freshrss-app/apache/freshrss.conf

# https://github.com/FreshRSS/FreshRSS/blob/edge/Docker/FreshRSS.Apache.conf

ServerName %{HTTP_HOST}

<VirtualHost *:8000>
    DocumentRoot /app/code/p
    AllowEncodedSlashes On

    LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxy
    CustomLog "|/bin/cat" proxy
    ErrorLog "|/bin/cat"

    <Directory /app/code/p/>
        Options +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    <Directory /app/code/p/api>
        Include /app/code/p/api/.htaccess
    </Directory>

    <Directory /app/code/p/i>
        ExpiresActive Off

        <IfDefine OIDC_ENABLED>
            AuthType openid-connect
            Require valid-user
        </IfDefine>
        IncludeOptional /app/code/p/i/.htaccess
    </Directory>

    <Directory /app/code/p/themes>
        Include /app/code/p/themes/.htaccess
    </Directory>


    <IfDefine OIDC_ENABLED>

        # CLOUDRON_OIDC_PROVIDER_NAME is not supported

        OIDCProviderMetadataURL ${CLOUDRON_OIDC_DISCOVERY_URL}
        OIDCClientID ${CLOUDRON_OIDC_CLIENT_ID}
        OIDCClientSecret ${CLOUDRON_OIDC_CLIENT_SECRET}

        OIDCRedirectURI /i/oidc/

        OIDCCryptoPassphrase ${OIDC_CRYPTO_PASSPHRASE}

        OIDCRemoteUserClaim sub

        OIDCScope "openid profile email"

        OIDCRefreshAccessTokenBeforeExpiry 30
        OIDCPassClaimsAs headers
        OIDCXForwardedHeaders X-Forwarded-Proto
    </IfDefine>
</VirtualHost>