Deployment guide

CommaFeed

Overview

CommaFeed is a self-hosted RSS and Atom feed reader inspired by the classic Google Reader. It fetches new articles from the sites, blogs and release feeds you follow, and presents them in a fast, keyboard-friendly web interface with folders, tags, full-text search, starred items and read tracking. It gives you one private place to keep up with the web without handing your reading habits to a third-party service.

This SecureAnyCloud image ships CommaFeed 7.2.0 as the official GraalVM native build on a hardened Ubuntu 24.04 LTS base, patched at build time. A bundled local PostgreSQL database makes the appliance complete on its own. A unique administrator account is created on the first boot of every VM, so there is no default login.

What you get:

CommaFeed 7.2.0 running as the native executable, managed by systemd
A bundled PostgreSQL 16 database holding your feeds, articles and settings, already installed and ready
CommaFeed served on :80 through an nginx reverse proxy, with WebSocket support for live feed tree updates
A per-VM administrator account created on first boot and recorded in a root-only file
No default login: the image ships an empty database, so the familiar admin / admin account never exists on your VM
CommaFeed and PostgreSQL bound to 127.0.0.1 only, never exposed to the network
A dedicated Azure data disk carrying the PostgreSQL cluster, so all of your reading data stays with the VM
commafeed.service, nginx.service and postgresql.service as enabled systemd units
An unauthenticated /health endpoint for Azure Load Balancer health probes
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Choose a larger size if you follow a large number of high-volume feeds.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the reader. CommaFeed serves plain HTTP on port 80, so for production terminate TLS in front of it with your own domain. The bundled PostgreSQL listens on 127.0.0.1 only, so port 5432 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for CommaFeed by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:commafeed-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name commafeed \
  --image sac1647283583153:commafeed-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 for the reader:

az vm open-port --resource-group <your-rg> --name commafeed --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that CommaFeed, nginx and PostgreSQL are all active. CommaFeed listens only on 127.0.0.1:8082 and PostgreSQL only on 127.0.0.1:5432, while nginx serves the reader on port 80.

systemctl is-active commafeed nginx postgresql commafeed-firstboot

ss -tlnp | grep -E ':80 |:8082 |:5432 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM administrator password

Every VM creates its own CommaFeed administrator account on first boot. The login user, the generated password and the URL are written to a root-only credentials file. Read it with sudo:

sudo cat /root/commafeed-credentials.txt

Step 5 - Sign in to CommaFeed

Browse to http://<vm-public-ip>/. The CommaFeed login page opens. Sign in with username admin and the password from Step 4.

Step 6 - Read your feeds

After you sign in, CommaFeed opens the reader. The left column is your feed tree, with unread counts per feed and folder. The main column is the article list.

Click an article to read it, star it to keep it, or mark it read. The toolbar across the top offers next and previous navigation, refresh, mark all as read, unread and sort filters, and full-text search.

Step 7 - Subscribe to a feed

Click the plus button next to the CommaFeed logo to add a subscription. Paste a feed URL, or a website address, in which case CommaFeed tries to discover the feed in the page. Click Next to analyse it and subscribe.

You can organise subscriptions into categories, and import or export your whole subscription list as OPML from the same dialog.

Step 8 - Tune your display and profile

Open Settings from the user menu in the top right. The Display tab controls language, primary colour, the reading layout, and how entries scroll and are marked as read.

The Profile tab is where you change your own password, set an email address for password recovery, and manage your API key. The Push notifications and Custom code tabs let you extend CommaFeed further.

Step 9 - Confirm there are no default credentials

Older CommaFeed releases shipped a well-known admin / admin account. This image removes that risk. It ships an empty database, so CommaFeed has no users at all on first boot. The appliance then creates the administrator with a unique per-VM secret before the reader is reachable.

Prove it with two requests: the default credential is rejected, and your per-VM credential is accepted.

curl -s -o /dev/null -w 'admin/admin default -> HTTP %{http_code}\n' -u admin:admin http://127.0.0.1:8082/rest/user/settings

PW=$(sudo grep '^COMMAFEED_ADMIN_PASSWORD=' /root/commafeed-credentials.txt | cut -d= -f2-); curl -s -o /dev/null -w 'your per VM admin -> HTTP %{http_code}\n' -u "admin:$PW" http://127.0.0.1:8082/rest/user/settings

The default admin / admin is rejected with 401. An anonymous request is also rejected with 401. Only your per-VM administrator password is accepted, with 200.

Step 10 - Verify the stack and where your data lives

The PostgreSQL cluster lives on the dedicated data disk mounted at /var/lib/commafeed, and its data directory is /var/lib/commafeed/pgdata. Your subscriptions and articles are therefore kept separate from the operating system disk and ride with the VM.

Check the health endpoint, confirm the mount, and read your live feed, article and user counts:

curl -sI http://127.0.0.1/health | head -1

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /var/lib/commafeed

sudo runuser -u postgres -- psql -d commafeed -tAc "SELECT 'feeds=' || (SELECT count(*) FROM feedsubscriptions) || ' entries=' || (SELECT count(*) FROM feedentries) || ' users=' || (SELECT count(*) FROM users)"

Adding your own domain and TLS

The appliance serves plain HTTP on port 80, so for production put CommaFeed behind your own domain and a TLS certificate. Terminate TLS with Azure Application Gateway, an nginx or Caddy reverse proxy, or a managed load balancer with a certificate for your domain. Point it at the VM on port 80.

CommaFeed itself needs no reconfiguration, because it already sits behind the local nginx proxy.

Security notes

Encrypt web traffic. CommaFeed serves plain HTTP on port 80. For anything beyond a trusted network, put it behind your own TLS-terminating reverse proxy or Azure Application Gateway with a certificate for your domain.
Keep PostgreSQL private. The bundled PostgreSQL listens on 127.0.0.1 only and is never reachable from the network. Administer it over SSH with sudo runuser -u postgres -- psql.
Protect the administrator account. It is unique per VM, and no default or blank credential authenticates. Keep /root/commafeed-credentials.txt protected, and change your password from the Settings Profile tab once you are signed in.
Restrict access. Public registration is disabled by default, so only accounts you create can sign in. Restrict inbound 80/tcp in your NSG to the networks that need the reader.

Support

SecureAnyCloud images come with 24/7 support. For help deploying or operating CommaFeed on Azure, contact us at secureanycloud.com.

Deploy on Azure

Launch CommaFeed on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

CommaFeed is a fast, self-hosted RSS and Atom feed reader with a modern React web interface. It is a private, ad-free successor to Google Reader that keeps your subscriptions and reading history on infrastructure you control.

This SecureAnyCloud image ships CommaFeed as the project's own recommended GraalVM native executable, with no Java runtime dependency. nginx is the sole public listener, PostgreSQL is bound to loopback as the datastore, and a unique administrator login is generated on the first boot of every instance.

What you get:

CommaFeed 7.2.0 as the official GraalVM native executable at /opt/commafeed/commafeed, run as the dedicated non-root commafeed system user
nginx on :80 as the only public listener, reverse-proxying to the application on 127.0.0.1:8082 (with WebSocket support for the live feed tree) and serving a static /health endpoint
PostgreSQL as the datastore for feeds, entries, tags and read state, bound to 127.0.0.1 only, on a dedicated EBS data volume mounted at /var/lib/commafeed
Per-instance administrator, session-encryption and PostgreSQL passwords generated at first boot and stored in a root-only file. The image ships with an empty database and no working credentials
New-user self-registration disabled by default, so the reader is not left open to the public
commafeed.service, nginx.service and postgresql.service as systemd units, enabled and active
24/7 SecureAnyCloud support

Prerequisites

Before you deploy this image, you need:

An Amazon Web Services account where you can launch EC2 instances and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network, and inbound ports 80 (and 443 once you enable HTTPS) from the networks you will read from
The AWS CLI version 2 installed locally, if you plan to deploy from the command line
Outbound internet access from the instance, for package updates and for fetching the feeds you subscribe to

m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type. CommaFeed's native executable is lightweight, so a smaller type also works for low-traffic personal use.

Connecting to your instance

Connect over SSH on port 22. The default login user for the Ubuntu 24.04 variant is ubuntu.

The examples below use ubuntu.

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for CommaFeed. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks you will read from. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes about a minute after the instance state becomes Running and the status checks pass. It covers database setup, secret rotation and administrator creation.

Launch the Instance from the AWS CLI

Run the following command to launch an instance from the SecureAnyCloud CommaFeed Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID and <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --associate-public-ip-address \
  --metadata-options 'HttpTokens=required' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=commafeed}]'

Connect to your instance

Connect over SSH with your key pair:

ssh -i /path/to/<key-name>.pem ubuntu@<instance-public-ip>

Confirm the services are running

Run these commands on the instance:

systemctl is-active commafeed.service nginx.service postgresql.service curl -s -o /dev/null -w 'health: HTTP %{http_code}\n' http://127.0.0.1/health curl -s -o /dev/null -w 'front door: HTTP %{http_code}\n' http://127.0.0.1/

All three services report active. The static health endpoint returns HTTP 200, and the reader front door returns HTTP 200 too, which confirms that nginx, CommaFeed and PostgreSQL are serving:

active active active health: HTTP 200 front door: HTTP 200

Retrieve your administrator login

The administrator account, the session-encryption key and the PostgreSQL password are generated uniquely on the first boot of your instance. They are written to a root-only file. Read it with:

sudo cat /root/commafeed-credentials.txt

The COMMAFEED_ADMIN_USER (always admin) and COMMAFEED_ADMIN_PASSWORD values are your sign-in for the web interface. To confirm that the file is present and root-only without printing the secret, run:

sudo test -f /root/commafeed-credentials.txt && echo "credentials file present, mode 0$(sudo stat -c '%a' /root/commafeed-credentials.txt)"
sudo grep -c '^COMMAFEED_ADMIN' /root/commafeed-credentials.txt

credentials file present, mode 0600 2

First sign-in

Open a web browser and go to http://<instance-public-ip>/. CommaFeed redirects to its sign-in page. Enter admin as the user name and the COMMAFEED_ADMIN_PASSWORD from the credentials file, then select Log in.

The sign-in page is served from first boot with a per-instance administrator login.

Subscribe to your first feed

Select the + (Subscribe) button in the top bar. On the Subscribe tab, paste a feed URL into Feed URL and select Next, then confirm to add it. If you paste a website URL instead, CommaFeed tries to discover the feed in the page.

You can also create categories to organize feeds, or bulk-import an existing subscription list on the OPML tab.

Read and organize your feeds

Your subscriptions appear in the left-hand tree, grouped by category, each with an unread count. Select All, a category or an individual feed to read its entries in the main pane.

The toolbar offers refresh, mark-all-as-read, unread/all filtering, sort order and full-text search.

Read an entry

Select an entry to expand it in place and read the content. The per-entry toolbar lets you star it, tag it, share it, or open the original article.

Entries are marked read as you go, and keyboard shortcuts let you move through your unread items quickly.

Verify the administrator login through the REST API

CommaFeed is API-driven, and the /rest API is protected by HTTP Basic authentication. From an SSH session on the instance, test the per-instance administrator password. A correct password returns 200, and a wrong password is refused with 401:

PW=$(sudo grep '^COMMAFEED_ADMIN_PASSWORD=' /root/commafeed-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'good password: HTTP %{http_code}\n' -u "admin:$PW" http://127.0.0.1:8082/rest/user/settings
curl -s -o /dev/null -w 'wrong password: HTTP %{http_code}\n' -u 'admin:wrong-password-x' http://127.0.0.1:8082/rest/user/settings

good password: HTTP 200 wrong password: HTTP 401

The API accepts the generated administrator credentials and refuses an incorrect one, which confirms that the reader requires authentication.

Confirm the runtime and security posture

Check the native executable, the dedicated non-root service user and the listening ports. nginx listens on all interfaces on :80, while CommaFeed and PostgreSQL are bound to loopback only:

file /opt/commafeed/commafeed | cut -d: -f2- id commafeed
sudo ss -tlnp | grep -E ':80 |:8082 |:5432 '

ELF 64-bit LSB executable, x86-64, ... dynamically linked uid=... (commafeed) gid=... (commafeed) groups=...(commafeed) LISTEN 0 4096 0.0.0.0:80 0.0.0.0:* LISTEN 0 4096 127.0.0.1:8082 0.0.0.0:* LISTEN 0 200 127.0.0.1:5432 0.0.0.0:*

nginx listens on all interfaces on port 80, while both the CommaFeed application (8082) and PostgreSQL (5432) are bound to loopback only and are never exposed to the network.

Enabling registration (optional)

New-user self-registration is disabled by default, so your reader is not open to the public. To let other people create their own accounts on this instance, enable registrations and restart CommaFeed:

sudo sed -i 's|^COMMAFEED_USERS_ALLOW_REGISTRATIONS=.*|COMMAFEED_USERS_ALLOW_REGISTRATIONS=true|' /etc/commafeed/commafeed.env
sudo systemctl restart commafeed

Leave it disabled if CommaFeed is only for you or your team; add users from the administrator account instead.

Enabling HTTPS

For any deployment reachable over the internet, serve CommaFeed over HTTPS so that logins cannot be intercepted. The image already fronts CommaFeed with nginx, so you only add a TLS certificate to the existing nginx site.

The following commands install certbot and obtain a certificate. They assume a DNS record that points your fully qualified domain name at the instance's public IP, and port 443 open in the security group:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d reader.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example --redirect

certbot edits the nginx site in place to serve HTTPS on 443 and redirect port 80, and it renews automatically. No change to the CommaFeed service is required, because nginx continues to proxy to it on loopback.

Backup and maintenance

CommaFeed keeps all of its state in PostgreSQL, on the dedicated /var/lib/commafeed EBS volume. That state covers feeds, entries, tags, read state and users. Back it up regularly:

sudo -u postgres pg_dump commafeed > <backup-dir>/commafeed-db-$(date +%F).sql

Ship the dump to Amazon S3 or another object store, and consider EBS snapshots of the data volume. You can also export your subscriptions from the web interface as an OPML file.

Ubuntu's unattended-upgrades is enabled by default. Keep the OS patched with sudo apt update && sudo apt upgrade.

To upgrade CommaFeed, replace the native executable at /opt/commafeed/commafeed with a newer release and restart the service. Database migrations run automatically on start. See https://github.com/Athou/commafeed.

Support

This image is backed by 24/7 SecureAnyCloud support. Contact us by email and chat for help with deployment, subscribing to and organizing feeds, OPML import and export, integrations, upgrades, TLS termination and database administration. Guaranteed response within 24 hours, one hour average for critical issues. Contact sales@secureanycloud.com.

For general CommaFeed questions, consult the project at https://github.com/Athou/commafeed. CommaFeed is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch CommaFeed on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS