Applications AWS

RSS-Bridge on AWS User Guide

Last updated: 2026-07-23 | Product: RSS-Bridge on AWS

Overview

This image runs RSS-Bridge, the open source application that generates RSS and Atom feeds for websites that do not publish their own. You pick a bridge from a searchable list, fill in a short form, and RSS-Bridge returns a feed URL you paste into any RSS reader, so you can follow sites, video channels and social accounts in one place again.

RSS-Bridge is pure PHP and stateless: there is no database to run, only a local file cache. nginx answers on port 80 (and 443 once you add TLS) and passes requests to php-fpm over a local socket. The application code lives at /var/www/rss-bridge with index.php at the root, and the file cache lives outside the web root at /var/cache/rss-bridge.

Because RSS-Bridge fetches upstream URLs on the requester's behalf, an unprotected instance can be abused by anyone on the internet as an open feed proxy. This image is hardened for exactly that: the entire interface is placed behind an nginx HTTP Basic Auth gate whose password is generated uniquely and at random on the first boot of every instance, so no shared or default credential ever ships in the image and only you can generate feeds. The password is stored only as a bcrypt hash on the instance, and the plaintext is written to a root-only file. An unauthenticated health endpoint at /healthz is provided for load-balancer probes.

Prerequisites

Before you deploy this image you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and inbound ports 80 and 443 from the networks you will reach RSS-Bridge on
The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Step 1: Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images choose AWS Marketplace AMIs and search for RSS-Bridge. Select the cloudimg listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or another size that suits your workload. Choose your EC2 key pair under Key pair (login). Under Network settings select your VPC and subnet, and either create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks you will use. Leave the root volume at the default size or larger.

Select Launch instance. First boot initialisation takes only a few seconds after the instance state becomes Running and the status checks pass.

Step 2: Launch the Instance from the AWS CLI

The following block launches an instance from the cloudimg RSS-Bridge Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22, 80, and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":20,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=rss-bridge-01}]'

The command prints a JSON document on success. Note the instance ID, then retrieve its public address once it is running with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Step 3: Connect and Retrieve the Basic Auth Password

Connect over SSH with the key pair you selected and the public IP address from step 2. The SSH login user depends on the operating system of the AMI variant you launched:

AMI variant	SSH login user
RSS-Bridge on Ubuntu 24.04	`ubuntu`

ssh -i <key-name>.pem ubuntu@<public-ip>

On the first boot of every instance, a one-shot service generates a unique 24-character Basic Auth password for the user admin, seeds it into the nginx password file as a bcrypt hash, proves the gate works, and records the plaintext to a root-only credentials file. Retrieve it with:

sudo cat /stage/scripts/rss-bridge-credentials.log

The file contains the interface URL, the username admin, and the generated password:

RSS_BRIDGE_URL=http://<public-ip>/
RSS_BRIDGE_USERNAME=admin
RSS_BRIDGE_PASSWORD=<generated-password>

Keep this password safe: it is the credential that unlocks the whole interface and stops anyone else using your instance as a feed proxy.

Step 4: Sign In to the RSS-Bridge Interface

Open http://<public-ip>/ in a browser. Because the entire surface is gated, the browser prompts for a username and password; enter admin and the generated password from step 3. The RSS-Bridge home page shows a search box and the searchable list of available bridges.

You can confirm the gate is working from the command line. Without credentials the interface returns 401, while the health endpoint stays open:

curl -s -o /dev/null -w '%{http_code}\n' http://<public-ip>/          # 401 (gated)
curl -s -o /dev/null -w '%{http_code}\n' http://<public-ip>/healthz   # 200 (open probe)
curl -s -o /dev/null -w '%{http_code}\n' -u admin:<generated-password> http://<public-ip>/   # 200

Step 5: Build a Feed from a Bridge

RSS-Bridge's headline feature is turning any site into a feed. Search for a bridge by name or paste a site URL into the search box, then choose a bridge. The generic bridges - CSS Selector Bridge, XPath Bridge, FeedMerge, FeedReducer and Filter - work against almost any site; popular site-specific bridges (YouTube, Reddit, Mastodon, Bandcamp and others) are enabled too.

The CSS Selector Bridge, for example, converts any page into a feed using CSS selectors. Fill in the home page URL and a selector for the article links, then choose your output format.

RSS-Bridge returns a feed in the format you pick. An Atom feed looks like this - a valid <feed> document with an entry per item, ready to subscribe to in any RSS reader:

Copy the feed URL from your browser's address bar and paste it into your RSS reader. Because the whole surface is password-gated, include the admin credentials in the reader (most readers accept http://admin:<password>@<public-ip>/... or a dedicated username/password field) so it can fetch the feed.

Curated Bridges and Hardening

RSS-Bridge is configured for safety out of the box. Its config.ini.php enables a curated set of bridges rather than all of them, disables debug mode and maintenance mode, and turns off the project's own token advertising. The nginx site is default-deny: every path requires the Basic Auth password except /healthz (a static probe) and a loopback-only self-test fixture used internally. The file cache and configuration are denied to the web.

You can review the enabled bridges and settings:

sudo sed -n '1,40p' /var/www/rss-bridge/config.ini.php

To enable a bridge that is not in the curated list, add an enabled_bridges[] = <BridgeName> line to that file and reload nginx with sudo systemctl reload nginx.

The Application Stack

RSS-Bridge is served by nginx and php-fpm under systemd. Check the services:

systemctl status nginx php8.3-fpm

Both should report active (running). nginx listens on port 80 (and 443 once you configure TLS), and php-fpm runs the PHP front controller over a local unix socket. The health endpoint at /healthz returns 200 without authentication for load-balancer and uptime checks.

Step 6: Add a Domain and HTTPS

For production, put RSS-Bridge behind a domain name and TLS. The simplest route on AWS is to place the instance behind an Application Load Balancer with an AWS Certificate Manager certificate, forwarding HTTPS on 443 to the instance on 80. Alternatively, install a certificate directly on the instance with certbot and the nginx plugin, pointing your domain's DNS A record at the instance's public IP first. Keep the Basic Auth gate in place either way - it is what stops your instance being abused as an open proxy.

Rotating the Password

The Basic Auth password is generated once, on first boot. To rotate it, generate a new bcrypt entry for admin and reload nginx:

sudo htpasswd -B /etc/nginx/.rss-bridge.htpasswd admin   # prompts for <new-password>
sudo systemctl reload nginx

htpasswd prompts for the new password twice and stores only the bcrypt hash. Update any RSS readers that carry the old credential.

Upgrades and Maintenance

The operating system is fully patched at build time and continues to receive unattended security updates. To upgrade RSS-Bridge itself, download a newer release from the RSS-Bridge project, verify it, and replace the contents of /var/www/rss-bridge while preserving your config.ini.php. Always take an EBS snapshot of the instance before upgrading so you can roll back.

Support

cloudimg provides 24/7 technical support for this RSS-Bridge AMI by email at support@cloudimg.co.uk and via live chat. We help with configuration, enabling bridges, custom domains and HTTPS, reverse proxy tuning, upgrades and troubleshooting. Critical issues receive a one hour average response time.