FreshRSS on Ubuntu 24.04 on Azure User Guide

Overview

FreshRSS is a fast, self hosted RSS and Atom feed aggregator and reader. It pulls together the sites, blogs, newsletters and podcasts you follow into a single clean reading interface that you own and control, with no tracking and no third party cloud. The cloudimg image installs FreshRSS 1.29.1 served by nginx and PHP 8.3 FPM on a hardened, fully patched Ubuntu 24.04 LTS base. FreshRSS runs behind an nginx reverse proxy on port 80, stores everything in a self contained SQLite database on a dedicated Azure data disk, and generates a unique administrator password on the first boot of every VM. Mobile and desktop reader apps connect over the built in Google Reader and Fever compatible APIs. Backed by 24/7 cloudimg support.

What is included:

• FreshRSS 1.29.1 served by nginx and PHP 8.3 FPM, managed by systemd
• The FreshRSS web interface on :80 with a per VM admin account
• A self contained SQLite database (no separate database server to run or tune)
• A per VM admin password generated on first boot and recorded in a root only file
• The Google Reader and Fever compatible APIs enabled for mobile and desktop reader apps
• A dedicated Azure data disk at /var/lib/freshrss for the database, cache, favicons and feeds
• nginx.service and php8.3-fpm.service as systemd units, enabled and active
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; size up for large feed collections or many users. NSG inbound: allow 22/tcp from your management network and 80/tcp for the web interface. FreshRSS serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for FreshRSS by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name freshrss \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name freshrss --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

FreshRSS is served by nginx on port 80, which forwards PHP requests to PHP 8.3 FPM over a local socket. Confirm both services are active and nginx is listening on port 80:

systemctl is-active nginx php8.3-fpm freshrss-firstboot
ss -tlnp | grep ':80 '

Step 5 - Retrieve your admin password

On the first boot of every VM the freshrss-firstboot.service generates a unique administrator password, seeds the FreshRSS admin account with it (and sets the same password as the Google Reader and Fever API password), and writes the details to a root only file. Read it with:

sudo cat /root/freshrss-credentials.txt

Step 6 - Confirm the stack and health endpoint

nginx serves an unauthenticated /healthz endpoint for load balancer probes. Confirm the FreshRSS release, the PHP version, that the web interface responds and that the Fever API is enabled:

grep -oP "FRESHRSS_VERSION = '\K[^']+" /var/www/freshrss/constants.php
php -v | head -1
curl -sI http://127.0.0.1/healthz | head -1
curl -s "http://127.0.0.1/api/fever.php?api"

Step 7 - Open FreshRSS in your browser

Browse to http://<vm-public-ip>/. FreshRSS redirects anonymous visitors to the sign in page.

Step 8 - Sign in and read your feeds

Enter admin and the password from Step 5, then select Sign in. FreshRSS opens the reader: your subscriptions are listed in the left hand sidebar, and articles appear in the main pane. The image ships with a small set of default subscriptions so you have content to read straight away.

Step 9 - Subscribe to a feed

Select the + (subscribe) control at the top of the sidebar, paste a site or feed URL, and FreshRSS discovers the feed and adds it. You can organise feeds into categories, and import an existing collection from another reader as an OPML file from Settings then Import / export.

Step 10 - Configure FreshRSS and connect mobile apps

Open Settings (the cog icon) to control refresh frequency, reading behaviour, themes, sharing, and user accounts. FreshRSS refreshes feeds automatically; you can also add extra user accounts for a shared household or team instance.

To read on the go, point a compatible mobile or desktop app (for example Reeder, Fluent Reader, FeedMe or NetNewsWire) at this instance. Under Settings then Profile enable the API and confirm the API password, then in your app choose the Google Reader API or Fever API and use these endpoints with the admin username and the API password from Step 5:

Google Reader API:  http://<vm-public-ip>/api/greader.php
Fever API:          http://<vm-public-ip>/api/fever.php

Step 11 - Confirm your data lives on the dedicated disk

All FreshRSS data lives under /var/lib/freshrss, which is a dedicated Azure data disk captured into the image and re provisioned on every VM. It holds the SQLite database, the per user configuration, the feed cache and favicons:

df -h /var/lib/freshrss | tail -1
ls /var/lib/freshrss
findmnt -no SOURCE,TARGET,FSTYPE /var/lib/freshrss

Maintenance

• Back up your data: a backup is a copy of /var/lib/freshrss (the SQLite database, per user config, cache and favicons). Snapshot the data disk or tar the directory. FreshRSS also ships ./cli/db-backup.php for database only exports.
• Add users: sign in as admin and use the user management screen under Settings, or run sudo -u www-data php /var/www/freshrss/cli/create-user.php --user <name> --password <pw> on the VM.
• Refresh feeds: FreshRSS refreshes feeds on a schedule. Force a refresh for a user with sudo -u www-data php /var/www/freshrss/cli/actualize-user.php --user admin.
• Mobile and desktop apps: connect over the Google Reader or Fever API endpoints shown in Step 10 with the admin user and the API password.
• Security updates: unattended security upgrades are enabled, so the OS keeps itself patched. Reboot when a new kernel is installed.
• TLS: for production, front FreshRSS with your own domain and a TLS terminating reverse proxy or Azure Application Gateway.

Support

cloudimg provides 24/7/365 expert technical support for this image. Contact support@cloudimg.co.uk. FreshRSS is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). This image is provided by cloudimg; additional charges apply for build, maintenance and 24/7 support.