Navigating the Web with FreshRSS as your News

Remember when the internet was a vast, uncharted territory? Back in the days where everything was scattered and decentralized. Logging on meant embarking on an exciting quest. Maybe you’d play a game, discover an unheard-of site, or browse a random news group. There was no guiding hand, no curated path, well I remember it, I was part of many forums back then, used ICQ and MSN Messenger to talk to random strangers with similar interests on other parts of the world, it all was uncharted..

Leap into the current digital age, and you’ll find Google at your fingertips for any query, Chromium browsers guiding your way and trying to DRM the web, and social media serving as a multifaceted tool for almost everything. The giant corporations are battling it out at every turn trying to beat each other on whom can get the most telemetry and who has the best AI which can suck out all knowledge from you and that everything seems like a battleground for political discourse. The web of today is swamped with intrusive advertisements, hidden paywalls, and slyly integrated sponsorships within the content.

FreshRSS is one of the ways I take back a little control: I choose the sources, read them in one place, and use FiveFilters when a feed contains only an excerpt.

FreshRSS and FiveFilters in One Compose Project

Originally I ran each service with a separate Docker command. For full articles I used FiveFilters as a middleman; it fetches the page and scoops out the article. It is not always perfect, but we use what we get :)

The two old commands both published host port 80. In the combined setup FiveFilters is only needed by FreshRSS, so it has no host port. The shared backend network still has ordinary outbound access because FiveFilters needs to fetch articles.

The official FreshRSS image has versioned releases; this example pins the release I reviewed. The FiveFilters Docker project intentionally rebuilds latest weekly and does not publish normal version tags, so I pin that image by digest in .env rather than pretending latest is immutable. FreshRSS releases and FiveFilters image documentation

docker buildx imagetools inspect heussd/fivefilters-full-text-rss:latest
# Copy the reviewed linux/amd64 or linux/arm64 digest into .env:
FIVEFILTERS_IMAGE=heussd/fivefilters-full-text-rss@sha256:REPLACE_WITH_REVIEWED_DIGEST

compose.yaml:

services:
  freshrss:
    image: freshrss/freshrss:1.29.1
    restart: unless-stopped
    environment:
      TZ: Europe/Stockholm
      CRON_MIN: "3,33"
    volumes:
      - ./freshrss-data:/var/www/FreshRSS/data
      - ./freshrss-extensions:/var/www/FreshRSS/extensions
    networks:
      - rss-internal
      - proxy
    labels:
      traefik.enable: "true"
      traefik.docker.network: proxy
      traefik.http.routers.freshrss.rule: Host(`freshrss.example.com`)
      traefik.http.routers.freshrss.entrypoints: websecure
      traefik.http.routers.freshrss.tls: "true"
      traefik.http.routers.freshrss.middlewares: freshrss-auth
      traefik.http.middlewares.freshrss-auth.forwardauth.address: http://authelia:9091/api/authz/forward-auth
      traefik.http.middlewares.freshrss-auth.forwardauth.trustForwardHeader: "true"
      traefik.http.middlewares.freshrss-auth.forwardauth.authResponseHeaders: Remote-User,Remote-Groups,Remote-Name,Remote-Email
      traefik.http.services.freshrss.loadbalancer.server.port: "80"
    depends_on:
      - fivefilters

  fivefilters:
    image: ${FIVEFILTERS_IMAGE:?set FIVEFILTERS_IMAGE to a reviewed digest}
    restart: unless-stopped
    environment:
      FTR_ADMIN_PASSWORD: ""
    volumes:
      - ./fivefilters-cache:/var/www/html/cache/rss
    networks:
      - rss-internal

networks:
  rss-internal:
  proxy:
    external: true

I no longer set PUID/PGID blindly: those variables belonged to the LinuxServer image and were not shared assumptions for the official FreshRSS and FiveFilters images. I create the bind directories with ownership appropriate to the chosen image, then verify with:

docker compose config
docker compose up -d
docker compose ps
docker compose exec freshrss curl -fsS http://fivefilters/

Within the Docker network, FiveFilters is available as http://fivefilters/. With no published port and no Traefik labels it is not exposed through the host or proxy, but it can still make outbound requests.

The Traefik labels use its documented forwardAuth middleware and assume an existing Authelia service on the external proxy network. This replaces my undeclared GitHub OAuth plugin. Authelia can also provide OIDC directly to applications that support it. Traefik ForwardAuth and Authelia Traefik integration

The internet has come a long way from the unstructured days of the good old days to the ad-infested landscape of today. But a good sense is to grab back what little you can :)