CommaFeed on Ubuntu 24.04 on Azure User Guide

Overview

CommaFeed is a self hosted RSS and Atom feed reader inspired by the classic Google Reader. It subscribes to the news sites, blogs and release feeds you follow, fetches new articles on a schedule, and presents them in a fast, keyboard friendly web interface with folders, tags, full text search, starred items and read tracking. It gives you one private place to keep up with the web without handing your reading habits to a third party service. The cloudimg image ships CommaFeed 7.2.0 as the official GraalVM native build on a hardened, fully patched Ubuntu 24.04 LTS base, with a bundled local PostgreSQL database so the appliance is complete and useful on its own. CommaFeed runs behind an nginx reverse proxy on port 80 and binds only to the loopback interface. PostgreSQL listens only on 127.0.0.1 and keeps its data on a dedicated Azure data disk. A unique administrator account is created on the first boot of every VM, so there is no default login. Backed by 24/7 cloudimg support.

What is included:

• CommaFeed 7.2.0 running as the native executable, managed by systemd
• A bundled PostgreSQL 16 database holding your feeds, articles and settings, already installed and ready
• CommaFeed served on :80 through an nginx reverse proxy, with WebSocket support for live feed tree updates
• A per VM administrator account created on first boot and recorded in a root only file
• No shipped default login: CommaFeed ships an empty database, so the familiar admin / admin account never exists on your VM
• CommaFeed and PostgreSQL bound to 127.0.0.1 only, never exposed to the network
• A dedicated Azure data disk carrying the PostgreSQL cluster, so all of your reading data stays with the VM
• commafeed.service, nginx.service and postgresql.service as enabled systemd units
• An unauthenticated /health endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; size up if you follow a large number of high volume feeds. NSG inbound: allow 22/tcp from your management network and 80/tcp for the reader. CommaFeed serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain. The bundled PostgreSQL is never exposed: it listens on 127.0.0.1 only, so port 5432 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for CommaFeed by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name commafeed \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 to the reader:

az vm open-port --resource-group <your-rg> --name commafeed --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm CommaFeed, nginx and PostgreSQL are all active. Note that CommaFeed listens only on 127.0.0.1:8082 and PostgreSQL only on 127.0.0.1:5432, while nginx serves the reader on port 80.

systemctl is-active commafeed nginx postgresql commafeed-firstboot

ss -tlnp | grep -E ':80 |:8082 |:5432 ' | sed 's/  */ /g'

Step 4 - Retrieve the per VM administrator password

Every VM creates its own CommaFeed administrator account on first boot and writes the login user, the generated password and the URL to a root only credentials file. Read it with sudo:

sudo cat /root/commafeed-credentials.txt

You sign in as user admin with the COMMAFEED_ADMIN_PASSWORD from this file.

Step 5 - Sign in to CommaFeed

Browse to http://<vm-public-ip>/. You land on the CommaFeed login page. Sign in with username admin and the password from Step 4.

Step 6 - Read your feeds

Once signed in, CommaFeed opens the reader. The left column is your feed tree with unread counts per feed and folder; the main column is the article list. Click any article to read it, star it to keep it, or mark it read. The toolbar across the top gives you next and previous navigation, refresh, mark all as read, unread and sort filters, and full text search.

Step 7 - Subscribe to a feed

Click the plus button next to the CommaFeed logo to add a subscription. Paste a feed URL, or even a website address and CommaFeed will try to discover the feed in the page, then click Next to analyse it and subscribe. You can organise subscriptions into categories, and import or export your whole subscription list as OPML from the same dialog.

Step 8 - Tune your display and profile

Open Settings from the user menu in the top right. The Display tab controls language, primary colour, the reading layout, and how entries scroll and are marked as read. The Profile tab is where you change your own password, set an email address for password recovery, and manage your API key. Push notifications and Custom code let you extend CommaFeed further.

Step 9 - No known or default credentials

Older CommaFeed releases shipped a well known admin / admin account. The cloudimg image removes that risk entirely: it ships an empty database, so on first boot CommaFeed has no users at all, and the appliance creates the administrator with a unique per VM secret before the reader is ever reachable. You can prove that the default credential does not work while your per VM credential does:

curl -s -o /dev/null -w 'admin/admin default  -> HTTP %{http_code}\n' -u admin:admin http://127.0.0.1:8082/rest/user/settings

PW=$(sudo grep '^COMMAFEED_ADMIN_PASSWORD=' /root/commafeed-credentials.txt | cut -d= -f2-); curl -s -o /dev/null -w 'your per VM admin  -> HTTP %{http_code}\n' -u "admin:$PW" http://127.0.0.1:8082/rest/user/settings

The default admin / admin is rejected with 401, an anonymous request is rejected with 401, and only your per VM administrator password is accepted with 200.

Step 10 - Verify the stack and where your data lives

Confirm the health endpoint and see your live feed, article and user counts. The PostgreSQL cluster lives on the dedicated data disk mounted at /var/lib/commafeed (its data directory is /var/lib/commafeed/pgdata), so all of your subscriptions and articles are kept separate from the operating system disk and ride with the VM:

curl -sI http://127.0.0.1/health | head -1

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /var/lib/commafeed

sudo runuser -u postgres -- psql -d commafeed -tAc "SELECT 'feeds=' || (SELECT count(*) FROM feedsubscriptions) || '  entries=' || (SELECT count(*) FROM feedentries) || '  users=' || (SELECT count(*) FROM users)"

Adding your own domain and TLS

The appliance serves plain HTTP on port 80. For production you should front CommaFeed with your own domain and a TLS certificate. Terminate TLS with Azure Application Gateway, an nginx or Caddy reverse proxy, or a managed load balancer with a certificate for your domain, and point it at the VM on port 80. CommaFeed itself needs no reconfiguration for this because it already sits behind the local nginx proxy.

Security notes

• CommaFeed serves plain HTTP on port 80. For anything beyond a trusted network, put it behind your own TLS terminating reverse proxy or Azure Application Gateway with a certificate for your domain.
• The bundled PostgreSQL listens on 127.0.0.1 only and is never reachable from the network. Administer it over SSH with sudo runuser -u postgres -- psql.
• The administrator account is unique per VM and no default or blank credential authenticates. Keep /root/commafeed-credentials.txt protected, and change your password from the Settings Profile tab once you are signed in.
• Public registration is disabled by default, so only accounts you create can sign in. Restrict inbound 80/tcp in your NSG to the networks that need the reader.

Support

This image is maintained by cloudimg with 24/7 support. If you need help deploying or operating CommaFeed on Azure, contact us at cloudimg.co.uk.