Host(`freshrss.ellis.link`)"
|
|
|
|
Label="traefik.http.routers.freshrss.entrypoints=https"
|
|
|
|
Label="traefik.http.routers.freshrss.middlewares=default@file"
|
|
|
|
Environment="TRUSTED_PROXY=10.89.0.0/24 fd76:6f6d:f45e:ea1a::/64"
|
|
Environment="CRON_MIN=13,43"
|
|
Environment="BASE_URL=https://freshrss.ellis.link"
|
|
|
|
# OIDC
|
|
# kanidm system oauth2 create freshrss "FreshRSS" https://freshrss.ellis.link/
|
|
# kanidm system oauth2 add-redirect-url freshrss https://freshrss.ellis.link/i/oidc/
|
|
# kanidm group create freshrss_users
|
|
# kanidm system oauth2 update-scope-map freshrss freshrss_users email profile openid
|
|
# kanidm group add-members freshrss_users idm_all_persons
|
|
# kanidm system oauth2 show-basic-secret freshrss -o json
|
|
# EnvironmentFile
|
|
|
|
|
|
Environment=OIDC_ENABLED=1
|
|
Environment=OIDC_PROVIDER_METADATA_URL=https://idm.ellis.link/oauth2/openid/freshrss/.well-known/openid-configuration
|
|
Environment=OIDC_CLIENT_ID=freshrss
|
|
Environment=OIDC_CLIENT_SECRET=LAAy7cSYr2b1e9Cf42ULs8FCzprgX3c7FTQ3Mdv6yJHpkE7N
|
|
Environment=OIDC_CLIENT_CRYPTO_KEY=9ub2rc^orMH9Fi2ogacTs3j
|
|
Environment=OIDC_REMOTE_USER_CLAIM=preferred_username
|
|
Environment="OIDC_SCOPES=openid profile"
|
|
Environment="OIDC_X_FORWARDED_HEADERS=X-Forwarded-Host X-Forwarded-Port X-Forwarded-Proto"
|
|
Environment=OIDC_SESSION_INACTIVITY_TIMEOUT=7200
|
|
#Environment=OIDC_SESSION_MAX_DURATION: Optional. Maximum duration of the application session. When not defined the default is 8 hours (3600 * 8 seconds). When set to 0, the session duration will be set equal to the expiry time of the ID token.
|
|
# Environment=OIDC_SESSION_TYPE
|
|
|
|
# OIDCRedirectURI /oauth2/callback
|
|
# OIDCCryptoPassphrase <random password here>
|
|
# OIDCProviderMetadataURL https://kanidm.example.com/oauth2/openid/<client name>/.well-known/openid-configuration
|
|
# OIDCScope "openid"
|
|
# OIDCUserInfoTokenMethod authz_header
|
|
# OIDCClientID <client name>
|
|
# OIDCClientSecret <client password>
|
|
# OIDCPKCEMethod S256
|
|
# OIDCCookieSameSite On
|
|
|
|
Label="homepage.group=Public"
|
|
Label="homepage.name=FreshRSS"
|
|
Label="homepage.href=https://freshrss.ellis.link/"
|
|
Label="homepage.siteMonitor=https://freshrss.ellis.link/"
|
|
Label="homepage.description=RSS feed reader"
|
|
Label=kuma.__monitor=''
|
|
|
|
StopTimeout=100
|
|
|
|
[Service]
|
|
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
TimeoutStopSec=2m
|
|
TimeoutStartSec=2m
|
|
|
|
# StartLimitInterval=1m
|
|
StartLimitBurst=5
|
|
|
|
[Install]
|
|
WantedBy=default.target |