fix: add /tmp to open_basedir as its required for exports

chore(docker): update thegeeklab/nginx:latest docker digest to 72ffd57
chore(docker): update thegeeklab/nginx:latest docker digest to 35d0f3c
2023-10-31 10:55:34 +01:00 · 2023-10-18 17:32:57 +00:00 · 2023-10-17 15:33:00 +00:00 · 2023-09-28 23:33:55 +00:00 · 2023-08-17 15:04:08 +00:00 · 2023-08-07 22:33:34 +00:00
20 changed files with 360 additions and 383 deletions
--- a/.chglog/CHANGELOG.tpl.md
+++ b/.chglog/CHANGELOG.tpl.md
@ -0,0 +1,23 @@
 # Changelog
 {{ range .Versions -}}
 ## {{ if .Tag.Previous }}[{{ .Tag.Name }}]({{ $.Info.RepositoryURL }}/compare/{{ .Tag.Previous.Name }}...{{ .Tag.Name }}){{ else }}{{ .Tag.Name }}{{ end }} ({{ datetime "2006-01-02" .Tag.Date }})
 {{ range .CommitGroups -}}
 ### {{ .Title }}
 {{ range .Commits -}}
 - {{ if .Scope }}**{{ .Scope }}:** {{ end }}{{ (regexReplaceAll "(.*)/issues/(.*)" (regexReplaceAll "(Co-\\w*-by.*)" .Subject "") "${1}/pulls/${2}") | trim }}
 {{ end }}
 {{- end -}}
 {{- if .NoteGroups -}}
 {{ range .NoteGroups -}}
 ### {{ .Title }}
 {{ range .Notes }}
 {{ .Body }}
 {{ end }}
 {{ end -}}
 {{ end -}}
 {{ end -}}
--- a/.chglog/config.yml
+++ b/.chglog/config.yml
@ -0,0 +1,25 @@
 style: github
 template: CHANGELOG.tpl.md
 info:
  title: CHANGELOG
  repository_url: https://gitea.rknet.org/docker/freshrss
 options:
  commit_groups:
    title_maps:
      feat: Features
      fix: Bug Fixes
      perf: Performance Improvements
      refactor: Code Refactoring
      chore: Others
      test: Testing
      ci: CI Pipeline
      docs: Documentation
  header:
    pattern: "^(\\w*)(?:\\(([\\w\\$\\.\\-\\*\\s]*)\\))?\\:\\s(.*)$"
    pattern_maps:
      - Type
      - Scope
      - Subject
  notes:
    keywords:
      - BREAKING CHANGE
--- a/.drone.jsonnet
+++ b/.drone.jsonnet
@ -1,148 +0,0 @@
 local PipelineBuild(arch='amd64') = {
  kind: 'pipeline',
  name: 'build-' + arch,
  platform: {
    os: 'linux',
    arch: arch,
  },
  steps: [
    {
      name: 'dryrun',
      image: 'plugins/docker',
      settings: {
        dry_run: true,
        dockerfile: 'Dockerfile',
        repo: 'xoxys/${DRONE_REPO_NAME}',
        username: { from_secret: 'docker_username' },
        password: { from_secret: 'docker_password' },
        build_args: [
          'BUILD_VERSION=${DRONE_TAG%-*}',
        ],
      },
      when: {
        ref: [
          'refs/pull/**',
        ],
      },
    },
    {
      name: 'publish',
      image: 'plugins/docker',
      settings: {
        auto_tag: true,
        auto_tag_suffix: arch,
        dockerfile: 'Dockerfile',
        repo: 'xoxys/${DRONE_REPO_NAME}',
        username: { from_secret: 'docker_username' },
        password: { from_secret: 'docker_password' },
        build_args: [
          'BUILD_VERSION=${DRONE_TAG%-*}',
        ],
      },
      when: {
        ref: [
          'refs/heads/master',
          'refs/tags/**',
        ],
      },
    },
    {
      name: 'publish-gitea',
      image: 'plugins/gitea-release',
      settings: {
        api_key: { from_secret: 'gitea_token' },
        base_url: 'https://gitea.rknet.org',
        overwrite: true,
        title: '${DRONE_TAG}',
        note: 'CHANGELOG.md',
      },
      when: {
        ref: ['refs/tags/**'],
      },
    },
  ],
 };
 local PipelineNotifications(depends_on=[]) = {
  kind: 'pipeline',
  name: 'notifications',
  platform: {
    os: 'linux',
    arch: 'amd64',
  },
  steps: [
    {
      image: 'plugins/manifest',
      name: 'manifest',
      settings: {
        ignore_missing: true,
        tags: [
          '${DRONE_TAG}',
          '${DRONE_TAG%-*}',
          '${DRONE_TAG%.*}',
          '${DRONE_TAG%%.*}',
        ],
        username: { from_secret: 'docker_username' },
        password: { from_secret: 'docker_password' },
        spec: 'manifest.tmpl',
      },
      when: {
        status: [
          'success',
        ],
      },
    },
    {
      name: 'readme',
      image: 'sheogorath/readme-to-dockerhub',
      environment: {
        DOCKERHUB_USERNAME: { from_secret: 'docker_username' },
        DOCKERHUB_PASSWORD: { from_secret: 'docker_password' },
        DOCKERHUB_REPO_PREFIX: 'xoxys',
        DOCKERHUB_REPO_NAME: '${DRONE_REPO_NAME}',
        README_PATH: 'README.md',
        SHORT_DESCRIPTION: 'Rootless FreshRSS - Self-hosted RSS feed aggregator',
      },
      when: {
        status: [
          'success',
        ],
      },
    },
    {
      name: 'matrix',
      image: 'plugins/matrix',
      settings: {
        homeserver: { from_secret: 'matrix_homeserver' },
        roomid: { from_secret: 'matrix_roomid' },
        template: 'Status: **{{ build.status }}**<br/> Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.link }}) ({{ build.branch }}) by {{ build.author }}<br/> Message: {{ build.message }}',
        username: { from_secret: 'matrix_username' },
        password: { from_secret: 'matrix_password' },
      },
      when: {
        status: [
          'success',
          'failure',
        ],
      },
    },
  ],
  trigger: {
    ref: [
      'refs/heads/master',
      'refs/tags/**',
    ],
    status: [
      'success',
      'failure',
    ],
  },
  depends_on: depends_on,
 };
 [
  PipelineBuild(arch='amd64'),
  PipelineNotifications(depends_on=[
    'build-amd64',
  ]),
 ]
--- a/.drone.yml
+++ b/.drone.yml
@ -1,59 +1,133 @@
 ---
 kind: pipeline
-name: build-amd64
+name: test
 platform:
  os: linux
  arch: amd64
 steps:
- name: dryrun
+  - name: markdownlint
-  image: plugins/docker
+    image: thegeeklab/markdownlint-cli
-  settings:
+    commands:
-    build_args:
+      - markdownlint 'README.md'
-    - BUILD_VERSION=${DRONE_TAG%-*}
+
-    dockerfile: Dockerfile
+trigger:
-    dry_run: true
+  ref:
-    password:
+    - refs/heads/main
      from_secret: docker_password
    repo: xoxys/${DRONE_REPO_NAME}
    username:
      from_secret: docker_username
  when:
    ref:
    - refs/pull/**
 - name: publish
  image: plugins/docker
  settings:
    auto_tag: true
    auto_tag_suffix: amd64
    build_args:
    - BUILD_VERSION=${DRONE_TAG%-*}
    dockerfile: Dockerfile
    password:
      from_secret: docker_password
    repo: xoxys/${DRONE_REPO_NAME}
    username:
      from_secret: docker_username
  when:
    ref:
    - refs/heads/master
    - refs/tags/**
- name: publish-gitea
+---
-  image: plugins/gitea-release
+kind: pipeline
-  settings:
+name: build-container
-    api_key:
+
-      from_secret: gitea_token
+platform:
-    base_url: https://gitea.rknet.org
+  os: linux
-    note: CHANGELOG.md
+  arch: amd64
-    overwrite: true
+
-    title: ${DRONE_TAG}
+steps:
-  when:
+  - name: dryrun
-    ref:
+    image: thegeeklab/drone-docker-buildx:23
    settings:
      dockerfile: Dockerfile
      dry_run: true
      provenance: false
      repo: thegeeklab/${DRONE_REPO_NAME}
    when:
      ref:
        - refs/pull/**
  - name: tags
    image: thegeeklab/docker-autotag
    environment:
      DOCKER_AUTOTAG_FORCE_LATEST: True
      DOCKER_AUTOTAG_IGNORE_PRERELEASE: True
      DOCKER_AUTOTAG_OUTPUT_FILE: .tags
      DOCKER_AUTOTAG_VERSION: ${DRONE_TAG}
    when:
      ref:
        - refs/heads/main
        - refs/tags/**
    depends_on:
      - dryrun
  - name: changelog-generate
    image: thegeeklab/git-chglog
    commands:
      - git fetch -tq
      - git-chglog --no-color --no-emoji -o CHANGELOG.md ${DRONE_TAG:---next-tag unreleased unreleased}
    depends_on:
      - tags
  - name: changelog-format
    image: thegeeklab/alpine-tools
    commands:
      - prettier CHANGELOG.md
      - prettier -w CHANGELOG.md
    depends_on:
      - changelog-generate
  - name: publish-dockerhub
    image: thegeeklab/drone-docker-buildx:23
    settings:
      dockerfile: Dockerfile
      password:
        from_secret: docker_password
      provenance: false
      repo: thegeeklab/${DRONE_REPO_NAME}
      username:
        from_secret: docker_username
    when:
      ref:
        - refs/heads/main
        - refs/tags/**
    depends_on:
      - changelog-format
  - name: publish-quay
    image: thegeeklab/drone-docker-buildx:23
    settings:
      dockerfile: Dockerfile
      password:
        from_secret: quay_password
      provenance: false
      registry: quay.io
      repo: quay.io/thegeeklab/${DRONE_REPO_NAME}
      username:
        from_secret: quay_username
    when:
      ref:
        - refs/heads/main
        - refs/tags/**
    depends_on:
      - changelog-format
  - name: publish-gitea
    image: plugins/gitea-release
    settings:
      api_key:
        from_secret: gitea_token
      base_url: https://gitea.rknet.org
      note: CHANGELOG.md
      overwrite: true
      title: ${DRONE_TAG}
    when:
      ref:
        - refs/tags/**
    depends_on:
      - publish-dockerhub
      - publish-quay
 trigger:
  ref:
    - refs/heads/main
    - refs/pull/**
    - refs/tags/**
 depends_on:
  - test
 ---
 kind: pipeline
 name: notifications
@ -63,69 +137,63 @@ platform:
  arch: amd64
 steps:
- name: manifest
+  - name: pushrm-dockerhub
-  image: plugins/manifest
+    pull: always
-  settings:
+    image: chko/docker-pushrm:1
-    ignore_missing: true
+    environment:
-    password:
+      DOCKER_PASS:
-      from_secret: docker_password
+        from_secret: docker_password
-    spec: manifest.tmpl
+      DOCKER_USER:
-    tags:
+        from_secret: docker_username
-    - ${DRONE_TAG}
+      PUSHRM_FILE: README.md
-    - ${DRONE_TAG%-*}
+      PUSHRM_SHORT: Custom image for FreshRSS feed aggregator
-    - ${DRONE_TAG%.*}
+      PUSHRM_TARGET: thegeeklab/${DRONE_REPO_NAME}
-    - ${DRONE_TAG%%.*}
+    when:
-    username:
+      status:
-      from_secret: docker_username
+        - success
  when:
    status:
    - success
- name: readme
+  - name: pushrm-quay
-  image: sheogorath/readme-to-dockerhub
+    pull: always
-  environment:
+    image: chko/docker-pushrm:1
-    DOCKERHUB_PASSWORD:
+    environment:
-      from_secret: docker_password
+      APIKEY__QUAY_IO:
-    DOCKERHUB_REPO_NAME: ${DRONE_REPO_NAME}
+        from_secret: quay_token
-    DOCKERHUB_REPO_PREFIX: xoxys
+      PUSHRM_FILE: README.md
-    DOCKERHUB_USERNAME:
+      PUSHRM_TARGET: quay.io/thegeeklab/${DRONE_REPO_NAME}
-      from_secret: docker_username
+    when:
-    README_PATH: README.md
+      status:
-    SHORT_DESCRIPTION: Rootless FreshRSS - Self-hosted RSS feed aggregator
+        - success
  when:
    status:
    - success
- name: matrix
+  - name: matrix
-  image: plugins/matrix
+    image: thegeeklab/drone-matrix
-  settings:
+    settings:
-    homeserver:
+      homeserver:
-      from_secret: matrix_homeserver
+        from_secret: matrix_homeserver
-    password:
+      password:
-      from_secret: matrix_password
+        from_secret: matrix_password
-    roomid:
+      roomid:
-      from_secret: matrix_roomid
+        from_secret: matrix_roomid
-    template: "Status: **{{ build.status }}**<br/> Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.link }}) ({{ build.branch }}) by {{ build.author }}<br/> Message: {{ build.message }}"
+      template: "Status: **{{ .Build.Status }}**<br/> Build: [{{ .Repo.Owner }}/{{ .Repo.Name }}]({{ .Build.Link }}){{ if .Build.Branch }} ({{ .Build.Branch }}){{ end }} by {{ .Commit.Author }}<br/> Message: {{ .Commit.Message.Title }}"
-    username:
+      username:
-      from_secret: matrix_username
+        from_secret: matrix_username
-  when:
+    when:
-    status:
+      status:
-    - success
+        - success
-    - failure
+        - failure
 trigger:
  ref:
-  - refs/heads/master
+    - refs/heads/main
-  - refs/tags/**
+    - refs/tags/**
  status:
-  - success
+    - success
-  - failure
+    - failure
 depends_on:
- build-amd64
+  - build-container
 ---
 kind: signature
-hmac: ef7295f9a2cf94dc557898ef6fb2f9d02dc4fe2aca57da40a0dbe08168c2b0ee
+hmac: cba07850e21c648f8558e69aa7e5a561ef473fe2a3a7890bf308a57c73ea0343
 ...
--- a/.gitignore
+++ b/.gitignore
@ -1 +1,2 @@
 test/
 CHANGELOG.md
--- a/.markdownlint.yml
+++ b/.markdownlint.yml
@ -0,0 +1,6 @@
 ---
 default: True
 MD013: False
 MD041: False
 MD004:
  style: dash
--- a/.prettierignore
+++ b/.prettierignore
@ -0,0 +1,3 @@
 .drone.yml
 *.tpl.md
 LICENSE
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -1,3 +0,0 @@
 * ENHANCEMENT
  * base nginx image updated to alpine 3.11
  * update to upstream version 1.16.0
--- a/36
+++ b/36
@ -1,30 +1,33 @@
-FROM xoxys/nginx:latest
+FROM thegeeklab/nginx:latest@sha256:72ffd57b6b89013f6b4c6a8a97728120df1dfac0d66b2164e0aacba21ee87380
-LABEL maintainer="Robert Kaussow <mail@geeklabor.de>" \
+LABEL maintainer="Robert Kaussow <mail@thegeeklab.de>"
-    org.label-schema.name="FreshRSS" \
+LABEL org.opencontainers.image.authors="Robert Kaussow <mail@thegeeklab.de>"
-    org.label-schema.vcs-url="https://gitea.rknet.org/docker/freshrss" \
+LABEL org.opencontainers.image.title="FreshRSS"
-    org.label-schema.vendor="Robert Kaussow" \
+LABEL org.opencontainers.image.url="https://gitea.rknet.org/docker/freshrss"
-    org.label-schema.schema-version="1.0"
+LABEL org.opencontainers.image.source="https://gitea.rknet.org/docker/freshrss"
 LABEL org.opencontainers.image.documentation="https://gitea.rknet.org/docker/freshrss"
-ARG BUILD_VERSION=master
+ARG BUILD_VERSION
-ENV FRESHRSS_VERSION="${BUILD_VERSION:-master}"
+
 # renovate: datasource=github-releases depName=FreshRSS/FreshRSS
 ENV FRESHRSS_VERSION="${BUILD_VERSION:-1.21.0}"
 ADD overlay/ /
 RUN apk --update add --virtual .build-deps tar curl && \
-    apk --update add php7 php7-curl php7-fpm php7-gmp php7-intl php7-mbstring php7-xml \
+    apk --update add php81 php81-curl php81-fpm php81-gmp php81-intl php81-mbstring php81-xml \
-    php7-zip php7-ctype php7-dom php7-fileinfo php7-iconv php7-json php7-session \
+      php81-zip php81-ctype php81-dom php81-fileinfo php81-iconv php81-json php81-opcache php81-phar \
-    php7-simplexml php7-xmlreader php7-zlib php7-pdo_sqlite php7-pdo_mysql\
+      php81-session php81-simplexml php81-xmlreader php81-xmlwriter php81-tokenizer php81-zlib \
-    php7-pdo_pgsql && \
+      php81-openssl php81-pdo_sqlite php81-pdo_mysql php81-pdo_pgsql && \
    rm -rf /var/www/localhost && \
-    rm -f /etc/php7/php-fpm.d/www.conf && \
+    rm -f /etc/php81/php-fpm.d/www.conf && \
    mkdir -p /var/www/app && \
    mkdir /var/www/.postgresql && \
    FRESHRSS_VERSION="${FRESHRSS_VERSION##v}" && \
    echo "Installing FreshRSS version '${FRESHRSS_VERSION}' ..." && \
-    curl -SsL "https://github.com/FreshRSS/FreshRSS/archive/${FRESHRSS_VERSION}.tar.gz" | \
+    curl -SsfL "https://github.com/FreshRSS/FreshRSS/archive/${FRESHRSS_VERSION}.tar.gz" | \
      tar xz -C /var/www/app/ -X /.tarignore --strip-components=1 && \
-    curl -SsL -o /etc/php7/browscap.ini https://browscap.org/stream?q=Lite_PHP_BrowsCapINI && \
+    curl -SsfL -o /etc/php81/browscap.ini https://browscap.org/stream?q=Lite_PHP_BrowsCapINI && \
    apk del .build-deps && \
    rm -rf /var/cache/apk/* && \
    rm -rf /tmp/* && \
@ -34,7 +37,7 @@ RUN apk --update add --virtual .build-deps tar curl && \
    mkdir -p /var/lib/php/soap_cache && \
    mkdir -p /var/lib/php/session && \
    chown -R nginx /var/lib/php && \
-    chown nginx /etc/php7/php.ini && \
+    chown nginx /etc/php81/php.ini && \
    chown -R nginx:nginx /var/www/.postgresql && \
    chown -R nginx:nginx /var/www/app
@ -48,6 +51,5 @@ USER nginx
 STOPSIGNAL SIGTERM
 ENTRYPOINT ["/usr/local/bin/entrypoint"]
 HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD /usr/local/bin/healthcheck
 WORKDIR /var/www/app
 CMD []
--- a/2
+++ b/2
@ -1,6 +1,6 @@
 MIT License
-Copyright (c) 2020 Robert Kaussow <mail@geeklabor.de>
+Copyright (c) 2022 Robert Kaussow <mail@thegeeklab.de>
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
--- a/README.md
+++ b/README.md
@ -1,10 +1,14 @@
-# [freshrss](https://gitea.rknet.org/docker/freshrss)
+# freshrss
 Custom image for FreshRSS feed aggregator
 [![Build Status](https://img.shields.io/drone/build/docker/freshrss?logo=drone&server=https%3A%2F%2Fdrone.rknet.org)](https://drone.rknet.org/docker/freshrss)
-[![Docker Hub](https://img.shields.io/badge/docker-latest-blue.svg?logo=docker&logoColor=white)](https://hub.docker.com/r/xoxys/freshrss)
+[![Docker Hub](https://img.shields.io/badge/dockerhub-latest-blue.svg?logo=docker&logoColor=white)](https://hub.docker.com/r/thegeeklab/freshrss)
-[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://gitea.rknet.org/docker/freshrss/src/branch/master/LICENSE)
+[![Quay.io](https://img.shields.io/badge/quay-latest-blue.svg?logo=docker&logoColor=white)](https://quay.io/repository/thegeeklab/freshrss)
 [![Source: Gitea](https://img.shields.io/badge/source-gitea-blue.svg?logo=gitea&logoColor=white)](https://gitea.rknet.org/docker/freshrss)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://gitea.rknet.org/docker/freshrss/src/branch/main/LICENSE)
-FreshRSS is a self-hosted RSS feed aggregator. It is lightweight, easy to work with, powerful, and customizable.
+Custom rootless Docker image for FreshRSS, a self-hosted RSS feed aggregator. It is lightweight, easy to work with, powerful, and customizable.
 ## Usage
@ -18,42 +22,16 @@ Here are some example snippets to help you get started creating a container. Thi
 docker create \
  --name=freshrss \
  -p 80:8080 \
-  xoxys/freshrss
+  thegeeklab/freshrss
 ```
 ### Docker Compose
-Compatible with docker-compose v2 schemas.
+Please take a look at the [example](https://gitea.rknet.org/docker/freshrss/src/branch/main/docker-compose.yml) compose file from the git repo.
 ```Yaml
 ---
 version: '2.1'
 services:
  freshrss:
    container_name: freshrss
    image: xoxys/freshrss:latest
    ports:
      - "80:8080"
    volumes:
      - freshrss_data:/var/www/app/data
      - freshrss_extensions:/var/www/app/extensions
    environment:
      FRESHRSS_DEFAULT_USER: admin
      FRESHRSS_DEFAULT_PASSWORD: freshrss
      FRESHRSS_API_ENABLED: "true"
      FRESHRSS_SALT: "38fd29ac5878c270bbfc3599723cd479d48c6c58"
 volumes:
  freshrss_data:
    driver: local
  freshrss_extensions:
    driver: local
 ```
 ## Environment variables
-### freshrss
+### FreshRSS
 > **WARNING**: Don't change any system settings through the web UI! These changes will be overwritten at EVERY container startup. Use the provided environment variables instead.
@ -70,7 +48,6 @@ FRESHRSS_BASE_URL="http://localhost/"
 FRESHRSS_LANGUAGE="en"
 FRESHRSS_TITLE="FreshRSS"
 FRESHRSS_META_DESCRIPTION=
 FRESHRSS_DEFAULT_USER="_"
 FRESHRSS_ALLOW_ANONYMOUS="false"
 FRESHRSS_ALLOW_ANONYMOUS_REFRESH="false"
 FRESHRSS_AUTH_TYPE="form"
@ -102,6 +79,8 @@ FRESHRSS_DB_BASE=
 FRESHRSS_DB_PREFIX="freshrss_"
 ## comma-seperated string, extensions must be installed!
 FRESHRSS_EXTENSIONS_ENABLED="Tumblr-GDPR"
 ## comma-seperated string
 FRESHRSS_TRUSTED_SOURCES=127.0.0.0/8,::1/128
 ```
 ### PHP
@ -133,8 +112,4 @@ PHP_SQL_SAFE_MODE=On
 ## License
-This project is licensed under the MIT License - see the [LICENSE](https://gitea.rknet.org/docker/freshrss/src/branch/master/LICENSE) file for details.
+This project is licensed under the MIT License - see the [LICENSE](https://gitea.rknet.org/docker/freshrss/src/branch/main/LICENSE) file for details.
 ## Maintainers and Contributors
 [Robert Kaussow](https://gitea.rknet.org/xoxys)
--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -1,10 +1,10 @@
 ---
-version: '2.1'
+version: "3"
 services:
  freshrss:
    container_name: freshrss
-    image: xoxys/freshrss:latest
+    image: thegeeklab/freshrss
    ports:
      - "80:8080"
    volumes:
--- a/manifest.tmpl
+++ b/manifest.tmpl
@ -1,15 +0,0 @@
 image: xoxys/freshrss:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}latest{{/if}}
 {{#if build.tags}}
 tags:
 {{#each build.tags}}
  {{#if this}}
  - {{trimPrefix "v" this}}
  - {{trimPrefix "v" this}}-amd64
  {{/if}}
 {{/each}}
 {{/if}}
 manifests:
  - image: xoxys/freshrss:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}amd64
    platform:
      architecture: amd64
      os: linux
--- a/overlay/etc/php81/php-fpm.conf
+++ b/overlay/etc/php81/php-fpm.conf
--- a/overlay/etc/templates/config.php.tmpl
+++ b/overlay/etc/templates/config.php.tmpl
@ -7,16 +7,16 @@ return array(
    'language' => '{{ getenv "FRESHRSS_LANGUAGE" "en" }}',
    'title' => '{{ getenv "FRESHRSS_TITLE" "FreshRSS" }}',
    'meta_description' => '{{ getenv "FRESHRSS_META_DESCRIPTION" }}',
-    'default_user' => '{{ getenv "FRESHRSS_DEFAULT_USER" "_" }}',
+    'default_user' => '{{ getenv "FRESHRSS_DEFAULT_USER" "admin" }}',
-    'allow_anonymous' => {{ getenv "FRESHRSS_ALLOW_ANONYMOUS" "false" }},
+    'allow_anonymous' => {{ getenv "FRESHRSS_ALLOW_ANONYMOUS" "false" | conv.ToBool }},
-    'allow_anonymous_refresh' => {{ getenv "FRESHRSS_ALLOW_ANONYMOUS_REFRESH" "false" }},
+    'allow_anonymous_refresh' => {{ getenv "FRESHRSS_ALLOW_ANONYMOUS_REFRESH" "false" | conv.ToBool }},
    'auth_type' => '{{ getenv "FRESHRSS_AUTH_TYPE" "form" }}',
-    'api_enabled' => {{ getenv "FRESHRSS_API_ENABLED" "false" }},
+    'api_enabled' => {{ getenv "FRESHRSS_API_ENABLED" "false" | conv.ToBool }},
-    'unsafe_autologin_enabled' => {{ getenv "FRESHRSS_UNSAFE_AUTOLOGIN_ENABLED" "false" }},
+    'unsafe_autologin_enabled' => {{ getenv "FRESHRSS_UNSAFE_AUTOLOGIN_ENABLED" "false" | conv.ToBool }},
-    'simplepie_syslog_enabled' => {{ getenv "FRESHRSS_SIMPLEPIE_SYSLOG_ENABLED" "true" }},
+    'simplepie_syslog_enabled' => {{ getenv "FRESHRSS_SIMPLEPIE_SYSLOG_ENABLED" "true" | conv.ToBool }},
-    'pubsubhubbub_enabled' => {{ getenv "FRESHRSS_PUBSUBHUBBUB_ENABLED" "false" }},
+    'pubsubhubbub_enabled' => {{ getenv "FRESHRSS_PUBSUBHUBBUB_ENABLED" "false" | conv.ToBool }},
-    'allow_robots' => {{ getenv "FRESHRSS_ALLOW_ROBOTS" "false" }},
+    'allow_robots' => {{ getenv "FRESHRSS_ALLOW_ROBOTS" "false" | conv.ToBool }},
-    'allow_referrer' => {{ getenv "FRESHRSS_ALLOW_REFERRER" "false" }},
+    'allow_referrer' => {{ getenv "FRESHRSS_ALLOW_REFERRER" "false" | conv.ToBool }},
    'limits' => array(
        'cookie_duration' => {{ getenv "FRESHRSS_LIMITS_COOKIE_DURATION" "2592000" }},
@ -29,25 +29,25 @@ return array(
    ),
    'curl_options' => array(
-        {{- if not (bool (getenv "FRESHRSS_CURLOPT_SSL_VERIFYHOST" "true")) }}
+        {{- if not (getenv "FRESHRSS_CURLOPT_SSL_VERIFYHOST" "true" | conv.ToBool) }}
        CURLOPT_SSL_VERIFYHOST => {{ getenv "FRESHRSS_CURLOPT_SSL_VERIFYHOST" }},
        {{- end }}
-        {{- if not (bool (getenv "FRESHRSS_CURLOPT_SSL_VERIFYPEER" "true")) }}
+        {{- if not (getenv "FRESHRSS_CURLOPT_SSL_VERIFYPEER" "true" | conv.ToBool) }}
        CURLOPT_SSL_VERIFYPEER => {{ getenv "FRESHRSS_CURLOPT_SSL_VERIFYPEER" }},
        {{- end }}
-        {{- if not (bool (getenv "FRESHRSS_CURLOPT_PROXYTYPE" "true")) }}
+        {{- if not (getenv "FRESHRSS_CURLOPT_PROXYTYPE" "true" | conv.ToBool) }}
        CURLOPT_PROXYTYPE => {{ getenv "FRESHRSS_CURLOPT_PROXYTYPE" }},
        {{- end }}
-        {{- if not (bool (getenv "FRESHRSS_CURLOPT_PROXY" "true" )) }}
+        {{- if not (getenv "FRESHRSS_CURLOPT_PROXY" "true" | conv.ToBool ) }}
        CURLOPT_PROXY => '{{ getenv "FRESHRSS_CURLOPT_PROXY" }}',
        {{- end }}
-        {{- if not (bool (getenv "FRESHRSS_CURLOPT_PROXYPORT" "true" )) }}
+        {{- if not (getenv "FRESHRSS_CURLOPT_PROXYPORT" "true" | conv.ToBool ) }}
        CURLOPT_PROXYPORT => {{ getenv "FRESHRSS_CURLOPT_PROXYPORT" }},
        {{- end }}
-        {{- if not (bool (getenv "FRESHRSS_CURLOPT_PROXYAUTH" "true" )) }}
+        {{- if not (getenv "FRESHRSS_CURLOPT_PROXYAUTH" "true" | conv.ToBool ) }}
        CURLOPT_PROXYAUTH => {{ getenv "FRESHRSS_CURLOPT_PROXYAUTH" }},
        {{- end }}
-        {{- if not (bool (getenv "FRESHRSS_CURLOPT_PROXYUSERPWD" "true" )) }}
+        {{- if not (getenv "FRESHRSS_CURLOPT_PROXYUSERPWD" "true" | conv.ToBool ) }}
        CURLOPT_PROXYUSERPWD => '{{ getenv "FRESHRSS_CURLOPT_PROXYUSERPWD" }}',
        {{- end }}
    ),
@ -71,4 +71,10 @@ return array(
    ),
    'disable_update' => true,
    'trusted_sources' => [
        {{- range (getenv "FRESHRSS_TRUSTED_SOURCES" "127.0.0.0/8,::1/128" | strings.Split ",") }}
        '{{ . | strings.TrimSpace }}',
        {{- end }}
    ]
 );
--- a/overlay/etc/templates/constants.local.php.tmpl
+++ b/overlay/etc/templates/constants.local.php.tmpl
@ -1,15 +1,15 @@
 <?php
-safe_define('FRESHRSS_USERAGENT', 'FreshRSS/' . FRESHRSS_VERSION . ' (' . PHP_OS . '; ' . FRESHRSS_WEBSITE . ')');
+define('FRESHRSS_USERAGENT', 'FreshRSS/' . FRESHRSS_VERSION . ' (' . PHP_OS . '; ' . FRESHRSS_WEBSITE . ')');
-safe_define('PHP_COMPRESSION', false);
+define('PHP_COMPRESSION', false);
-safe_define('COPY_SYSLOG_TO_STDERR', true);
+define('COPY_SYSLOG_TO_STDERR', true);
-safe_define('MAX_LOG_SIZE', 1048576);
+define('MAX_LOG_SIZE', 1048576);
-safe_define('DATA_PATH', FRESHRSS_PATH . '/data');
+define('DATA_PATH', FRESHRSS_PATH . '/data');
-safe_define('UPDATE_FILENAME', DATA_PATH . '/update.php');
+define('UPDATE_FILENAME', DATA_PATH . '/update.php');
-safe_define('USERS_PATH', DATA_PATH . '/users');
+define('USERS_PATH', DATA_PATH . '/users');
-safe_define('ADMIN_LOG', USERS_PATH . '/_/log.txt');
+define('ADMIN_LOG', USERS_PATH . '/_/log.txt');
-safe_define('API_LOG', USERS_PATH . '/_/log_api.txt');
+define('API_LOG', USERS_PATH . '/_/log_api.txt');
-safe_define('CACHE_PATH', DATA_PATH . '/cache');
+define('CACHE_PATH', DATA_PATH . '/cache');
-safe_define('PSHB_LOG', USERS_PATH . '/_/log_pshb.txt');
+define('PSHB_LOG', USERS_PATH . '/_/log_pshb.txt');
-safe_define('PSHB_PATH', DATA_PATH . '/PubSubHubbub');
+define('PSHB_PATH', DATA_PATH . '/PubSubHubbub');
-safe_define('TMP_PATH', CACHE_PATH);
+define('TMP_PATH', CACHE_PATH);
--- a/overlay/etc/templates/php.ini.tmpl
+++ b/overlay/etc/templates/php.ini.tmpl
@ -19,9 +19,9 @@ implicit_flush = Off
 unserialize_callback_func =
 serialize_precision = 17
-open_basedir = "/var/www/app:/var/lib/php/tmp_upload:/var/lib/php/session:/var/lib/php/soap_cache"
+open_basedir = "/var/www/app:/var/lib/php/tmp_upload:/var/lib/php/session:/var/lib/php/soap_cache:/tmp"
-disable_functions = system, exec, shell_exec, phpinfo, show_source, highlight_file, popen, proc_open, fopen_with_path, dbmopen, dbase_open, move_uploaded_file, chmod, rename, filepro, filepro_rowcount, filepro_retrieve, posix_mkfifo
+disable_functions = system, exec, shell_exec, phpinfo, show_source, highlight_file, popen, proc_open, fopen_with_path, dbmopen, dbase_open, move_uploaded_file, chmod, filepro, filepro_rowcount, filepro_retrieve, posix_mkfifo
 disable_classes =
 ;highlight.string  = #DD0000
@ -86,12 +86,12 @@ default_charset = "UTF-8"
 ;input_encoding =
 ;output_encoding =
-;include_path = ".:/php7/includes"
+;include_path = ".:/php81/includes"
 doc_root =
 user_dir =
-extension_dir = "/usr/lib/php7/modules"
+extension_dir = "/usr/lib/php81/modules"
 ;sys_temp_dir = "/tmp"
 enable_dl = Off
@ -250,7 +250,7 @@ pgsql.log_notice = 0
 bcmath.scale = 0
 [browscap]
-browscap = /etc/php7/browscap.ini
+browscap = /etc/php81/browscap.ini
 [Session]
 session.save_handler = files
@ -327,7 +327,7 @@ zend.assertions = -1
 ;exif.decode_jis_intel = JIS
 [Tidy]
-;tidy.default_config = /usr/local/lib/php7/default.tcfg
+;tidy.default_config = /usr/local/lib/php81/default.tcfg
 tidy.clean_output = Off
 [soap]
--- a/overlay/usr/local/bin/entrypoint
+++ b/overlay/usr/local/bin/entrypoint
@ -1,40 +1,61 @@
 #!/usr/bin/env sh
-/usr/local/bin/gomplate -V -o /etc/php7/php.ini -f /etc/templates/php.ini.tmpl
+# shellcheck disable=SC1091
-/usr/local/bin/gomplate -V -o /var/www/app/data/config.php -f /etc/templates/config.php.tmpl
+. /usr/local/lib/log.sh
-/usr/local/bin/gomplate -V -o /var/www/app/constants.local.php -f /etc/templates/constants.local.php.tmpl
+
 /usr/local/bin/gomplate -o /etc/php81/php.ini -f /etc/templates/php.ini.tmpl
 /usr/local/bin/gomplate -o /var/www/app/constants.local.php -f /etc/templates/constants.local.php.tmpl
 if [ -n "${FRESHRSS_POSTGRES_SSL_ROOTCERT}" ] && [ ! -f "/var/www/.postgresql/root.crt" ]; then
    ln -s "${FRESHRSS_POSTGRES_SSL_ROOTCERT}" /var/www/.postgresql/root.crt
 fi
-printf "\nPrepare FreshRSS...\n"
+log_info "Prepare FreshRSS"
-PREP=$(/usr/bin/php -f ./cli/prepare.php)
+/usr/bin/php -f ./cli/prepare.php >/dev/null 2>&1
-if [ $? -ne 0 ]; then
+
-    echo "$PREP"
+ERROR=$(/usr/bin/php -f ./cli/do-install.php -- --api_enabled \
-    exit 1
+    --base_url "${FRESHRSS_BASE_URL:-http://localhost/}" \
    --db-base "${FRESHRSS_DB_BASE}" \
    --db-host "${FRESHRSS_DB_HOST:-localhost}" \
    --db-password "${FRESHRSS_DB_PASSWORD}" \
    --db-type "${FRESHRSS_DB_TYPE:-sqlite}" \
    --db-user "${FRESHRSS_DB_USER}" \
    --default_user "${FRESHRSS_DEFAULT_USER:-admin}" \
    --language "${FRESHRSS_LANGUAGE:-en}" \
    2>&1)
 EXITCODE=$?
 if [ $EXITCODE -eq 3 ]; then
    log_info "FreshRSS already installed, skipped"
 elif [ $EXITCODE -eq 0 ]; then
    log_info "FreshRSS successfully installed"
 else
    log_error "FreshRSS error during installation: ${ERROR}"
    exit $EXITCODE
 fi
-if [ "${FRESHRSS_DEFAULT_USER}" ]; then
+log_info "Ensure default user exists"
-    printf "\nEnsure default user exists...\n"
+ERROR=$(/usr/bin/php ./cli/create-user.php \
-    UCREATE=$(/usr/bin/php ./cli/create-user.php --user "$FRESHRSS_DEFAULT_USER" --password "$FRESHRSS_DEFAULT_PASSWORD" 2>&1)
+    --user "${FRESHRSS_DEFAULT_USER:-admin}" \
-    if [ $? -ne 0 ]; then
+    --password "${FRESHRSS_DEFAULT_PASSWORD:-freshrss}" \
-        case "$UCREATE" in
+    --language "${FRESHRSS_LANGUAGE:-en}" \
-          *"username already taken"*) ;;
+    2>&1)
-          *)
+EXITCODE=$?
-          echo "$UCREATE"
+
-          rm -rf "/var/www/app/data/users/$FRESHRSS_DEFAULT_USER"
+if [ $EXITCODE -eq 3 ]; then
-          exit 1
+    log_info "FreshRSS user already exists, skipped"
-          ;;
+elif [ $EXITCODE -eq 0 ]; then
-        esac
+    log_info "FreshRSS user successfully created"
-    fi
+    ./cli/list-users.php | xargs -n1 ./cli/actualize-user.php --user "${FRESHRSS_DEFAULT_USER:-admin}"
-    printf "Result: success\n\n"
+    ./cli/access-permissions.sh
 else
    log_error "FreshRSS error during the creation of a user: ${ERROR}"
    exit $EXITCODE
 fi
-if [ -f "/var/www/app/data/do-install.txt" ]; then
+/usr/local/bin/gomplate -o /var/www/app/data/config.php -f /etc/templates/config.php.tmpl
    rm -rf /var/www/app/data/do-install.txt
 fi
 log_info "Start FreshRSS Server\n"
 supercronic /etc/crontabs/nginx &
-php-fpm7 -F &
+php-fpm81 -F &
 exec nginx -g "daemon off;"
--- a/overlay/usr/local/bin/healthcheck
+++ b/overlay/usr/local/bin/healthcheck
@ -1,3 +1,12 @@
 #!/usr/bin/env sh
-(php -r "readfile('http://localhost:8080/i/');" | grep -q 'jsonVars') || exit 1
+# shellcheck disable=SC3040
 set -eo pipefail
 if [ "$(gomplate -i '{{ getenv "FRESHRSS_API_ENABLED" "false" | conv.ToBool }}')" = "true" ]; then
    (php -r "readfile('http://127.0.0.1:8080/api/fever.php');" | grep -q 'api_version') || exit 1
 else
    (php -r "readfile('http://127.0.0.1:8080/i/');" | grep -q 'jsonVars') || exit 1
 fi
 exit 0
--- a/renovate.json
+++ b/renovate.json
@ -0,0 +1,4 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["github>thegeeklab/renovate-presets:docker"]
 }