Connecting an Existing FreshRSS instance to OIDC

Fri, 15 Aug 2025 21:05:44 -0400

Connecting an existing FreshRSS instance to OIDC

Specifically, how to do so without starting over.

WARNING: I am not responsible for you losing data by doing this. Make sure you have a recent backup before you go digging around and changing things in the filesystem.

Overview

It came to my attention yesterday that the FreshRSS project directly supports OIDC now.

I’ve been using the Traefik ForwardAuth middleware to get the same functionality for some time, but this allows me to get rid of a layer.

It was also slightly clunky, since after I’d logged in through Authentik, I’d have to also authenticate via FreshRSS. I’m aware I could have simply disabled authentication, but I chose not to at the time.

I had been using the LinuxServer.io Docker container, but this functionality depended on Apache’s OIDC module, so it was unsupported. (The LinuxServer.io container uses nginx instead of Apache.)

OIDC Setup

The first thing I needed to do was switch to the official container on DockerHub.

The volume layout was a bit different from the LinuxServer container, so I had to stop the container and move some files around.

All you should need to do is move the data and extensions folders out from under the config directory that the LSIO container uses, and make them their own separate bind mounts.

Next, I set about configuring OIDC.

I followed their official instructions to set up OIDC with Authentik.

This was mostly fine, though I had to make a few tweaks to their environment variables. The OIDC_SCOPES variable in particular was my issue - it would not work if I had it in quotes. I can only assume that this was being interpreted as a single string by the application.

Here’s what my Docker Compose file wound up looking like at the end. The OIDC values have been replaced with gibberish, make sure to substitute your own if you copy and paste.

Note

2025/08/21 - After posting this I began noticing that my feeds were no longer auto-updating. As it turns out, the FreshRSS official Docker image disabled this feature by default unless you pass it the CRON_MIN environment variable. I have updated the Docker Compose file below with a setting that works.

services:
  freshrss:
    container_name: freshrss
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
      - CRON_MIN=2,32
      - TRUSTED_PROXY=172.23.0.0/16
      - OIDC_ENABLED=1
      - OIDC_PROVIDER_METADATA_URL="https://auth.example.com/application/o/fresh-rss-oidc/.well-known/openid-configuration"
      - OIDC_REMOTE_USER_CLAIM=preferred_username
      - OIDC_CLIENT_ID=1234455262233
      - OIDC_CLIENT_SECRET=7dfadkfjakldgjad7897324
      - OIDC_CLIENT_CRYPTO_KEY=dfajfakjglkdg70708723434
      - OIDC_SCOPES=openid email profile
      - OIDC_X_FORWARDED_HEADERS=X-Forwarded-Host X-Forwarded-Port X-Forwarded-Proto
    volumes:
      - ./data:/var/www/FreshRSS/data
      - ./extensions:/var/www/FreshRSS/extensions
    restart: unless-stopped
    image: "freshrss/freshrss:latest"
    labels:
      - traefik.enable=true
      - traefik.http.routers.freshrss-external.rule=Host(`rss.example.com`)
      - traefik.http.routers.freshrss-external.entrypoints=https
      - traefik.http.routers.freshrss-external.middlewares=default-headers@file
      - traefik.http.routers.freshrss-external.tls=true
      - traefik.http.routers.freshrss-external.service=freshrss-external
      - traefik.http.services.freshrss-external.loadbalancer.server.port=80
    networks:
      - proxy

networks:
  proxy:
    external: true

I’m not 100% certain that the TRUSTED_PROXY setting is necessary. The subnet there is the subnet used by my proxy docker network. It works and I’m too lazy to try removing it.

You can get this subnet by running docker network inspect <network-name>

> docker-ubuntu in ~/docker/freshrss/data
docker network inspect proxy
docker network inspect proxy
[
    {
        "Name": "proxy",
        "Id": "4b6ea83029c955c6f7609af4552ed053760aadbb6de5c72f8390d3cfa96023b1",
        "Created": "2022-09-24T02:01:57.289063399Z",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "172.23.0.0/16", <-------- This
                    "Gateway": "172.23.0.1"
                }
            ]
        },

<snip>

Not losing data

Onto the meat and potatoes.

In order to not log into a completely fresh profile with no articles and none of your settings - your user ID in FreshRSS needs to match that of your identity provider.

Mine did not, so I had to do a little detective work.

I stopped the container with a docker compose down and started poking about in the filesystem, trying to figure out how I could change my username.

As it turns out, it’s quite simple - each user has their own directory under data/users/, and each user has their own individual sqlite database. I poked around in the database a little, but there didn’t seem to be any indication of who owned each entry it stored in its tables.

This led me to believe that maybe FreshRSS was just reading the directory structure to find its list of users.

docker-ubuntu in ~/docker/freshrss/data
> tree users
users
├── MyUsername
│   ├── config.php
│   ├── db.sqlite
│   └── log.txt
├── _
│   ├── db.sqlite
│   ├── index.html
│   ├── log.txt
│   ├── log_api.txt
│   └── log_pshb.txt
└── index.html

2 directories, 10 files

So as an experiment, I simply renamed the user folder under data/users to match the one from my identity provider and started FreshRSS back up. Imagine my surprise when that simply worked.

I was logged in automatically with Authentik SSO, and I had all of my feeds, saved articles and settings.

Configuring Apache for OIDC with an Authentik backend

Wed, 26 Feb 2025 20:06:16 -0500

Summary

For the past year and half I’ve been running my own mailserver using Postfix and Dovecot.

This setup works quite well, and I’ve also installed Roundcube to have a convenient web frontend. It’s nice to have, though most of the time I interact with the mailserver via apps like Thunderbird or FairEmail.

While Roundcube is quite nice, I don’t necessarily trust the authentication mechanism to be exposed directly to the internet.

Since I set this up, I put Apache basic authentication in front of it as a deterrent. However, the issue with basic auth is that it requires you to log in again every single time you restart your browser.

So, I decided on a more robust solution. I’ve already been running Authentik for some of the other services in my lab that support OIDC, so I decided to tie back into that system, which will give me nice single sign on features.

Configuring Apache

Here’s how you can set this up for yourself.

First, install the Apache module that adds OIDC support:

sudo apt install mod_auth_openidc

Enable the module:

sudo a2enmod auth_openidc

Here’s an example Apache virtual host with working OIDC support:

<VirtualHost *:443>
ServerAdmin webmaster@localhost
ServerName mail.example.net

OIDCProviderMetadataURL "https://auth.example.net/application/o/roundcube-webmail/.well-known/openid-configuration"
OIDCClientID redacted
OIDCClientSecret redacted
OIDCRedirectURI "https://mail.example.net/roundcube"
OIDCCacheType file
OIDCCacheDir /var/cache/mod_auth_openidc
OIDCCryptoPassphrase redacted

<Location /roundcube>
AuthType openid-connect
Require valid-user
</Location>

<Location />
AuthType openid-connect
Require valid-user
</Location>

# Handle the case if someone hits the root location and redirect them to /roundcube 
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/$
RewriteCond %{HTTP_REFERER} !auth.example.net [NC]
RewriteRule ^/$ /roundcube/ [R=302,L]

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

SSLEngine on
SSLCertificateFile      /etc/letsencrypt/live/mail.example.net/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/mail.example.net/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/mail.example.net/fullchain.pem
</VirtualHost>

Once you have this set up, restart apache:

sudo systemctl restart apache2

On systems other than Ubuntu the service may be called httpd rather than apache2.

OIDC configuration options

OIDCClientId, OIDCProviderMetadataURL and OIDCClientSecret can both be found in your Authentik provider configuration.

OIDCCryptoPassphrase is only used internally. You can generate any random string for this, I’d recommend at least 64 characters.

Don’t forget that you also need to set the redirect URI in the provider settings!

Oidc on Sysadmin Tales