Authentik's default-authentication-login stage ships with
session_duration: seconds=0, so the SSO session died with the browser.
New blueprint raises it to 30 days for every app on that flow.
FreshRSS runs OIDC through Apache mod_auth_openidc, whose defaults are a
5 minute inactivity timeout and a ~7.5 hour max duration in a non-persistent
cookie. Bumped to a 30 day sliding inactivity window (refreshed on every
request) with a 90 day hard cap, and made the cookie persistent so it
survives a browser restart.
Adds the VAPID keypair for web push and raises the ingress body limit to 25m to
match the app's BODY_SIZE_LIMIT, since a bulk route import posts every GPX in one
request.
The VAPID env refs are optional:true on purpose — a missing key in a secretKeyRef
puts the pod in CreateContainerConfigError, and the app already handles absent
keys by sending no notifications.
Add vic.rubenhensen.nl to tunneledHosts so the edge box does SNI
passthrough on :443 and the :80 ACME/redirect vhost for it, matching
the DNS record. Without this, vic falls through to Stalwart on :8443
and cert-manager's HTTP-01 challenge can't be reached.
Deploys ghcr.io/rubenhensen/bolletjestrui at vic.rubenhensen.nl:
- bolletjestrui/ folder: deployment (SQLite on a PVC, migrate-on-start,
ORIGIN + raised BODY_SIZE_LIMIT for GPX uploads), service, nginx
ingress with prod-cluster-issuer TLS, PVC, and a Vault ExternalSecret
(kv/bolletjestrui: site_password, admin_password, key_secret).
- apps/templates/bolletjestrui-folder.yaml: ArgoCD Application.
- dns: vic A record -> 46.224.26.65 (ingress LB).
- renovate: watch bolletjestrui/ for image tag bumps.
Committed locally, not pushed: needs the Vault secret created and the
ghcr package made public first.
Single-pod sqlite install (simplest path for a home git host). HTTPS-only,
no SSH listener for now. Wired into the Hetzner tunnel like the other
rubenhensen.nl services.
First visitor to git.rubenhensen.nl can register; Gitea auto-promotes the
first user to admin.
Point rss to the Hetzner box and reverse-proxy/SNI-passthrough back to
the home cluster so cert-manager keeps owning the certificate. Move
stalwart's HTTPS listener to 127.0.0.1:8443 so nginx can take :443 and
dispatch by SNI.
Ruben Hensen