Deployment guide

RSS-Bridge

Overview

RSS-Bridge is a popular open-source application that generates RSS and Atom feeds for websites that do not publish their own. Pick a bridge from a searchable list and fill in a short form. RSS-Bridge returns a feed URL that you paste into any RSS reader, so you can follow sites, video channels and social accounts in one place.

The SecureAnyCloud image installs RSS-Bridge on nginx and PHP 8.3 FPM, then locks it down. RSS-Bridge fetches upstream URLs on the requester's behalf, so an unprotected instance could be abused by anyone on the internet as an open feed proxy. To prevent that, the entire interface sits behind a per-VM HTTP Basic Auth gate (user admin, with a unique password generated on first boot). Only an unauthenticated /healthz endpoint stays open for load balancer probes. RSS-Bridge's own configuration is hardened too, with a curated set of bridges and debug mode disabled.

What you get:

RSS-Bridge (release 2025-08-05) installed on nginx and PHP 8.3 FPM, with no database to run
The full RSS-Bridge web UI on :80, fronted by nginx with a default-deny HTTP Basic Auth gate
Per-VM HTTP Basic Auth (user admin) protecting the whole surface, with a unique password generated on first boot
Open proxy protection, so only the authenticated owner can generate feeds and the instance cannot be abused
A curated enabled_bridges set and enable_debug_mode = false in config.ini.php for defence in depth
An unauthenticated /healthz endpoint for Azure Load Balancer health probes
nginx.service and php8.3-fpm.service as systemd units, enabled and active
A bcrypt Basic Auth hash stored on disk only, so no plaintext password ships in the image
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting point, because RSS-Bridge is light on resources. In the NSG, allow inbound 22/tcp from your management network, 80/tcp for the web UI, and 443/tcp if you add TLS.

RSS-Bridge serves plain HTTP on port 80. For production, terminate TLS in front of it with your own domain and restrict access to trusted IP ranges (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for RSS-Bridge by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then choose Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:rss-bridge-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name rss-bridge \
  --image sac1647283583153:rss-bridge-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name rss-bridge --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active nginx.service php8.3-fpm.service

Both services report active. RSS-Bridge runs as PHP under php8.3-fpm, and nginx fronts it on port 80 and adds the per-VM HTTP Basic Auth gate. PHP-FPM listens only on a local unix socket, so nginx is the only way in.

Step 5 - Retrieve your web UI password

nginx protects the whole RSS-Bridge interface with HTTP Basic Auth. The username is admin. The first boot of your VM generates a unique password and writes it to a root-only file:

sudo cat /stage/scripts/rss-bridge-credentials.log

The file contains RSS_BRIDGE_USERNAME, RSS_BRIDGE_PASSWORD and the RSS_BRIDGE_URL to open in a browser. The password is stored on disk only as a bcrypt hash in /etc/nginx/.rss-bridge.htpasswd, so no plaintext password ships in the image. Store the password somewhere safe.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/healthz

The endpoint returns ok. It never requires authentication, so it is safe for an Azure Load Balancer health probe. It is the only path that is reachable without the password.

Step 7 - Confirm the open proxy protection

A password is set on first boot, so an unauthenticated request to the interface returns HTTP 401. Nobody can use RSS-Bridge without the password, which stops your instance being abused as an open feed proxy.

The following commands read the per-VM password from the credentials file and prove the round trip. An unauthenticated request is rejected, a wrong password is rejected, and the correct password authenticates:

PW=$(sudo grep '^RSS_BRIDGE_PASSWORD=' /stage/scripts/rss-bridge-credentials.log | cut -d= -f2-)
echo "unauth : $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/)"
echo "wrongpw : $(curl -s -o /dev/null -w '%{http_code}' -u admin:wrong-pw http://127.0.0.1/)"
echo "authed : $(curl -s -L -o /dev/null -w '%{http_code}' -u admin:$PW http://127.0.0.1/)"

The output is unauth : 401, wrongpw : 401 and authed : 200. The whole interface is reachable only with the per-VM password.

Step 8 - Generate a feed from the command line

The image ships a small built-in self-test page, reachable only on loopback, so you can confirm the feed pipeline end to end without depending on an external site. The following commands authenticate with your per-VM password and ask the CSS Selector Bridge to turn that page into an Atom feed:

PW=$(sudo grep '^RSS_BRIDGE_PASSWORD=' /stage/scripts/rss-bridge-credentials.log | cut -d= -f2-)
curl -s -u "admin:$PW" -G http://127.0.0.1/ \
  --data-urlencode action=display \
  --data-urlencode bridge=CssSelectorBridge \
  --data-urlencode home_page=http://127.0.0.1/selftest/feed-source.html \
  --data-urlencode 'url_selector=article h2 a' \
  --data-urlencode format=Atom | head -16

The output is a valid Atom document with an <feed> element and three <entry> items. This proves that RSS-Bridge can fetch a page, extract items and emit a feed. In the browser, you point the same bridge at any real site.

Step 9 - Sign in and browse the bridge list

Browse to http://<vm-public-ip>/. When your browser prompts for a username and password, enter admin and the password from Step 5.

RSS-Bridge opens on its home page, a searchable list of bridges. Each bridge is a card that describes a site or service it can turn into a feed. Use the search box at the top to filter by name, description or URL.

Step 10 - Fill in a bridge form

Click Show more on a bridge card to reveal its form.

The CSS Selector Bridge turns any page into a feed. Enter the page URL under Site URL, and enter a CSS selector for the article links under Selector for article links (for example article h2 a). The optional fields let you filter URLs, expand article content and set a limit. Click Generate feed to produce the feed.

Step 11 - Read the generated feed

RSS-Bridge opens the generated feed. In the HTML view, each extracted item appears as a card with its title and link. A row of format buttons (Atom, Json, Mrss and Plaintext) lets you switch the output format. This is the feed your RSS reader will consume.

Step 12 - Subscribe in your RSS reader

Choose Atom (or Mrss) to get the raw feed URL, then copy it into your RSS reader.

The whole interface is behind HTTP Basic Auth, so include the credentials in the subscription. Most readers accept a URL of the form http://admin:your-password@<vm-public-ip>/?action=display&bridge=..., or a separate username and password field. The reader then polls the feed on its own schedule.

Step 13 - Enable more bridges

The image enables a curated set of bridges rather than all of them. The set includes the generic CSS Selector, XPath, Feed Merge, Feed Reducer and Filter bridges, plus popular site bridges. To enable another bridge, add it to the [system] section of the RSS-Bridge configuration. No nginx reload is needed, because RSS-Bridge picks up the change on the next request:

sudo nano /var/www/rss-bridge/config.ini.php
# under [system], add a line such as:
# enabled_bridges[] = VimeoBridge
# save, then just refresh the browser

The full list of available bridge names is in /var/www/rss-bridge/bridges/. Keep the list curated rather than enabling * (all bridges), so the home page stays focused on the sources you use.

Maintenance

Password: the UI password is set on first boot and stored as a bcrypt entry in /etc/nginx/.rss-bridge.htpasswd. To change it, run sudo htpasswd -B /etc/nginx/.rss-bridge.htpasswd admin and then sudo systemctl reload nginx.
Enabled bridges: edit the enabled_bridges[] lines under [system] in /var/www/rss-bridge/config.ini.php. Keep it curated rather than *, and leave enable_debug_mode = false in production.
Restrict access: RSS-Bridge serves plain HTTP on port 80. For production, restrict access to trusted IP ranges in your Network Security Group, and front it with TLS (for example certbot with your own domain) terminating on :443.
Cache: feeds are cached on disk under /var/cache/rss-bridge. To force a refresh, clear the cache with sudo rm -rf /var/cache/rss-bridge/*.
Upgrades: RSS-Bridge is deployed under /var/www/rss-bridge. To upgrade, download a newer release, extract it over the web root preserving config.ini.php, and set ownership back to www-data.
Security patches: unattended-upgrades stays enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. To reach the team, email sales@secureanycloud.com.

Deploy on Azure

Launch RSS-Bridge on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

This image runs RSS-Bridge, the open-source application that generates RSS and Atom feeds for websites that do not publish their own. Pick a bridge from a searchable list and fill in a short form. RSS-Bridge returns a feed URL that you paste into any RSS reader, so you can follow sites, video channels and social accounts in one place.

RSS-Bridge is pure PHP and stateless. There is no database to run, only a local file cache. nginx answers on port 80 (and 443 once you add TLS) and passes requests to php-fpm over a local socket. The application code lives at /var/www/rss-bridge with index.php at the root, and the file cache lives outside the web root at /var/cache/rss-bridge.

RSS-Bridge fetches upstream URLs on the requester's behalf, so an unprotected instance can be abused by anyone on the internet as an open feed proxy. This image is hardened against that. The entire interface sits behind an nginx HTTP Basic Auth gate, and the first boot of every instance generates its password uniquely and at random. No shared or default credential ships in the image, and only you can generate feeds.

The password is stored only as a bcrypt hash on the instance, and the plaintext is written to a root-only file. An unauthenticated health endpoint at /healthz is provided for load-balancer probes.

Prerequisites

Before you deploy this image, make sure you have:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks you will reach RSS-Bridge on
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for RSS-Bridge. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or another size that suits your workload. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and either create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks you will use. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes only a few seconds after the instance state becomes Running and the status checks pass.

Launch the Instance from the AWS CLI

The following command launches an instance from the SecureAnyCloud RSS-Bridge Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":20,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=rss-bridge-01}]'

On success, the command prints a JSON document. Note the instance ID, then retrieve the public address once the instance is running withaws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect and Retrieve the Basic Auth Password

Connect over SSH with the key pair you selected and the public IP address from Step 2. For the RSS-Bridge on Ubuntu 24.04 variant, the SSH login user is ubuntu:

ssh -i <key-name>.pem ubuntu@<public-ip>

On the first boot of every instance, a one-shot service generates a unique 24-character Basic Auth password for the user admin. The service seeds the password into the nginx password file as a bcrypt hash, proves the gate works, and records the plaintext in a root-only credentials file. Retrieve it with:

sudo cat /stage/scripts/rss-bridge-credentials.log

The file contains the interface URL, the username admin, and the generated password:

RSS_BRIDGE_URL=http://<public-ip>/ RSS_BRIDGE_USERNAME=admin RSS_BRIDGE_PASSWORD=<generated-password>

Keep this password safe. It unlocks the whole interface and stops anyone else using your instance as a feed proxy.

Sign In to the RSS-Bridge Interface

Open http://<public-ip>/ in a browser. The entire surface is gated, so the browser prompts for a username and password. Enter admin and the generated password from Step 3. The RSS-Bridge home page shows a search box and the searchable list of available bridges.

To confirm the gate is working, use the command line. Without credentials the interface returns 401, while the health endpoint stays open:

curl -s -o /dev/null -w '%{http_code}\n' http://<public-ip>/
# 401 (gated)
curl -s -o /dev/null -w '%{http_code}\n' http://<public-ip>/healthz
# 200 (open probe)
curl -s -o /dev/null -w '%{http_code}\n' -u admin:<generated-password> http://<public-ip>/
# 200

Build a Feed from a Bridge

RSS-Bridge turns any site into a feed. Search for a bridge by name, or paste a site URL into the search box, then choose a bridge. The generic bridges (CSS Selector Bridge, XPath Bridge, FeedMerge, FeedReducer and Filter) work against almost any site. Popular site-specific bridges (YouTube, Reddit, Mastodon, Bandcamp and others) are enabled too.

The CSS Selector Bridge, for example, converts any page into a feed using CSS selectors. Fill in the home page URL and a selector for the article links, then choose your output format.

RSS-Bridge returns a feed in the format you pick. An Atom feed is a valid <feed> document with an entry per item, ready to subscribe to in any RSS reader.

Copy the feed URL from your browser's address bar and paste it into your RSS reader. The whole surface is password-gated, so include the admin credentials in the reader. Most readers accept http://admin:<password>@<public-ip>/... or a dedicated username and password field.

Curated Bridges and Hardening

RSS-Bridge is configured for safety out of the box. Its config.ini.php enables a curated set of bridges rather than all of them, disables debug mode and maintenance mode, and turns off the project's own token advertising.

The nginx site is default-deny. Every path requires the Basic Auth password, except /healthz (a static probe) and a loopback-only self-test fixture. The file cache and configuration are denied to the web.

To review the enabled bridges and settings, run:

sudo sed -n '1,40p' /var/www/rss-bridge/config.ini.php

To enable a bridge that is not in the curated list, add an enabled_bridges[] = <BridgeName> line to that file and reload nginx with sudo systemctl reload nginx.

The Application Stack

RSS-Bridge is served by nginx and php-fpm under systemd. Check the services:

systemctl status nginx php8.3-fpm

Both services should report active (running). nginx listens on port 80 (and 443 once you configure TLS), and php-fpm runs the PHP front controller over a local unix socket. The health endpoint at /healthz returns 200 without authentication, for load-balancer and uptime checks.

Add a Domain and HTTPS

For production, put RSS-Bridge behind a domain name and TLS. The simplest route on AWS is to place the instance behind an Application Load Balancer with an AWS Certificate Manager certificate, forwarding HTTPS on 443 to the instance on 80.

Alternatively, install a certificate directly on the instance with certbot and the nginx plugin. Point your domain's DNS A record at the instance's public IP first. Keep the Basic Auth gate in place either way, because it stops your instance being abused as an open proxy.

Rotating the Password

The first boot generates the Basic Auth password once. To rotate it, generate a new bcrypt entry for admin and reload nginx:

sudo htpasswd -B /etc/nginx/.rss-bridge.htpasswd admin
# prompts for <new-password>
sudo systemctl reload nginx

htpasswd prompts for the new password twice and stores only the bcrypt hash. Update any RSS readers that carry the old credential.

Upgrades and Maintenance

The operating system is fully patched at build time and continues to receive unattended security updates.

To upgrade RSS-Bridge itself, download a newer release from the RSS-Bridge project, verify it, and replace the contents of /var/www/rss-bridge while preserving your config.ini.php. Take an EBS snapshot of the instance before you upgrade, so you can roll back.

Support

SecureAnyCloud provides 24/7 technical support for this RSS-Bridge AMI by email at sales@secureanycloud.com and via live chat. We help with configuration, enabling bridges, custom domains and HTTPS, reverse proxy tuning, upgrades and troubleshooting. Critical issues receive a one hour average response time.

Deploy on AWS

Launch RSS-Bridge on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS