apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    kompose.cmd: kompose convert
    kompose.version: 1.34.0 (cbf2835db)
  labels:
    io.kompose.service: freshrss
  name: freshrss
spec:
  replicas: 1
  selector:
    matchLabels:
      io.kompose.service: freshrss
  strategy:
    type: Recreate
  template:
    metadata:
      annotations:
        kompose.cmd: kompose convert
        kompose.version: 1.34.0 (cbf2835db)
      labels:
        io.kompose.service: freshrss
    spec:
      initContainers:
        - image: alpine/git
          name: git
          command:
          - git
          - clone
          - https://github.com/rubenhensen/Extensions.git
          - /tmp
          volumeMounts:
          - name: extensions
            mountPath: /tmp
# cd /var/www/FreshRSS/extensions
# git checkout main
      containers:
        - env:
            - name: FRESHRSS_ENV
              value: production
            - name: CRON_MIN
              value: "13,43"
            - name: OIDC_ENABLED
              value: "1"
            - name: OIDC_PROVIDER_METADATA_URL
              value: https://authentik.rubenhensen.nl/application/o/freshrss/.well-known/openid-configuration
            - name: OIDC_CLIENT_ID
              value: freshrss
            - name: OIDC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: freshrss-oidc-client-secret
                  key: client_secret
            - name: OIDC_SCOPES
              value: "openid email profile"
            - name: OIDC_X_FORWARDED_HEADERS
              value: X-Forwarded-Port X-Forwarded-Proto X-Forwarded-Host
            # Session handling for the Apache mod_auth_openidc layer that guards /i/.
            # Defaults are 5 min inactivity / ~7.5 h max, which is what caused the
            # constant bounces back to authentik.
            # Sliding window: refreshed on every request, so any visit within the
            # period extends it by another 30 days.
            - name: OIDC_SESSION_INACTIVITY_TIMEOUT
              value: "2592000" # 30 days
            # Hard cap, counted from login and never extended.
            - name: OIDC_SESSION_MAX_DURATION
              value: "7776000" # 90 days
            # ":persistent" makes the session cookie survive a browser restart
            # (its expiry tracks OIDC_SESSION_INACTIVITY_TIMEOUT).
            - name: OIDC_SESSION_TYPE
              value: "server-cache:persistent"
            - name: TZ
              value: Europe/Amsterdam
          image: freshrss/freshrss:latest
          name: freshrss
          ports:
            - containerPort: 80
              protocol: TCP
          volumeMounts:
            - mountPath: /var/www/FreshRSS/data
              name: data
            - mountPath: /var/www/FreshRSS/extensions
              name: extensions
            - mountPath: /var/www/FreshRSS/data/config.custom.php
              name: freshrss-claim2
            - mountPath: /var/www/FreshRSS/data/config-user.custom.php
              name: freshrss-claim3
      restartPolicy: Always
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: data
        - name: extensions
          emptyDir: {}
        - name: freshrss-claim2
          persistentVolumeClaim:
            claimName: freshrss-claim2
        - name: freshrss-claim3
          persistentVolumeClaim:
            claimName: freshrss-claim3