PodFetch

Prerequisites

You need the following:

• An active Azure subscription
• An SSH key pair
• A virtual network and subnet in the target region
• A VM size of Standard_B2s (2 vCPU / 4 GiB RAM) as a starting point. Choose a larger size for larger libraries or more concurrent listeners.
• Network security group inbound rules that allow 22/tcp from your management network and 80/tcp for the web player

PodFetch serves plain HTTP on port 80. To serve it over HTTPS, terminate TLS in front of it with your own domain. The PodFetch server never faces the network directly. ufw keeps it off the network, and nginx on port 80 is the only way to reach it, so port 8000 stays private.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure portal, choose Create a resource, search the Marketplace for PodFetch by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab. Then choose Review + create and Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, then create the VM:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:podfetch-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name podfetch \
  --image sac1647283583153:podfetch-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 to the web player:

az vm open-port --resource-group <your-rg> --name podfetch --port 80

Step 3 - Confirm the services are running

Connect over SSH as azureuser and confirm that PodFetch and nginx are active. The PodFetch server listens on port 8000, but ufw keeps that port off the network. nginx serves the web player on port 80.

systemctl is-active podfetch nginx podfetch-firstboot

sudo ss -tlnp | grep -E ':80 |:8000 ' | sed 's/ */ /g'

sudo ufw status | grep -E '22/tcp|80/tcp|443/tcp'

Step 4 - Retrieve your per-VM administrator password

The image ships with no baked-in password. On the first boot of every VM, a one-shot service generates a unique administrator password. It writes the password, the site URL and the username to a root-only file. Read the file with sudo:

sudo cat /root/podfetch-credentials.txt

The username is admin, and the password is unique to this VM. At any time, you can prove the whole authentication round trip from the command line with the bundled self test. It confirms that an unauthenticated request is rejected with 401, that a wrong password is rejected with 401, and that the per-VM password is accepted with 200:

sudo /opt/podfetch/podfetch-selftest.sh

You can also check by hand. The health endpoint is unauthenticated, an unauthenticated API request is challenged, and the per-VM password authenticates:

curl -s -o /dev/null -w 'GET /healthz -> HTTP %{http_code}\n' http://127.0.0.1/healthz

curl -s -o /dev/null -w 'GET /api/v1/podcasts (no credentials) -> HTTP %{http_code}\n' http://127.0.0.1/api/v1/podcasts

PODFETCH_PASSWORD=$(sudo grep '^PODFETCH_PASSWORD=' /root/podfetch-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'GET /api/v1/podcasts (per VM password) -> HTTP %{http_code}\n' -u "admin:$PODFETCH_PASSWORD" http://127.0.0.1/api/v1/podcasts

Step 5 - Sign in to the web player

Browse to http://<vm-public-ip>/. PodFetch shows its sign-in screen. Sign in with the username admin and the per-VM password from Step 4, and the web player opens.

To avoid entering the credentials on every visit, tick the memorize option. Use this option only on a device that you own.

Step 6 - The PodFetch home screen

After you sign in, the PodFetch web player opens. The sidebar lets you move between your podcasts, the episode timeline, favourites and settings. A search box lets you find and add new podcasts.

The image ships with an empty library. Your podcasts appear here once you subscribe to feeds in the next step.

Step 7 - Subscribe to a podcast

Open the add or search view, then type the name of a podcast or paste an RSS feed URL. PodFetch searches the PodcastIndex and iTunes directories. Select a result to subscribe. PodFetch then downloads episodes on the schedule that the polling interval sets, so they are ready to stream offline.

You can add as many feeds as you like and manage them from the podcasts view.

Step 8 - Verify the stack

Confirm the PodFetch version, confirm that the services are enabled, confirm that the web player responds through nginx, and confirm the dedicated data disk mount:

grep podfetch_version /opt/podfetch/VERSION

systemctl is-enabled podfetch nginx

curl -s -o /dev/null -w 'GET /healthz -> HTTP %{http_code}\n' http://127.0.0.1/healthz

findmnt -no SOURCE,TARGET,FSTYPE /var/lib/podfetch

Step 9 - Where your data lives

The SQLite database and the downloaded podcast episodes both live on a dedicated Azure data disk mounted at /var/lib/podfetch, separate from the OS disk. The disk is captured into the image and reprovisioned on every VM. You can snapshot and resize it independently as your library grows. Confirm the mount and the free space:

df -h /var/lib/podfetch | tail -1

sudo du -sh /var/lib/podfetch/db /var/lib/podfetch/podcasts

Step 10 - Connect a podcast app

PodFetch exposes gpodder, Subsonic and AudiobookShelf compatible sync APIs, so a range of mobile and desktop podcast apps can sync subscriptions and playback against your server. Point the app at http://<vm-public-ip>/ and sign in with the admin username and the per-VM password.

To stream episodes with authentication enabled, you may need to generate an API key for your user from the profile view in the web UI. You can also invite additional users from the user administration view, so that a household or team shares one server while you keep administrative control.

Security notes

• TLS. PodFetch serves plain HTTP on port 80. Put it behind your own TLS-terminating reverse proxy or an Azure Application Gateway with a certificate for your domain, and restrict port 80 in the network security group to trusted networks. A common approach is certbot with your-domain on a front-end proxy.
• Network exposure. The PodFetch server binds to port 8000, but ufw keeps that port off the network, so only nginx on port 80 faces the network. Both the nginx Basic Auth gate and the native Basic Auth of PodFetch require the per-VM password.
• Administrator password. The image ships with no baked-in password. First boot generates a unique administrator password and writes it to /root/podfetch-credentials.txt, which only root can read. Keep the password in a safe place, and change it or add scoped user accounts from the user administration view.
• Patching. The image is patched at build time and ships with unattended security upgrades enabled. Keep the VM patched.

Support

SecureAnyCloud provides 24/7 support with its images. If you have questions about this PodFetch image or need help with your deployment, contact us through the SecureAnyCloud website.

Deploy on Azure

Launch PodFetch on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com