fix: add /tmp to open_basedir as its required for exports

Reviewed-on: docker/freshrss#106

.drone.yml

@@ -28,12 +28,11 @@ platform:
 
 steps:
   - name: dryrun
-    image: thegeeklab/drone-docker-buildx:20
+    image: thegeeklab/drone-docker-buildx:23
     settings:
-      build_args:
-        - BUILD_VERSION=${DRONE_TAG%-*}
       dockerfile: Dockerfile
       dry_run: true
+      provenance: false
       repo: thegeeklab/${DRONE_REPO_NAME}
     when:
       ref:
@@ -70,13 +69,12 @@ steps:
       - changelog-generate
 
   - name: publish-dockerhub
-    image: thegeeklab/drone-docker-buildx:20
+    image: thegeeklab/drone-docker-buildx:23
     settings:
-      build_args:
-        - BUILD_VERSION=${DRONE_TAG%-*}
       dockerfile: Dockerfile
       password:
         from_secret: docker_password
+      provenance: false
       repo: thegeeklab/${DRONE_REPO_NAME}
       username:
         from_secret: docker_username
@@ -88,13 +86,12 @@ steps:
       - changelog-format
 
   - name: publish-quay
-    image: thegeeklab/drone-docker-buildx:20
+    image: thegeeklab/drone-docker-buildx:23
     settings:
-      build_args:
-        - BUILD_VERSION=${DRONE_TAG%-*}
       dockerfile: Dockerfile
       password:
         from_secret: quay_password
+      provenance: false
       registry: quay.io
       repo: quay.io/thegeeklab/${DRONE_REPO_NAME}
       username:
@@ -176,7 +173,7 @@ steps:
         from_secret: matrix_password
       roomid:
         from_secret: matrix_roomid
-      template: "Status: **{{ build.Status }}**<br/> Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.Link }}){{#if build.Branch}} ({{ build.Branch }}){{/if}} by {{ commit.Author }}<br/> Message: {{ commit.Message.Title }}"
+      template: "Status: **{{ .Build.Status }}**<br/> Build: [{{ .Repo.Owner }}/{{ .Repo.Name }}]({{ .Build.Link }}){{ if .Build.Branch }} ({{ .Build.Branch }}){{ end }} by {{ .Commit.Author }}<br/> Message: {{ .Commit.Message.Title }}"
       username:
         from_secret: matrix_username
     when:
@@ -197,6 +194,6 @@ depends_on:
 
 ---
 kind: signature
-hmac: 07c057dfd06b861ee2213ff0f86e517c52aea018985cd84d90c69c7d21483116
+hmac: cba07850e21c648f8558e69aa7e5a561ef473fe2a3a7890bf308a57c73ea0343
 
 ...

Dockerfile

@@ -1,4 +1,4 @@
-FROM thegeeklab/nginx:latest@sha256:1b4a55c078486ffab6b8bb96def236b47f07574f5966cedcf9ce68de0d529fe8
+FROM thegeeklab/nginx:latest@sha256:72ffd57b6b89013f6b4c6a8a97728120df1dfac0d66b2164e0aacba21ee87380
 
 LABEL maintainer="Robert Kaussow <mail@thegeeklab.de>"
 LABEL org.opencontainers.image.authors="Robert Kaussow <mail@thegeeklab.de>"
@@ -10,7 +10,7 @@ LABEL org.opencontainers.image.documentation="https://gitea.rknet.org/docker/fre
 ARG BUILD_VERSION
 
 # renovate: datasource=github-releases depName=FreshRSS/FreshRSS
-ENV FRESHRSS_VERSION="${BUILD_VERSION:-1.20.2}"
+ENV FRESHRSS_VERSION="${BUILD_VERSION:-1.21.0}"
 
 ADD overlay/ /
 

overlay/etc/templates/config.php.tmpl

@@ -8,15 +8,15 @@ return array(
     'title' => '{{ getenv "FRESHRSS_TITLE" "FreshRSS" }}',
     'meta_description' => '{{ getenv "FRESHRSS_META_DESCRIPTION" }}',
     'default_user' => '{{ getenv "FRESHRSS_DEFAULT_USER" "admin" }}',
-    'allow_anonymous' => {{ getenv "FRESHRSS_ALLOW_ANONYMOUS" "false" }},
-    'allow_anonymous_refresh' => {{ getenv "FRESHRSS_ALLOW_ANONYMOUS_REFRESH" "false" }},
+    'allow_anonymous' => {{ getenv "FRESHRSS_ALLOW_ANONYMOUS" "false" | conv.ToBool }},
+    'allow_anonymous_refresh' => {{ getenv "FRESHRSS_ALLOW_ANONYMOUS_REFRESH" "false" | conv.ToBool }},
     'auth_type' => '{{ getenv "FRESHRSS_AUTH_TYPE" "form" }}',
-    'api_enabled' => {{ getenv "FRESHRSS_API_ENABLED" "false" }},
-    'unsafe_autologin_enabled' => {{ getenv "FRESHRSS_UNSAFE_AUTOLOGIN_ENABLED" "false" }},
-    'simplepie_syslog_enabled' => {{ getenv "FRESHRSS_SIMPLEPIE_SYSLOG_ENABLED" "true" }},
-    'pubsubhubbub_enabled' => {{ getenv "FRESHRSS_PUBSUBHUBBUB_ENABLED" "false" }},
-    'allow_robots' => {{ getenv "FRESHRSS_ALLOW_ROBOTS" "false" }},
-    'allow_referrer' => {{ getenv "FRESHRSS_ALLOW_REFERRER" "false" }},
+    'api_enabled' => {{ getenv "FRESHRSS_API_ENABLED" "false" | conv.ToBool }},
+    'unsafe_autologin_enabled' => {{ getenv "FRESHRSS_UNSAFE_AUTOLOGIN_ENABLED" "false" | conv.ToBool }},
+    'simplepie_syslog_enabled' => {{ getenv "FRESHRSS_SIMPLEPIE_SYSLOG_ENABLED" "true" | conv.ToBool }},
+    'pubsubhubbub_enabled' => {{ getenv "FRESHRSS_PUBSUBHUBBUB_ENABLED" "false" | conv.ToBool }},
+    'allow_robots' => {{ getenv "FRESHRSS_ALLOW_ROBOTS" "false" | conv.ToBool }},
+    'allow_referrer' => {{ getenv "FRESHRSS_ALLOW_REFERRER" "false" | conv.ToBool }},
 
     'limits' => array(
         'cookie_duration' => {{ getenv "FRESHRSS_LIMITS_COOKIE_DURATION" "2592000" }},

overlay/etc/templates/php.ini.tmpl

@@ -19,7 +19,7 @@ implicit_flush = Off
 unserialize_callback_func =
 serialize_precision = 17
 
-open_basedir = "/var/www/app:/var/lib/php/tmp_upload:/var/lib/php/session:/var/lib/php/soap_cache"
+open_basedir = "/var/www/app:/var/lib/php/tmp_upload:/var/lib/php/session:/var/lib/php/soap_cache:/tmp"
 
 disable_functions = system, exec, shell_exec, phpinfo, show_source, highlight_file, popen, proc_open, fopen_with_path, dbmopen, dbase_open, move_uploaded_file, chmod, filepro, filepro_rowcount, filepro_retrieve, posix_mkfifo
 disable_classes =

overlay/usr/local/bin/entrypoint

@@ -47,6 +47,7 @@ if [ $EXITCODE -eq 3 ]; then
 elif [ $EXITCODE -eq 0 ]; then
     log_info "FreshRSS user successfully created"
     ./cli/list-users.php | xargs -n1 ./cli/actualize-user.php --user "${FRESHRSS_DEFAULT_USER:-admin}"
+    ./cli/access-permissions.sh
 else
     log_error "FreshRSS error during the creation of a user: ${ERROR}"
     exit $EXITCODE

overlay/usr/local/bin/healthcheck

@@ -1,3 +1,12 @@
 #!/usr/bin/env sh
 
-(php -r "readfile('http://127.0.0.1:8080/i/');" | grep -q 'jsonVars') || exit 1
+# shellcheck disable=SC3040
+set -eo pipefail
+
+if [ "$(gomplate -i '{{ getenv "FRESHRSS_API_ENABLED" "false" | conv.ToBool }}')" = "true" ]; then
+    (php -r "readfile('http://127.0.0.1:8080/api/fever.php');" | grep -q 'api_version') || exit 1
+else
+    (php -r "readfile('http://127.0.0.1:8080/i/');" | grep -q 'jsonVars') || exit 1
+fi
+
+exit 0