mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-09-17 18:22:54 +02:00
Ruben Hensen
20cf119dbd
Authentik's default-authentication-login stage ships with session_duration: seconds=0, so the SSO session died with the browser. New blueprint raises it to 30 days for every app on that flow. FreshRSS runs OIDC through Apache mod_auth_openidc, whose defaults are a 5 minute inactivity timeout and a ~7.5 hour max duration in a non-persistent cookie. Bumped to a 30 day sliding inactivity window (refreshed on every request) with a 90 day hard cap, and made the cookie persistent so it survives a browser restart.
102 lines
3.4 KiB
YAML
102 lines
3.4 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
annotations:
|
|
kompose.cmd: kompose convert
|
|
kompose.version: 1.34.0 (cbf2835db)
|
|
labels:
|
|
io.kompose.service: freshrss
|
|
name: freshrss
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
io.kompose.service: freshrss
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
kompose.cmd: kompose convert
|
|
kompose.version: 1.34.0 (cbf2835db)
|
|
labels:
|
|
io.kompose.service: freshrss
|
|
spec:
|
|
initContainers:
|
|
- image: alpine/git
|
|
name: git
|
|
command:
|
|
- git
|
|
- clone
|
|
- https://github.com/rubenhensen/Extensions.git
|
|
- /tmp
|
|
volumeMounts:
|
|
- name: extensions
|
|
mountPath: /tmp
|
|
# cd /var/www/FreshRSS/extensions
|
|
# git checkout main
|
|
containers:
|
|
- env:
|
|
- name: FRESHRSS_ENV
|
|
value: production
|
|
- name: CRON_MIN
|
|
value: "13,43"
|
|
- name: OIDC_ENABLED
|
|
value: "1"
|
|
- name: OIDC_PROVIDER_METADATA_URL
|
|
value: https://authentik.rubenhensen.nl/application/o/freshrss/.well-known/openid-configuration
|
|
- name: OIDC_CLIENT_ID
|
|
value: freshrss
|
|
- name: OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: freshrss-oidc-client-secret
|
|
key: client_secret
|
|
- name: OIDC_SCOPES
|
|
value: "openid email profile"
|
|
- name: OIDC_X_FORWARDED_HEADERS
|
|
value: X-Forwarded-Port X-Forwarded-Proto X-Forwarded-Host
|
|
# Session handling for the Apache mod_auth_openidc layer that guards /i/.
|
|
# Defaults are 5 min inactivity / ~7.5 h max, which is what caused the
|
|
# constant bounces back to authentik.
|
|
# Sliding window: refreshed on every request, so any visit within the
|
|
# period extends it by another 30 days.
|
|
- name: OIDC_SESSION_INACTIVITY_TIMEOUT
|
|
value: "2592000" # 30 days
|
|
# Hard cap, counted from login and never extended.
|
|
- name: OIDC_SESSION_MAX_DURATION
|
|
value: "7776000" # 90 days
|
|
# ":persistent" makes the session cookie survive a browser restart
|
|
# (its expiry tracks OIDC_SESSION_INACTIVITY_TIMEOUT).
|
|
- name: OIDC_SESSION_TYPE
|
|
value: "server-cache:persistent"
|
|
- name: TZ
|
|
value: Europe/Amsterdam
|
|
image: freshrss/freshrss:latest
|
|
name: freshrss
|
|
ports:
|
|
- containerPort: 80
|
|
protocol: TCP
|
|
volumeMounts:
|
|
- mountPath: /var/www/FreshRSS/data
|
|
name: data
|
|
- mountPath: /var/www/FreshRSS/extensions
|
|
name: extensions
|
|
- mountPath: /var/www/FreshRSS/data/config.custom.php
|
|
name: freshrss-claim2
|
|
- mountPath: /var/www/FreshRSS/data/config-user.custom.php
|
|
name: freshrss-claim3
|
|
restartPolicy: Always
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: data
|
|
- name: extensions
|
|
emptyDir: {}
|
|
- name: freshrss-claim2
|
|
persistentVolumeClaim:
|
|
claimName: freshrss-claim2
|
|
- name: freshrss-claim3
|
|
persistentVolumeClaim:
|
|
claimName: freshrss-claim3
|