Clément Désiles
5efc0b0d6e
certbot cannot issue for internal hostnames (*.nas.local), which made nginx-enabled services with internal names fail on deploy. Add a <service>_nginx_letsencrypt flag (default false) and computed <service>_nginx_ssl_certificate/_key paths: when off the vhost uses the shared self-signed cert (nginx_default_ssl_cert), when on it uses the Let's Encrypt lineage. Gate the certbot include on the flag and apply the pattern to all service roles (deluge, fdroid, gitea, grafana, immich, metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
fdroid - F-Droid Custom APK Repository
Deploys an F-Droid repository server using austozi/fdroidserver to host custom APKs for family devices.
Configuration
Required Variables
Set in inventory or vault:
fdroid_keystore_password: "your-secure-password-here" # Min 12 chars
Optional Variables
See defaults/main.yml for all configuration options.
Key settings:
fdroid_version: "26.2.1"
fdroid_port: 8070
fdroid_repo_url: "https://apk.jokester.fr/repo"
fdroid_repo_name: "F-Droid Repository"
fdroid_repo_description: "Custom APK repository"
fdroid_update_interval: "12h"
# Nginx reverse proxy
fdroid_nginx_enabled: false
fdroid_nginx_hostname: apk.nas.local
Usage
Adding APKs
scp my-app.apk jokester@andromeda:/opt/podman/fdroid/data/repo/
The container automatically re-runs fdroid update every fdroid_update_interval (default: 12h) to regenerate the signed index.
To trigger an immediate update:
ssh jokester@andromeda "podman exec fdroid-server fdroid update -c"
F-Droid Client Setup
On family phones, open F-Droid and add a new repository:
- Repository URL:
https://apk.jokester.fr/repo - Accept the fingerprint on first connection
Keystore Backup
The signing keystore at {{ podman_projects_dir }}/fdroid/data/keystore.p12 is critical. If lost, all clients must re-add the repository. Back it up.
Architecture
- Container:
austozi/fdroidserver(Apache + fdroidserver + Android build-tools) - Storage: Persistent data directory for keystore, config, metadata, and APKs
- Networking: Localhost binding, nginx reverse proxy for HTTPS
- Index updates: Automatic on configurable interval
Dependencies
- podman
- nginx (if
fdroid_nginx_enabled: true)