fix: add /tmp to open_basedir as its required for exports

Reviewed-on: docker/freshrss#106

.chglog/CHANGELOG.tpl.md

@@ -0,0 +1,23 @@
+# Changelog
+
+{{ range .Versions -}}
+## {{ if .Tag.Previous }}[{{ .Tag.Name }}]({{ $.Info.RepositoryURL }}/compare/{{ .Tag.Previous.Name }}...{{ .Tag.Name }}){{ else }}{{ .Tag.Name }}{{ end }} ({{ datetime "2006-01-02" .Tag.Date }})
+
+{{ range .CommitGroups -}}
+### {{ .Title }}
+
+{{ range .Commits -}}
+- {{ if .Scope }}**{{ .Scope }}:** {{ end }}{{ (regexReplaceAll "(.*)/issues/(.*)" (regexReplaceAll "(Co-\\w*-by.*)" .Subject "") "${1}/pulls/${2}") | trim }}
+{{ end }}
+{{- end -}}
+
+{{- if .NoteGroups -}}
+{{ range .NoteGroups -}}
+### {{ .Title }}
+
+{{ range .Notes }}
+{{ .Body }}
+{{ end }}
+{{ end -}}
+{{ end -}}
+{{ end -}}

.chglog/config.yml

@@ -0,0 +1,25 @@
+style: github
+template: CHANGELOG.tpl.md
+info:
+  title: CHANGELOG
+  repository_url: https://gitea.rknet.org/docker/freshrss
+options:
+  commit_groups:
+    title_maps:
+      feat: Features
+      fix: Bug Fixes
+      perf: Performance Improvements
+      refactor: Code Refactoring
+      chore: Others
+      test: Testing
+      ci: CI Pipeline
+      docs: Documentation
+  header:
+    pattern: "^(\\w*)(?:\\(([\\w\\$\\.\\-\\*\\s]*)\\))?\\:\\s(.*)$"
+    pattern_maps:
+      - Type
+      - Scope
+      - Subject
+  notes:
+    keywords:
+      - BREAKING CHANGE

.dockerignore

@@ -1,8 +0,0 @@
-.git
-.git*
-.drone.*
-*.md
-.dockerignore
-Dockerfile
-Dockerfile.*
-docker-compose.yml

.drone.jsonnet

@@ -1,148 +0,0 @@
-local PipelineBuild(os='linux', arch='amd64') = {
-  local tag = os + '-' + arch,
-  local version_tag = os + '-' + arch,
-  local file_suffix = std.strReplace(version_tag, '-', '.'),
-  kind: "pipeline",
-  name: version_tag,
-  platform: {
-    os: os,
-    arch: arch,
-  },
-  steps: [
-    {
-      name: 'dryrun',
-      image: 'plugins/docker:' + tag,
-      pull: 'always',
-      settings: {
-        dry_run: true,
-        tags: version_tag,
-        dockerfile: './Dockerfile.' + file_suffix,
-        repo: 'xoxys/freshrss',
-        username: { from_secret: "docker_username" },
-        password: { from_secret: "docker_password" },
-        build_args: {
-          FRESHRSS_VERSION: "${DRONE_TAG%-*}",
-        },
-      },
-    },
-    {
-      name: 'publish',
-      image: 'plugins/docker:' + tag,
-      pull: 'always',
-      settings: {
-        auto_tag: true,
-        auto_tag_suffix: version_tag,
-        dockerfile: './Dockerfile.' + file_suffix,
-        repo: 'xoxys/freshrss',
-        username: { from_secret: "docker_username" },
-        password: { from_secret: "docker_password" },
-        build_args: {
-          FRESHRSS_VERSION: "${DRONE_TAG%-*}",
-        },
-      },
-      when: {
-        ref: [
-          'refs/heads/master',
-          'refs/tags/**',
-        ],
-      },
-    },
-    {
-      name: "publish-gitea",
-      image: "plugins/gitea-release",
-      pull: "always",
-      settings: {
-        api_key: { "from_secret": "gitea_token" },
-        base_url: "https://gitea.rknet.org",
-        overwrite: true,
-        title: "${DRONE_TAG}",
-        note: "CHANGELOG.md",
-      },
-      when: {
-        ref: ['refs/tags/**'],
-      },
-    },
-  ],
-};
-
-local PipelineNotifications(depends_on=[]) = {
-  kind: "pipeline",
-  name: "notifications",
-  platform: {
-    os: "linux",
-    arch: "amd64",
-  },
-  steps: [
-    {
-      image: "plugins/manifest",
-      name: "manifest",
-      pull: "always",
-      settings: {
-        ignore_missing: true,
-        tags: ["${DRONE_TAG}", "${DRONE_TAG%-*}", "${DRONE_TAG%.*}", "${DRONE_TAG%%.*}"],
-        username: { from_secret: "docker_username" },
-        password: { from_secret: "docker_password" },
-        spec: "./manifest.tmpl",
-      },
-      when: {
-        ref: [
-          'refs/heads/master',
-          'refs/tags/**',
-        ],
-      },
-    },
-    {
-      name: "readme",
-      image: "sheogorath/readme-to-dockerhub",
-      pull: "always",
-      environment: {
-        DOCKERHUB_USERNAME: { from_secret: "docker_username" },
-        DOCKERHUB_PASSWORD: { from_secret: "docker_password" },
-        DOCKERHUB_REPO_PREFIX: "xoxys",
-        DOCKERHUB_REPO_NAME: "freshrss",
-        README_PATH: "README.md",
-        SHORT_DESCRIPTION: "Rootless FreshRSS - Self-hosted RSS feed aggregator"
-      },
-      when: {
-        ref: [
-          'refs/heads/master',
-          'refs/tags/**',
-        ],
-      },
-    },
-    {
-      name: "microbadger",
-      image: "plugins/webhook",
-      pull: "always",
-      settings: {
-        urls: { from_secret: "microbadger_url" },
-      },
-    },
-    {
-      image: "plugins/matrix",
-      name: "matrix",
-      pull: 'always',
-      settings: {
-        homeserver: "https://matrix.rknet.org",
-        roomid: "MtidqQXWWAtQcByBhH:rknet.org",
-        template: "Status: **{{ build.status }}**<br/> Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.link }}) ({{ build.branch }}) by {{ build.author }}<br/> Message: {{ build.message }}",
-        username: { from_secret: "matrix_username" },
-        password: { from_secret: "matrix_password" },
-      },
-      when: {
-        status: [ "success", "failure" ],
-      },
-    },
-  ],
-  trigger: {
-    status: [ "success", "failure" ],
-  },
-  depends_on: depends_on,
-};
-
-[
-  PipelineBuild(os='linux', arch='amd64'),
-  PipelineNotifications(depends_on=[
-    "linux-amd64",
-  ])
-]

.drone.yml

@@ -1,59 +1,132 @@
 ---
 kind: pipeline
-name: linux-amd64
+name: test
 
 platform:
   os: linux
   arch: amd64
 
 steps:
-- name: dryrun
-  pull: always
-  image: plugins/docker:linux-amd64
-  settings:
-    build_args:
-      FRESHRSS_VERSION: "${DRONE_TAG%-*}"
-    dockerfile: ./Dockerfile.linux.amd64
-    dry_run: true
-    password:
-      from_secret: docker_password
-    repo: xoxys/freshrss
-    tags: linux-amd64
-    username:
-      from_secret: docker_username
+  - name: markdownlint
+    image: thegeeklab/markdownlint-cli
+    commands:
+      - markdownlint 'README.md'
 
-- name: publish
-  pull: always
-  image: plugins/docker:linux-amd64
-  settings:
-    auto_tag: true
-    auto_tag_suffix: linux-amd64
-    build_args:
-      FRESHRSS_VERSION: "${DRONE_TAG%-*}"
-    dockerfile: ./Dockerfile.linux.amd64
-    password:
-      from_secret: docker_password
-    repo: xoxys/freshrss
-    username:
-      from_secret: docker_username
-  when:
-    ref:
-    - refs/heads/master
-    - "refs/tags/**"
+trigger:
+  ref:
+    - refs/heads/main
+    - refs/pull/**
+    - refs/tags/**
 
-- name: publish-gitea
-  pull: always
-  image: plugins/gitea-release
-  settings:
-    api_key:
-      from_secret: gitea_token
-    base_url: https://gitea.rknet.org
-    note: CHANGELOG.md
-    overwrite: true
-    title: "${DRONE_TAG}"
-  when:
-    ref:
-    - "refs/tags/**"
+---
+kind: pipeline
+name: build-container
+
+platform:
+  os: linux
+  arch: amd64
+
+steps:
+  - name: dryrun
+    image: thegeeklab/drone-docker-buildx:23
+    settings:
+      dockerfile: Dockerfile
+      dry_run: true
+      provenance: false
+      repo: thegeeklab/${DRONE_REPO_NAME}
+    when:
+      ref:
+        - refs/pull/**
+
+  - name: tags
+    image: thegeeklab/docker-autotag
+    environment:
+      DOCKER_AUTOTAG_FORCE_LATEST: True
+      DOCKER_AUTOTAG_IGNORE_PRERELEASE: True
+      DOCKER_AUTOTAG_OUTPUT_FILE: .tags
+      DOCKER_AUTOTAG_VERSION: ${DRONE_TAG}
+    when:
+      ref:
+        - refs/heads/main
+        - refs/tags/**
+    depends_on:
+      - dryrun
+
+  - name: changelog-generate
+    image: thegeeklab/git-chglog
+    commands:
+      - git fetch -tq
+      - git-chglog --no-color --no-emoji -o CHANGELOG.md ${DRONE_TAG:---next-tag unreleased unreleased}
+    depends_on:
+      - tags
+
+  - name: changelog-format
+    image: thegeeklab/alpine-tools
+    commands:
+      - prettier CHANGELOG.md
+      - prettier -w CHANGELOG.md
+    depends_on:
+      - changelog-generate
+
+  - name: publish-dockerhub
+    image: thegeeklab/drone-docker-buildx:23
+    settings:
+      dockerfile: Dockerfile
+      password:
+        from_secret: docker_password
+      provenance: false
+      repo: thegeeklab/${DRONE_REPO_NAME}
+      username:
+        from_secret: docker_username
+    when:
+      ref:
+        - refs/heads/main
+        - refs/tags/**
+    depends_on:
+      - changelog-format
+
+  - name: publish-quay
+    image: thegeeklab/drone-docker-buildx:23
+    settings:
+      dockerfile: Dockerfile
+      password:
+        from_secret: quay_password
+      provenance: false
+      registry: quay.io
+      repo: quay.io/thegeeklab/${DRONE_REPO_NAME}
+      username:
+        from_secret: quay_username
+    when:
+      ref:
+        - refs/heads/main
+        - refs/tags/**
+    depends_on:
+      - changelog-format
+
+  - name: publish-gitea
+    image: plugins/gitea-release
+    settings:
+      api_key:
+        from_secret: gitea_token
+      base_url: https://gitea.rknet.org
+      note: CHANGELOG.md
+      overwrite: true
+      title: ${DRONE_TAG}
+    when:
+      ref:
+        - refs/tags/**
+    depends_on:
+      - publish-dockerhub
+      - publish-quay
+
+trigger:
+  ref:
+    - refs/heads/main
+    - refs/pull/**
+    - refs/tags/**
+
+depends_on:
+  - test
 
 ---
 kind: pipeline
@@ -64,76 +137,63 @@ platform:
   arch: amd64
 
 steps:
-- name: manifest
-  pull: always
-  image: plugins/manifest
-  settings:
-    ignore_missing: true
-    password:
-      from_secret: docker_password
-    spec: ./manifest.tmpl
-    tags:
-    - "${DRONE_TAG}"
-    - "${DRONE_TAG%-*}"
-    - "${DRONE_TAG%.*}"
-    - "${DRONE_TAG%%.*}"
-    username:
-      from_secret: docker_username
-  when:
-    ref:
-    - refs/heads/master
-    - "refs/tags/**"
+  - name: pushrm-dockerhub
+    pull: always
+    image: chko/docker-pushrm:1
+    environment:
+      DOCKER_PASS:
+        from_secret: docker_password
+      DOCKER_USER:
+        from_secret: docker_username
+      PUSHRM_FILE: README.md
+      PUSHRM_SHORT: Custom image for FreshRSS feed aggregator
+      PUSHRM_TARGET: thegeeklab/${DRONE_REPO_NAME}
+    when:
+      status:
+        - success
 
-- name: readme
-  pull: always
-  image: sheogorath/readme-to-dockerhub
-  environment:
-    DOCKERHUB_PASSWORD:
-      from_secret: docker_password
-    DOCKERHUB_REPO_NAME: freshrss
-    DOCKERHUB_REPO_PREFIX: xoxys
-    DOCKERHUB_USERNAME:
-      from_secret: docker_username
-    README_PATH: README.md
-    SHORT_DESCRIPTION: Rootless FreshRSS - Self-hosted RSS feed aggregator
-  when:
-    ref:
-    - refs/heads/master
-    - "refs/tags/**"
+  - name: pushrm-quay
+    pull: always
+    image: chko/docker-pushrm:1
+    environment:
+      APIKEY__QUAY_IO:
+        from_secret: quay_token
+      PUSHRM_FILE: README.md
+      PUSHRM_TARGET: quay.io/thegeeklab/${DRONE_REPO_NAME}
+    when:
+      status:
+        - success
 
-- name: microbadger
-  pull: always
-  image: plugins/webhook
-  settings:
-    urls:
-      from_secret: microbadger_url
+  - name: matrix
+    image: thegeeklab/drone-matrix
+    settings:
+      homeserver:
+        from_secret: matrix_homeserver
+      password:
+        from_secret: matrix_password
+      roomid:
+        from_secret: matrix_roomid
+      template: "Status: **{{ .Build.Status }}**<br/> Build: [{{ .Repo.Owner }}/{{ .Repo.Name }}]({{ .Build.Link }}){{ if .Build.Branch }} ({{ .Build.Branch }}){{ end }} by {{ .Commit.Author }}<br/> Message: {{ .Commit.Message.Title }}"
+      username:
+        from_secret: matrix_username
+    when:
+      status:
+        - success
+        - failure
 
-- name: matrix
-  pull: always
-  image: plugins/matrix
-  settings:
-    homeserver: https://matrix.rknet.org
-    password:
-      from_secret: matrix_password
-    roomid: MtidqQXWWAtQcByBhH:rknet.org
-    template: "Status: **{{ build.status }}**<br/> Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.link }}) ({{ build.branch }}) by {{ build.author }}<br/> Message: {{ build.message }}"
-    username:
-      from_secret: matrix_username
-  when:
-    status:
+trigger:
+  ref:
+    - refs/heads/main
+    - refs/tags/**
+  status:
     - success
     - failure
 
-trigger:
-  status:
-  - success
-  - failure
-
 depends_on:
-- linux-amd64
+  - build-container
 
 ---
 kind: signature
-hmac: bd995781ed16870c304a86ea3c0ab8e61f34f6539ab34e4c16750f0e677965a2
+hmac: cba07850e21c648f8558e69aa7e5a561ef473fe2a3a7890bf308a57c73ea0343
 
 ...

.gitignore

@@ -1 +1,2 @@
 test/
+CHANGELOG.md

.markdownlint.yml

@@ -0,0 +1,6 @@
+---
+default: True
+MD013: False
+MD041: False
+MD004:
+  style: dash

.prettierignore

@@ -0,0 +1,3 @@
+.drone.yml
+*.tpl.md
+LICENSE

CHANGELOG.md

@@ -1,2 +0,0 @@
-* BUGFIX
-  * move healthcheck to wrapper script

Dockerfile

@@ -0,0 +1,55 @@
+FROM thegeeklab/nginx:latest@sha256:72ffd57b6b89013f6b4c6a8a97728120df1dfac0d66b2164e0aacba21ee87380
+
+LABEL maintainer="Robert Kaussow <mail@thegeeklab.de>"
+LABEL org.opencontainers.image.authors="Robert Kaussow <mail@thegeeklab.de>"
+LABEL org.opencontainers.image.title="FreshRSS"
+LABEL org.opencontainers.image.url="https://gitea.rknet.org/docker/freshrss"
+LABEL org.opencontainers.image.source="https://gitea.rknet.org/docker/freshrss"
+LABEL org.opencontainers.image.documentation="https://gitea.rknet.org/docker/freshrss"
+
+ARG BUILD_VERSION
+
+# renovate: datasource=github-releases depName=FreshRSS/FreshRSS
+ENV FRESHRSS_VERSION="${BUILD_VERSION:-1.21.0}"
+
+ADD overlay/ /
+
+RUN apk --update add --virtual .build-deps tar curl && \
+    apk --update add php81 php81-curl php81-fpm php81-gmp php81-intl php81-mbstring php81-xml \
+      php81-zip php81-ctype php81-dom php81-fileinfo php81-iconv php81-json php81-opcache php81-phar \
+      php81-session php81-simplexml php81-xmlreader php81-xmlwriter php81-tokenizer php81-zlib \
+      php81-openssl php81-pdo_sqlite php81-pdo_mysql php81-pdo_pgsql && \
+    rm -rf /var/www/localhost && \
+    rm -f /etc/php81/php-fpm.d/www.conf && \
+    mkdir -p /var/www/app && \
+    mkdir /var/www/.postgresql && \
+    FRESHRSS_VERSION="${FRESHRSS_VERSION##v}" && \
+    echo "Installing FreshRSS version '${FRESHRSS_VERSION}' ..." && \
+    curl -SsfL "https://github.com/FreshRSS/FreshRSS/archive/${FRESHRSS_VERSION}.tar.gz" | \
+      tar xz -C /var/www/app/ -X /.tarignore --strip-components=1 && \
+    curl -SsfL -o /etc/php81/browscap.ini https://browscap.org/stream?q=Lite_PHP_BrowsCapINI && \
+    apk del .build-deps && \
+    rm -rf /var/cache/apk/* && \
+    rm -rf /tmp/* && \
+    mkdir -p /var/run/php && \
+    chown -R nginx /var/run/php && \
+    mkdir -p /var/lib/php/tmp_upload && \
+    mkdir -p /var/lib/php/soap_cache && \
+    mkdir -p /var/lib/php/session && \
+    chown -R nginx /var/lib/php && \
+    chown nginx /etc/php81/php.ini && \
+    chown -R nginx:nginx /var/www/.postgresql && \
+    chown -R nginx:nginx /var/www/app
+
+VOLUME /var/www/app/extensions
+VOLUME /var/www/app/data
+
+EXPOSE 8080
+
+USER nginx
+
+STOPSIGNAL SIGTERM
+
+ENTRYPOINT ["/usr/local/bin/entrypoint"]
+WORKDIR /var/www/app
+CMD []

Dockerfile.linux.amd64

@@ -1,49 +0,0 @@
-FROM xoxys/nginx:latest
-
-LABEL maintainer="Robert Kaussow <mail@geeklabor.de>" \
-    org.label-schema.name="FreshRSS" \
-    org.label-schema.version="1.2" \
-    org.label-schema.vendor="Robert Kaussow" \
-    org.label-schema.schema-version="1.0"
-
-ARG FRESHRSS_VERSION=master
-ARG FRESHRSS_TARBALL=https://github.com/FreshRSS/FreshRSS/archive/${FRESHRSS_VERSION}.tar.gz
-
-RUN apk --update add --virtual .build-deps tar curl && \
-    apk --update add php7 php7-curl php7-fpm php7-gmp php7-intl php7-mbstring php7-xml \
-    php7-zip php7-ctype php7-dom php7-fileinfo php7-iconv php7-json php7-session \
-    php7-simplexml php7-xmlreader php7-zlib php7-pdo_sqlite php7-pdo_mysql\
-    php7-pdo_pgsql && \
-    rm -rf /var/www/localhost && \
-    rm -f /etc/php7/php-fpm.d/www.conf && \
-    mkdir -p /var/www/app && \
-    curl -SsL ${FRESHRSS_TARBALL} | tar xz -C /var/www/app/ --strip-components=1 && \
-    curl -SsL -o /etc/php7/browscap.ini https://browscap.org/stream?q=Lite_PHP_BrowsCapINI && \
-    apk del .build-deps && \
-    rm -rf /var/cache/apk/* && \
-    rm -rf /tmp/* && \
-    rm -rf /var/www/app/CHANGELOG.md /var/www/app/CONTRIBUTING.md /var/www/app/CREDITS.md /var/www/app/Docker /var/www/app/README.* && \
-    mkdir -p /var/run/php && \
-    chown -R nginx /var/run/php && \
-    mkdir -p /var/lib/php/tmp_upload && \
-    mkdir -p /var/lib/php/soap_cache && \
-    mkdir -p /var/lib/php/session && \
-    chown -R nginx /var/lib/php && \
-    chown nginx /etc/php7/php.ini && \
-    chown -R nginx:nginx /var/www/app
-
-ADD overlay/ /
-
-VOLUME /var/www/app/extensions
-VOLUME /var/www/app/data
-
-EXPOSE 8080
-
-USER nginx
-
-STOPSIGNAL SIGTERM
-
-ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
-HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD /usr/local/bin/healthcheck.sh
-WORKDIR /var/www/app
-CMD []

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2019 Robert Kaussow
+Copyright (c) 2022 Robert Kaussow <mail@thegeeklab.de>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -1,9 +1,14 @@
-# [freshrss](https://gitea.rknet.org/docker/freshrss)
+# freshrss
 
-[![Build Status](https://drone.rknet.org/api/badges/docker/freshrss/status.svg)](https://drone.rknet.org/docker/freshrss/)
-[![Microbadger](https://images.microbadger.com/badges/image/xoxys/freshrss.svg)](https://microbadger.com/images/xoxys/freshrss "Get your own image badge on microbadger.com")
+Custom image for FreshRSS feed aggregator
 
-FreshRSS is a self-hosted RSS feed aggregator. It is lightweight, easy to work with, powerful, and customizable.
+[![Build Status](https://img.shields.io/drone/build/docker/freshrss?logo=drone&server=https%3A%2F%2Fdrone.rknet.org)](https://drone.rknet.org/docker/freshrss)
+[![Docker Hub](https://img.shields.io/badge/dockerhub-latest-blue.svg?logo=docker&logoColor=white)](https://hub.docker.com/r/thegeeklab/freshrss)
+[![Quay.io](https://img.shields.io/badge/quay-latest-blue.svg?logo=docker&logoColor=white)](https://quay.io/repository/thegeeklab/freshrss)
+[![Source: Gitea](https://img.shields.io/badge/source-gitea-blue.svg?logo=gitea&logoColor=white)](https://gitea.rknet.org/docker/freshrss)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://gitea.rknet.org/docker/freshrss/src/branch/main/LICENSE)
+
+Custom rootless Docker image for FreshRSS, a self-hosted RSS feed aggregator. It is lightweight, easy to work with, powerful, and customizable.
 
 ## Usage
 
@@ -17,42 +22,16 @@ Here are some example snippets to help you get started creating a container. Thi
 docker create \
   --name=freshrss \
   -p 80:8080 \
-  xoxys/freshrss
+  thegeeklab/freshrss
 ```
 
 ### Docker Compose
 
-Compatible with docker-compose v2 schemas.
-
-```Yaml
----
-version: '2.1'
-
-services:
-  freshrss:
-    container_name: freshrss
-    image: xoxys/freshrss:latest
-    ports:
-      - "80:8080"
-    volumes:
-      - freshrss_data:/var/www/app/data
-      - freshrss_extensions:/var/www/app/extensions
-    environment:
-      FRESHRSS_DEFAULT_USER: admin
-      FRESHRSS_DEFAULT_PASSWORD: freshrss
-      FRESHRSS_API_ENABLED: "true"
-      FRESHRSS_SALT: "38fd29ac5878c270bbfc3599723cd479d48c6c58"
-
-volumes:
-  freshrss_data:
-    driver: local
-  freshrss_extensions:
-    driver: local
-```
+Please take a look at the [example](https://gitea.rknet.org/docker/freshrss/src/branch/main/docker-compose.yml) compose file from the git repo.
 
 ## Environment variables
 
-### freshrss
+### FreshRSS
 
 > **WARNING**: Don't change any system settings through the web UI! These changes will be overwritten at EVERY container startup. Use the provided environment variables instead.
 
@@ -69,7 +48,6 @@ FRESHRSS_BASE_URL="http://localhost/"
 FRESHRSS_LANGUAGE="en"
 FRESHRSS_TITLE="FreshRSS"
 FRESHRSS_META_DESCRIPTION=
-FRESHRSS_DEFAULT_USER="_"
 FRESHRSS_ALLOW_ANONYMOUS="false"
 FRESHRSS_ALLOW_ANONYMOUS_REFRESH="false"
 FRESHRSS_AUTH_TYPE="form"
@@ -82,7 +60,6 @@ FRESHRSS_ALLOW_REFERRER="false"
 FRESHRSS_LIMITS_COOKIE_DURATION="2592000"
 FRESHRSS_LIMITS_CACHE_DURATION="800"
 FRESHRSS_LIMITS_TIMEOUT="15"
-FRESHRSS_LIMITS_MAX_INACTIVITY="10800"
 FRESHRSS_LIMITS_MAX_FEEDS="16384"
 FRESHRSS_LIMITS_MAX_CATEGORIES="16384"
 FRESHRSS_LIMITS_MAX_REGISTRATIONS="1"
@@ -95,12 +72,15 @@ FRESHRSS_CURLOPT_PROXYAUTH=
 FRESHRSS_CURLOPT_PROXYUSERPWD=
 FRESHRSS_DB_TYPE="sqlite"
 FRESHRSS_DB_HOST="localhost"
+FRESHRSS_DB_PORT=
 FRESHRSS_DB_USER=
 FRESHRSS_DB_PASSWORD=
 FRESHRSS_DB_BASE=
 FRESHRSS_DB_PREFIX="freshrss_"
 ## comma-seperated string, extensions must be installed!
 FRESHRSS_EXTENSIONS_ENABLED="Tumblr-GDPR"
+## comma-seperated string
+FRESHRSS_TRUSTED_SOURCES=127.0.0.0/8,::1/128
 ```
 
 ### PHP
@@ -121,7 +101,7 @@ PHP_REPORT_MEMLEAKS=On
 PHP_HTML_ERRORSOn
 PHP_ERROR_LOG=/proc/self/fd/2
 PHP_POST_MAX_SIZE=8M
-PHP_FILE_UPLOADS=Off
+PHP_FILE_UPLOADS=On
 PHP_UPLOAD_MAX_FILESIZE=2M
 PHP_MAX_FILE_UPLOADS=2
 PHP_ALLOW_URL_FOPEN=On
@@ -130,10 +110,6 @@ PHP_DATE_TIMEZONE=Europe/Berlin
 PHP_SQL_SAFE_MODE=On
 ```
 
-### License
+## License
 
-This project is licensed under the MIT License - see the [LICENSE](https://gitea.rknet.org/docker/freshrss/src/branch/master/LICENSE) file for details.
-
-### Maintainers and Contributors
-
-[Robert Kaussow](https://gitea.rknet.org/xoxys)
+This project is licensed under the MIT License - see the [LICENSE](https://gitea.rknet.org/docker/freshrss/src/branch/main/LICENSE) file for details.

docker-compose.yml

@@ -1,10 +1,10 @@
 ---
-version: '2.1'
+version: "3"
 
 services:
   freshrss:
     container_name: freshrss
-    image: xoxys/freshrss:latest
+    image: thegeeklab/freshrss
     ports:
       - "80:8080"
     volumes:

manifest.tmpl

@@ -1,15 +0,0 @@
-image: xoxys/freshrss:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}latest{{/if}}
-{{#if build.tags}}
-tags:
-{{#each build.tags}}
-  {{#if this}}
-  - {{trimPrefix "v" this}}
-  - {{trimPrefix "v" this}}-linux-amd64
-  {{/if}}
-{{/each}}
-{{/if}}
-manifests:
-  - image: xoxys/freshrss:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}linux-amd64
-    platform:
-      architecture: amd64
-      os: linux

overlay/.tarignore

@@ -0,0 +1,9 @@
+CHANGELOG.md
+CONTRIBUTING.md
+CREDITS.md
+Docker
+docs
+tests
+README*
+Make*
+.[!.]*

overlay/etc/crontabs/nginx

@@ -1,2 +1,2 @@
 SHELL=/bin/sh
-*/15 * * * * /usr/bin/php -f /var/www/app/app/actualize_script.php >/dev/null 2>&1
+*/15 * * * * /usr/bin/php -f /var/www/app/app/actualize_script.php >/tmp/freshrss_sync.log 2>&1

overlay/etc/templates/config.php.tmpl

@@ -7,47 +7,47 @@ return array(
     'language' => '{{ getenv "FRESHRSS_LANGUAGE" "en" }}',
     'title' => '{{ getenv "FRESHRSS_TITLE" "FreshRSS" }}',
     'meta_description' => '{{ getenv "FRESHRSS_META_DESCRIPTION" }}',
-    'default_user' => '{{ getenv "FRESHRSS_DEFAULT_USER" "_" }}',
-    'allow_anonymous' => {{ getenv "FRESHRSS_ALLOW_ANONYMOUS" "false" }},
-    'allow_anonymous_refresh' => {{ getenv "FRESHRSS_ALLOW_ANONYMOUS_REFRESH" "false" }},
+    'default_user' => '{{ getenv "FRESHRSS_DEFAULT_USER" "admin" }}',
+    'allow_anonymous' => {{ getenv "FRESHRSS_ALLOW_ANONYMOUS" "false" | conv.ToBool }},
+    'allow_anonymous_refresh' => {{ getenv "FRESHRSS_ALLOW_ANONYMOUS_REFRESH" "false" | conv.ToBool }},
     'auth_type' => '{{ getenv "FRESHRSS_AUTH_TYPE" "form" }}',
-    'api_enabled' => {{ getenv "FRESHRSS_API_ENABLED" "false" }},
-    'unsafe_autologin_enabled' => {{ getenv "FRESHRSS_UNSAFE_AUTOLOGIN_ENABLED" "false" }},
-    'simplepie_syslog_enabled' => {{ getenv "FRESHRSS_SIMPLEPIE_SYSLOG_ENABLED" "true" }},
-    'pubsubhubbub_enabled' => {{ getenv "FRESHRSS_PUBSUBHUBBUB_ENABLED" "false" }},
-    'allow_robots' => {{ getenv "FRESHRSS_ALLOW_ROBOTS" "false" }},
-    'allow_referrer' => {{ getenv "FRESHRSS_ALLOW_REFERRER" "false" }},
+    'api_enabled' => {{ getenv "FRESHRSS_API_ENABLED" "false" | conv.ToBool }},
+    'unsafe_autologin_enabled' => {{ getenv "FRESHRSS_UNSAFE_AUTOLOGIN_ENABLED" "false" | conv.ToBool }},
+    'simplepie_syslog_enabled' => {{ getenv "FRESHRSS_SIMPLEPIE_SYSLOG_ENABLED" "true" | conv.ToBool }},
+    'pubsubhubbub_enabled' => {{ getenv "FRESHRSS_PUBSUBHUBBUB_ENABLED" "false" | conv.ToBool }},
+    'allow_robots' => {{ getenv "FRESHRSS_ALLOW_ROBOTS" "false" | conv.ToBool }},
+    'allow_referrer' => {{ getenv "FRESHRSS_ALLOW_REFERRER" "false" | conv.ToBool }},
 
     'limits' => array(
         'cookie_duration' => {{ getenv "FRESHRSS_LIMITS_COOKIE_DURATION" "2592000" }},
         'cache_duration' => {{ getenv "FRESHRSS_LIMITS_CACHE_DURATION" "800" }},
         'timeout' => {{ getenv "FRESHRSS_LIMITS_TIMEOUT" "15" }},
-        'max_inactivity' => {{ getenv "FRESHRSS_LIMITS_MAX_INACTIVITY" "10800" }},
+        'max_inactivity' => PHP_INT_MAX,
         'max_feeds' => {{ getenv "FRESHRSS_LIMITS_MAX_FEEDS" "16384" }},
         'max_categories' => {{ getenv "FRESHRSS_LIMITS_MAX_CATEGORIES" "16384" }},
         'max_registrations' => {{ getenv "FRESHRSS_LIMITS_MAX_REGISTRATIONS" "1" }},
     ),
 
     'curl_options' => array(
-        {{- if not (bool (getenv "FRESHRSS_CURLOPT_SSL_VERIFYHOST" "true")) }}
+        {{- if not (getenv "FRESHRSS_CURLOPT_SSL_VERIFYHOST" "true" | conv.ToBool) }}
         CURLOPT_SSL_VERIFYHOST => {{ getenv "FRESHRSS_CURLOPT_SSL_VERIFYHOST" }},
         {{- end }}
-        {{- if not (bool (getenv "FRESHRSS_CURLOPT_SSL_VERIFYPEER" "true")) }}
+        {{- if not (getenv "FRESHRSS_CURLOPT_SSL_VERIFYPEER" "true" | conv.ToBool) }}
         CURLOPT_SSL_VERIFYPEER => {{ getenv "FRESHRSS_CURLOPT_SSL_VERIFYPEER" }},
         {{- end }}
-        {{- if not (bool (getenv "FRESHRSS_CURLOPT_PROXYTYPE" "true")) }}
+        {{- if not (getenv "FRESHRSS_CURLOPT_PROXYTYPE" "true" | conv.ToBool) }}
         CURLOPT_PROXYTYPE => {{ getenv "FRESHRSS_CURLOPT_PROXYTYPE" }},
         {{- end }}
-        {{- if not (bool (getenv "FRESHRSS_CURLOPT_PROXY" "true" )) }}
+        {{- if not (getenv "FRESHRSS_CURLOPT_PROXY" "true" | conv.ToBool ) }}
         CURLOPT_PROXY => '{{ getenv "FRESHRSS_CURLOPT_PROXY" }}',
         {{- end }}
-        {{- if not (bool (getenv "FRESHRSS_CURLOPT_PROXYPORT" "true" )) }}
+        {{- if not (getenv "FRESHRSS_CURLOPT_PROXYPORT" "true" | conv.ToBool ) }}
         CURLOPT_PROXYPORT => {{ getenv "FRESHRSS_CURLOPT_PROXYPORT" }},
         {{- end }}
-        {{- if not (bool (getenv "FRESHRSS_CURLOPT_PROXYAUTH" "true" )) }}
+        {{- if not (getenv "FRESHRSS_CURLOPT_PROXYAUTH" "true" | conv.ToBool ) }}
         CURLOPT_PROXYAUTH => {{ getenv "FRESHRSS_CURLOPT_PROXYAUTH" }},
         {{- end }}
-        {{- if not (bool (getenv "FRESHRSS_CURLOPT_PROXYUSERPWD" "true" )) }}
+        {{- if not (getenv "FRESHRSS_CURLOPT_PROXYUSERPWD" "true" | conv.ToBool ) }}
         CURLOPT_PROXYUSERPWD => '{{ getenv "FRESHRSS_CURLOPT_PROXYUSERPWD" }}',
         {{- end }}
     ),
@@ -55,6 +55,7 @@ return array(
     'db' => array(
         'type' => '{{ getenv "FRESHRSS_DB_TYPE" "sqlite" }}',
         'host' => '{{ getenv "FRESHRSS_DB_HOST" "localhost" }}',
+        'port' => '{{ getenv "FRESHRSS_DB_PORT" }}',
         'user' => '{{ getenv "FRESHRSS_DB_USER" }}',
         'password' => '{{ getenv "FRESHRSS_DB_PASSWORD" }}',
         'base' => '{{ getenv "FRESHRSS_DB_BASE" }}',
@@ -70,4 +71,10 @@ return array(
     ),
 
     'disable_update' => true,
+
+    'trusted_sources' => [
+        {{- range (getenv "FRESHRSS_TRUSTED_SOURCES" "127.0.0.0/8,::1/128" | strings.Split ",") }}
+        '{{ . | strings.TrimSpace }}',
+        {{- end }}
+    ]
 );

overlay/etc/templates/constants.local.php.tmpl

@@ -1,15 +1,15 @@
 <?php
-safe_define('FRESHRSS_USERAGENT', 'FreshRSS/' . FRESHRSS_VERSION . ' (' . PHP_OS . '; ' . FRESHRSS_WEBSITE . ')');
-safe_define('PHP_COMPRESSION', false);
-safe_define('COPY_SYSLOG_TO_STDERR', true);
-safe_define('MAX_LOG_SIZE', 1048576);
-safe_define('DATA_PATH', FRESHRSS_PATH . '/data');
+define('FRESHRSS_USERAGENT', 'FreshRSS/' . FRESHRSS_VERSION . ' (' . PHP_OS . '; ' . FRESHRSS_WEBSITE . ')');
+define('PHP_COMPRESSION', false);
+define('COPY_SYSLOG_TO_STDERR', true);
+define('MAX_LOG_SIZE', 1048576);
+define('DATA_PATH', FRESHRSS_PATH . '/data');
 
-safe_define('UPDATE_FILENAME', DATA_PATH . '/update.php');
-safe_define('USERS_PATH', DATA_PATH . '/users');
-safe_define('ADMIN_LOG', USERS_PATH . '/_/log.txt');
-safe_define('API_LOG', USERS_PATH . '/_/log_api.txt');
-safe_define('CACHE_PATH', DATA_PATH . '/cache');
-safe_define('PSHB_LOG', USERS_PATH . '/_/log_pshb.txt');
-safe_define('PSHB_PATH', DATA_PATH . '/PubSubHubbub');
-safe_define('TMP_PATH', CACHE_PATH);
+define('UPDATE_FILENAME', DATA_PATH . '/update.php');
+define('USERS_PATH', DATA_PATH . '/users');
+define('ADMIN_LOG', USERS_PATH . '/_/log.txt');
+define('API_LOG', USERS_PATH . '/_/log_api.txt');
+define('CACHE_PATH', DATA_PATH . '/cache');
+define('PSHB_LOG', USERS_PATH . '/_/log_pshb.txt');
+define('PSHB_PATH', DATA_PATH . '/PubSubHubbub');
+define('TMP_PATH', CACHE_PATH);

overlay/etc/templates/php.ini.tmpl

@@ -19,9 +19,9 @@ implicit_flush = Off
 unserialize_callback_func =
 serialize_precision = 17
 
-open_basedir = "/var/www/app:/var/lib/php/tmp_upload:/var/lib/php/session:/var/lib/php/soap_cache"
+open_basedir = "/var/www/app:/var/lib/php/tmp_upload:/var/lib/php/session:/var/lib/php/soap_cache:/tmp"
 
-disable_functions = system, exec, shell_exec, phpinfo, show_source, highlight_file, popen, proc_open, fopen_with_path, dbmopen, dbase_open, move_uploaded_file, chmod, rename, filepro, filepro_rowcount, filepro_retrieve, posix_mkfifo
+disable_functions = system, exec, shell_exec, phpinfo, show_source, highlight_file, popen, proc_open, fopen_with_path, dbmopen, dbase_open, move_uploaded_file, chmod, filepro, filepro_rowcount, filepro_retrieve, posix_mkfifo
 disable_classes =
 
 ;highlight.string  = #DD0000
@@ -86,12 +86,12 @@ default_charset = "UTF-8"
 ;input_encoding =
 ;output_encoding =
 
-;include_path = ".:/php7/includes"
+;include_path = ".:/php81/includes"
 
 doc_root =
 user_dir =
 
-extension_dir = "/usr/lib/php7/modules"
+extension_dir = "/usr/lib/php81/modules"
 ;sys_temp_dir = "/tmp"
 enable_dl = Off
 
@@ -106,7 +106,7 @@ cgi.discard_path = 1
 ;cgi.rfc2616_headers = 0
 ;cgi.check_shebang_line = 1
 
-file_uploads = {{ getenv "PHP_FILE_UPLOADS" "Off" }}
+file_uploads = {{ getenv "PHP_FILE_UPLOADS" "On" }}
 upload_tmp_dir = /var/lib/php/tmp_upload
 upload_max_filesize = {{ getenv "PHP_UPLOAD_MAX_FILESIZE" "2M" }}
 max_file_uploads = {{ getenv "PHP_MAX_FILE_UPLOADS" "2" }}
@@ -250,7 +250,7 @@ pgsql.log_notice = 0
 bcmath.scale = 0
 
 [browscap]
-browscap = /etc/php7/browscap.ini
+browscap = /etc/php81/browscap.ini
 
 [Session]
 session.save_handler = files
@@ -327,7 +327,7 @@ zend.assertions = -1
 ;exif.decode_jis_intel = JIS
 
 [Tidy]
-;tidy.default_config = /usr/local/lib/php7/default.tcfg
+;tidy.default_config = /usr/local/lib/php81/default.tcfg
 tidy.clean_output = Off
 
 [soap]

overlay/usr/local/bin/entrypoint

@@ -0,0 +1,61 @@
+#!/usr/bin/env sh
+
+# shellcheck disable=SC1091
+. /usr/local/lib/log.sh
+
+/usr/local/bin/gomplate -o /etc/php81/php.ini -f /etc/templates/php.ini.tmpl
+/usr/local/bin/gomplate -o /var/www/app/constants.local.php -f /etc/templates/constants.local.php.tmpl
+
+if [ -n "${FRESHRSS_POSTGRES_SSL_ROOTCERT}" ] && [ ! -f "/var/www/.postgresql/root.crt" ]; then
+    ln -s "${FRESHRSS_POSTGRES_SSL_ROOTCERT}" /var/www/.postgresql/root.crt
+fi
+
+log_info "Prepare FreshRSS"
+/usr/bin/php -f ./cli/prepare.php >/dev/null 2>&1
+
+ERROR=$(/usr/bin/php -f ./cli/do-install.php -- --api_enabled \
+    --base_url "${FRESHRSS_BASE_URL:-http://localhost/}" \
+    --db-base "${FRESHRSS_DB_BASE}" \
+    --db-host "${FRESHRSS_DB_HOST:-localhost}" \
+    --db-password "${FRESHRSS_DB_PASSWORD}" \
+    --db-type "${FRESHRSS_DB_TYPE:-sqlite}" \
+    --db-user "${FRESHRSS_DB_USER}" \
+    --default_user "${FRESHRSS_DEFAULT_USER:-admin}" \
+    --language "${FRESHRSS_LANGUAGE:-en}" \
+    2>&1)
+EXITCODE=$?
+
+if [ $EXITCODE -eq 3 ]; then
+    log_info "FreshRSS already installed, skipped"
+elif [ $EXITCODE -eq 0 ]; then
+    log_info "FreshRSS successfully installed"
+else
+    log_error "FreshRSS error during installation: ${ERROR}"
+    exit $EXITCODE
+fi
+
+log_info "Ensure default user exists"
+ERROR=$(/usr/bin/php ./cli/create-user.php \
+    --user "${FRESHRSS_DEFAULT_USER:-admin}" \
+    --password "${FRESHRSS_DEFAULT_PASSWORD:-freshrss}" \
+    --language "${FRESHRSS_LANGUAGE:-en}" \
+    2>&1)
+EXITCODE=$?
+
+if [ $EXITCODE -eq 3 ]; then
+    log_info "FreshRSS user already exists, skipped"
+elif [ $EXITCODE -eq 0 ]; then
+    log_info "FreshRSS user successfully created"
+    ./cli/list-users.php | xargs -n1 ./cli/actualize-user.php --user "${FRESHRSS_DEFAULT_USER:-admin}"
+    ./cli/access-permissions.sh
+else
+    log_error "FreshRSS error during the creation of a user: ${ERROR}"
+    exit $EXITCODE
+fi
+
+/usr/local/bin/gomplate -o /var/www/app/data/config.php -f /etc/templates/config.php.tmpl
+
+log_info "Start FreshRSS Server\n"
+supercronic /etc/crontabs/nginx &
+php-fpm81 -F &
+exec nginx -g "daemon off;"

overlay/usr/local/bin/entrypoint.sh

@@ -1,15 +0,0 @@
-#!/bin/sh
-/usr/local/bin/gomplate -V -o /etc/php7/php.ini -f /etc/templates/php.ini.tmpl
-/usr/local/bin/gomplate -V -o /var/www/app/data/config.php -f /etc/templates/config.php.tmpl
-/usr/local/bin/gomplate -V -o /var/www/app/constants.local.php -f /etc/templates/constants.local.php.tmpl
-
-/usr/bin/php -f ./cli/prepare.php >/dev/null 2>&1
-
-if [ "${FRESHRSS_DEFAULT_USER}" ]; then
-    /usr/bin/php ./cli/create-user.php --user "$FRESHRSS_DEFAULT_USER" --password "$FRESHRSS_DEFAULT_PASSWORD" >/dev/null 2>&1
-    /usr/bin/php ./cli/do-install.php --default_user "$FRESHRSS_DEFAULT_USER" >/dev/null 2>&1
-fi
-
-exec supercronic -split-logs /etc/crontabs/nginx 1> /dev/null &
-exec php-fpm7 -F &
-exec nginx -g "daemon off;"

overlay/usr/local/bin/healthcheck

@@ -0,0 +1,12 @@
+#!/usr/bin/env sh
+
+# shellcheck disable=SC3040
+set -eo pipefail
+
+if [ "$(gomplate -i '{{ getenv "FRESHRSS_API_ENABLED" "false" | conv.ToBool }}')" = "true" ]; then
+    (php -r "readfile('http://127.0.0.1:8080/api/fever.php');" | grep -q 'api_version') || exit 1
+else
+    (php -r "readfile('http://127.0.0.1:8080/i/');" | grep -q 'jsonVars') || exit 1
+fi
+
+exit 0

overlay/usr/local/bin/healthcheck.sh

@@ -1,3 +0,0 @@
-#!/bin/sh
-
-(php -r "readfile('http://localhost:8080/i/');" | grep -q 'jsonVars') || exit 1

renovate.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["github>thegeeklab/renovate-presets:docker"]
+}