FreshRSS on Google Cloud Run

FreshRSS is a free, self-hosted, GPL-3.0-licensed RSS and Atom feed aggregator — a lightweight, multi-user "news reader" written in PHP that runs behind Apache and exposes the Google Reader and Fever APIs for mobile clients. This module deploys FreshRSS on Cloud Run v2 on top of the App_CloudRun foundation, which provisions and manages the shared Google Cloud infrastructure.

This guide focuses on the cloud services FreshRSS uses and how to explore and operate them from the Google Cloud Console and the command line. For the mechanics common to every Cloud Run application — service identity, ingress and load balancing, scaling and concurrency, CI/CD, Cloud Armor, IAP, Binary Authorization, VPC Service Controls, backups, and the deployment lifecycle — refer to the App_CloudRun foundation guide rather than repeating them here.

1. Overview

FreshRSS runs as a PHP/Apache container on Cloud Run v2. The deployment wires together a focused set of Google Cloud services:

Capability	Google Cloud service	Notes
Compute	Cloud Run v2	PHP/Apache service on port 80, 1 vCPU / 2 GiB by default, serverless autoscaling; scale-to-zero enabled
Database	Cloud SQL for PostgreSQL 15	Required — the entrypoint installs with `--db-type pgsql`
Persistent storage	NFS (Filestore / self-managed)	Mounted at `/var/www/FreshRSS/data`; holds config, per-user state, feed cache. No GCS bucket
Cache	Redis (optional)	Off by default; FreshRSS does not require it
Secrets	Secret Manager	Auto-generated `FRESHRSS_ADMIN_PASSWORD`; database password
Ingress	Cloud Run URL / Cloud Load Balancing	Default `run.app` URL; optional external HTTPS load balancer + custom domain

Sensible defaults worth knowing up front:

PostgreSQL 15 is the supported engine. The container entrypoint hardcodes --db-type pgsql and the db-init job is Postgres-only; the schema is created by FreshRSS's own installer on first boot.
NFS is enabled by default (enable_nfs = true) and mounted at /var/www/FreshRSS/data. FreshRSS writes its generated config (data/config.php), per-user state, cached articles, and favicons there — without a persistent volume this state is lost on every cold start or redeploy.
FRESHRSS_ADMIN_PASSWORD is generated automatically and stored in Secret Manager. It seeds the default admin account (and its API password for mobile clients) on first install.
Scale-to-zero is enabled by default (min_instance_count = 0, max_instance_count = 1). Cold starts add a few seconds of latency to the first request after idle.
Feed refresh runs as an in-container cron (CRON_MIN = */15). While the service is scaled to zero, that cron does not fire — see the pitfalls table.
max_instance_count = 1. A single instance owns the in-container refresh cron and the file-based session/cache state; running more than one without care duplicates feed refreshes.
The container listens on port 80 (Apache), not 8080.
BASE_URL is set from the predicted service URL at plan time and corrected at runtime from CLOUDRUN_SERVICE_URL, so FreshRSS's self-referencing links and the / → setup redirect resolve on the real Cloud Run host.

2. Google Cloud Services & How to Explore Them

All commands assume PROJECT and REGION are set. Service and resource names are reported in the deployment Outputs.

A. Cloud Run — the FreshRSS service

FreshRSS runs as a Cloud Run v2 service that autoscales by request load between the minimum and maximum instance counts. Each deployment creates an immutable revision; traffic can be split across revisions for safe rollouts.

Console: Cloud Run → select the service for revisions, traffic, logs, and metrics.

CLI:

gcloud run services list --project "$PROJECT" --region "$REGION" \
  --filter="metadata.name~freshrss"
gcloud run services describe <service-name> --project "$PROJECT" --region "$REGION"
gcloud run revisions list --service <service-name> --project "$PROJECT" --region "$REGION"

See App_CloudRun for scaling, concurrency, execution environment, and traffic splitting.

B. Cloud SQL for PostgreSQL 15

FreshRSS stores all application data (feeds, subscriptions, articles, categories, users) in a managed Cloud SQL for PostgreSQL 15 instance. The service connects privately through the Cloud SQL Auth Proxy over a Unix socket; no public IP is exposed. On first deploy the db-init Job creates the application database and user, and FreshRSS's own installer creates the schema.

Console: SQL → select the instance for connections, backups, flags, metrics.

CLI:

gcloud sql instances list --project "$PROJECT"
gcloud sql instances describe <instance-name> --project "$PROJECT"
gcloud sql connect <instance-name> --user=<db-user> --database=<db-name> --project "$PROJECT"

The instance name, database, user, and password secret are in the Outputs. See App_CloudRun for the connection model, backups, and password rotation.

C. Persistent storage (NFS)

FreshRSS's data directory (/var/www/FreshRSS/data) is backed by an NFS volume (enable_nfs = true), which holds the generated config, per-user state, cached articles, and favicons. This module declares no GCS bucket — feed content is kept in PostgreSQL and the NFS data dir.

Console: Filestore → Instances (managed NFS), or Compute Engine → VM instances (self-managed NFS server).

CLI:

gcloud filestore instances list --project "$PROJECT"
# Confirm the mount inside the running revision:
gcloud run services describe <service-name> --region "$REGION" \
  --format='value(spec.template.spec.volumes)'

See App_CloudRun for the NFS server model and GCS Fuse options.

D. Redis (optional cache)

Redis is disabled by default (enable_redis = false) and FreshRSS does not require it. It is exposed as a forwarded option for parity with sibling PHP modules; leave it off unless you have a specific reason to enable it.

Console: Memorystore → Redis (if using a managed instance).
CLI:
```
redis-cli -h <redis-host> ping
```

E. Secret Manager

One application secret is generated automatically: FRESHRSS_ADMIN_PASSWORD, which seeds the default admin account and its API password on first install. The database password is managed separately by the foundation.

Console: Security → Secret Manager.

CLI:

gcloud secrets list --project "$PROJECT" --filter="name~freshrss"
gcloud secrets versions access latest --secret=<secret-name> --project "$PROJECT"

See App_CloudRun for injection and rotation details.

F. Networking & ingress

The service is reachable at its run.app URL by default (public ingress). An external HTTPS load balancer with a custom domain, Cloud CDN, and Cloud Armor can be layered on; ingress settings and VPC egress control connectivity.

Console: Cloud Run (service URL); Network services → Load balancing.

CLI:

gcloud run services describe <service-name> --region "$REGION" --format='value(status.url)'
gcloud compute addresses list --project "$PROJECT"

See App_CloudRun.

G. Cloud Logging & Monitoring

Container logs flow to Cloud Logging; Cloud Run and Cloud SQL metrics flow to Cloud Monitoring, with optional uptime checks and alert policies.

Console: Logging → Logs Explorer; Monitoring → Dashboards / Alerting.

CLI:

gcloud run services logs read <service-name> --project "$PROJECT" --region "$REGION" --limit 50

3. FreshRSS Application Behaviour

First-deploy database setup. The db-init Job runs using postgres:15-alpine. It connects through the Cloud SQL Auth Proxy and idempotently creates the application database and user and grants privileges. The job is safe to re-run.
First-boot install. The container's platform-entrypoint.sh resolves the DB host, then drives FreshRSS's own cli/do-install.php (creates data/config.php and the schema) and cli/create-user.php (creates the admin account from FRESHRSS_ADMIN_PASSWORD), then chains the upstream entrypoint. The install is idempotent — it is skipped once data/config.php exists on the NFS volume.
Feed refresh cron. The upstream image starts an in-container cron (CRON_MIN = */15) that actualizes subscribed feeds every 15 minutes. This runs only while an instance is alive — under scale-to-zero (min_instance_count = 0) refreshes pause until the next request wakes the service.
Admin credential. The default login is admin with the generated FRESHRSS_ADMIN_PASSWORD; the same value is set as the API password used by Google Reader / Fever API mobile clients. Change it in the FreshRSS UI after first login — rotating the Secret Manager value alone will not re-set an already-installed account.
Health path. The startup probe is a TCP check on port 80; the liveness probe is an HTTP GET on / (200). FreshRSS also serves an unauthenticated /status JSON endpoint suitable for uptime checks. Allow a generous first-boot window while the installer creates the schema.
Base URL. BASE_URL is set to the predicted Cloud Run URL at plan time and corrected at runtime from CLOUDRUN_SERVICE_URL. Verify the running revision:
```
gcloud run services describe <service-name> --region "$REGION" --format='value(status.url)'
```

Inspect job execution:

gcloud run jobs list --project "$PROJECT" --region "$REGION"
gcloud run jobs executions list --job <job-name> --project "$PROJECT" --region "$REGION"

4. Configuration Variables

Variables are grouped exactly as they appear on the deployment platform. Only settings specific to or notable for FreshRSS are listed; every other input is inherited from App_CloudRun with its standard behaviour.