mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
117 lines
3.9 KiB
YAML
117 lines
3.9 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
annotations:
|
|
kompose.cmd: kompose convert
|
|
kompose.version: 1.34.0 (cbf2835db)
|
|
labels:
|
|
io.kompose.service: freshrss
|
|
name: freshrss
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
io.kompose.service: freshrss
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
kompose.cmd: kompose convert
|
|
kompose.version: 1.34.0 (cbf2835db)
|
|
labels:
|
|
io.kompose.service: freshrss
|
|
spec:
|
|
initContainers:
|
|
- image: alpine/git
|
|
name: git
|
|
command:
|
|
- git
|
|
- clone
|
|
- https://github.com/rubenhensen/Extensions.git
|
|
- /tmp
|
|
volumeMounts:
|
|
- name: extensions
|
|
mountPath: /tmp
|
|
# cd /var/www/FreshRSS/extensions
|
|
# git checkout main
|
|
containers:
|
|
- env:
|
|
- name: FRESHRSS_ENV
|
|
value: production
|
|
- name: CRON_MIN
|
|
value: "13,43"
|
|
- name: OIDC_ENABLED
|
|
value: "1"
|
|
- name: OIDC_PROVIDER_METADATA_URL
|
|
value: https://authentik.rubenhensen.nl/application/o/freshrss/.well-known/openid-configuration
|
|
- name: OIDC_CLIENT_ID
|
|
value: freshrss
|
|
- name: OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: freshrss-oidc-client-secret
|
|
key: client_secret
|
|
- name: OIDC_SCOPES
|
|
value: "openid email profile"
|
|
- name: OIDC_X_FORWARDED_HEADERS
|
|
value: X-Forwarded-Port X-Forwarded-Proto X-Forwarded-Host
|
|
# Session handling for the Apache mod_auth_openidc layer that guards /i/.
|
|
# Defaults are 5 min inactivity / ~7.5 h max, which is what caused the
|
|
# constant bounces back to authentik.
|
|
# Sliding window: refreshed on every request, so any visit within the
|
|
# period extends it by another 30 days.
|
|
- name: OIDC_SESSION_INACTIVITY_TIMEOUT
|
|
value: "2592000" # 30 days
|
|
# Hard cap, counted from login and never extended.
|
|
- name: OIDC_SESSION_MAX_DURATION
|
|
value: "7776000" # 90 days
|
|
# ":persistent" makes the session cookie survive a browser restart
|
|
# (its expiry tracks OIDC_SESSION_INACTIVITY_TIMEOUT).
|
|
- name: OIDC_SESSION_TYPE
|
|
value: "server-cache:persistent"
|
|
- name: TZ
|
|
value: Europe/Amsterdam
|
|
# 1.30.3 ships PHP 8.4.27, which fixes CVE-2026-109618 and
|
|
# CVE-2026-109619.
|
|
image: freshrss/freshrss:1.30.3
|
|
name: freshrss
|
|
ports:
|
|
- containerPort: 80
|
|
protocol: TCP
|
|
# TCP, because mod_auth_openidc answers 401 to anything that isn't a
|
|
# browser.
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: 80
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: 80
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 30
|
|
timeoutSeconds: 10
|
|
failureThreshold: 5
|
|
volumeMounts:
|
|
- mountPath: /var/www/FreshRSS/data
|
|
name: data
|
|
- mountPath: /var/www/FreshRSS/extensions
|
|
name: extensions
|
|
- mountPath: /var/www/FreshRSS/data/config.custom.php
|
|
name: freshrss-claim2
|
|
- mountPath: /var/www/FreshRSS/data/config-user.custom.php
|
|
name: freshrss-claim3
|
|
restartPolicy: Always
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: data
|
|
- name: extensions
|
|
emptyDir: {}
|
|
- name: freshrss-claim2
|
|
persistentVolumeClaim:
|
|
claimName: freshrss-claim2
|
|
- name: freshrss-claim3
|
|
persistentVolumeClaim:
|
|
claimName: freshrss-claim3
|