sora/nixconfig
1
0
Fork 1
Code Issues 2 Pull Requests Actions Releases Activity

freshrss oidc

Browse Source
This commit is contained in:
soraefir
2026-06-01 22:27:12 +02:00
parent 7805758114
commit 70eb9f8664
4 changed files with 81 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
modules/server/containers/apps/authentik.nix
View File

@@ -11,6 +11,7 @@ let
// (if serverCfg.containers?jellyfin then { JELLYFIN_DOMAIN = "${serverCfg.containers.jellyfin.subdomain}.${serverCfg.domain}";} else {})
// (if serverCfg.containers?gitea then { GITEA_DOMAIN = "${serverCfg.containers.gitea.subdomain}.${serverCfg.domain}";} else {})
// (if serverCfg.containers?immich then { IMMICH_DOMAIN = "${serverCfg.containers.immich.subdomain}.${serverCfg.domain}";} else {})
// (if serverCfg.containers?freshrss then { FRESHRSS_DOMAIN = "${serverCfg.containers.freshrss.subdomain}.${serverCfg.domain}";} else {})
// (if serverCfg.containers?homepage then { HOMEPAGE_DOMAIN = "${serverCfg.containers.homepage.subdomain}.${serverCfg.domain}";} else {})
// (if serverCfg.containers?nextcloud then { NEXTCLOUD_DOMAIN = "${serverCfg.containers.nextcloud.subdomain}.${serverCfg.domain}";} else {});
};
@@ -107,6 +108,7 @@ in {
${lib.optionalString (serverCfg.containers ? jellyfin) ''$AK apply_blueprint /blueprints/custom/jellyfin.yaml''}
${lib.optionalString (serverCfg.containers ? nextcloud) ''$AK apply_blueprint /blueprints/custom/nextcloud.yaml''}
${lib.optionalString (serverCfg.containers ? immich) ''$AK apply_blueprint /blueprints/custom/immich.yaml''}
${lib.optionalString (serverCfg.containers ? freshrss) ''$AK apply_blueprint /blueprints/custom/freshrss.yaml''}
${lib.optionalString (serverCfg.containers ? homepage) ''$AK apply_blueprint /blueprints/custom/homepage.yaml''}
echo "Completed Authentik Setup"

31
modules/server/containers/apps/freshrss.nix
View File

@@ -26,29 +26,34 @@ in {
PGID = "1000";
TRUSTED_PROXY = "10.0.0.0/8 192.168.0.1/16";
PUBLISHED_PORT = "80";
ADMIN_PASSWORD = "admin"; # Change this to a secure password in production!
ADMIN_API_PASSWORD = "admin"; # Change this to a secure password in production!
BASE_URL = "https://${containerCfg.subdomain}.${serverCfg.domain}";
SERVER_DNS = "${containerCfg.subdomain}.${serverCfg.domain}";
DB_HOST = "${builder.host}";
DB_BASE = "freshrss_db";
DB_USER = "freshrss_user";
OIDC_PROVIDER_METADATA_URL = "https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}/application/o/freshrss/.well-known/openid-configuration";
OIDC_REMOTE_USER_CLAIM = "preferred_username";
OIDC_CLIENT_ID = "freshrss";
OIDC_SCOPES = "openid profile";
OIDC_X_FORWARDED_HEADERS = "X-Forwarded-Host X-Forwarded-Port X-Forwarded-Proto";
OIDC_CLIENT_SECRET = "123"; #SECRET
# OIDC_CLIENT_CRYPTO_KEY = "123"; #SECRET
};
overrides = {
volumes = [
"${serverCfg.configPath}/freshrss:/config"
];
volumes = [];
};
};
};
setup = {
trigger = "server"; # Triggers atomic environment verification on main controller
envFile = config.sops.secrets."FRESHRSS".path;
envFile = [ config.sops.secrets."FRESHRSS".path config.sops.secrets."CUSTOM".path];
script = pkgs.writeShellScript "setup-freshrss" ''
RSS_URL="https://${containerCfg.subdomain}.${serverCfg.domain}"
${pkgs.curl}/bin/curl -s -X POST "$RSS_URL/i/index.php?step=0" -H "Content-Type: application/x-www-form-urlencoded" --data-raw "language=en"
RSS="${pkgs.podman}/bin/podman --events-backend=none exec freshrss-server"
$RSS ./cli/prepare.php
$RSS ./cli/do-install.php --default-user $DEFAULT_ADMIN_USERNAME --auth-type http_auth --base-url https://${containerCfg.subdomain}.${serverCfg.domain} --language en \
--title RSS --api-enabled --db-type pgsql --db-host ${builder.host} --db-user freshrss-user --db-API $DB_PASSWORD --db-base freshrss-db
$RSS ./cli/reconfigure.php
$RSS ./cli/update-user.php --user $DEFAULT_ADMIN_USERNAME --password $DEFAULT_ADMIN_PASSWORD --email $DEFAULT_ADMIN_EMAIL
'';
};
}