yarr - Self-Hosted RSS and Atom Feed Reader

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

yarr (yet another rss reader) is a fast, lightweight, self-hosted RSS and Atom feed reader and aggregator built as a single Go binary with an embedded web interface and SQLite database. It starts in seconds, requires no external database, and keeps your reading history entirely on infrastructure you control. Subscribe to any website's feed, organise subscriptions into folders, and read articles in a clean, distraction-free reading view with unread tracking, full-text search, a built-in readability mode, and OPML import and export. A system-based light and dark theme follows your browser preference.

This AMI delivers yarr fully installed and reverse-proxied behind nginx, so a working, authenticated feed reader is running within minutes of launch with no manual package installation, no dependency troubleshooting, and no proxy configuration required.

## Why This AMI vs Other Options

Compared to a manual install: The image completes every build and hardening step at creation time - fetching the binary, authoring a systemd unit, configuring a reverse proxy, and adding authentication that yarr does not provide natively. You skip all of it.

Compared to database-backed self-hosted readers: yarr has no external database dependency. A single Go binary plus embedded SQLite means fewer moving parts, a smaller attack surface, and lower resource consumption, so it runs comfortably on small instances.

Compared to SaaS feed services: Your subscriptions, reading history, and article content stay entirely within your AWS account. No data leaves your VPC unless you choose to expose the instance.

## Security Hardening

• Network isolation: yarr binds exclusively to the loopback interface; only the nginx reverse proxy is exposed, so authentication cannot be bypassed by reaching the app directly
• Authentication enforced: every request is authenticated at nginx, with an unauthenticated health endpoint provided only for loopback probes
• No default or shared credentials: a cryptographically random admin password is generated on each instance's first boot and written only to a root-only file
• Least privilege: the reader runs as an unprivileged system user with NoNewPrivileges, PrivateTmp, and ProtectSystem set; systemd restarts it on failure

## Populated Out of the Box

The reader arrives pre-populated with self-contained demo feeds served from the image itself, so the interface shows folders, feeds, and articles the moment you sign in. You can evaluate the UI immediately before adding your own subscriptions.

## Concrete Use Cases

• Aggregating vulnerability and vendor feeds: A security or operations team subscribes to many disclosure and vendor feeds, organises them by source and severity, and uses full-text search to surface relevant advisories across all sources without sending data to a third-party platform.
• OPML migration target: Import an existing subscription list exported from another reader and continue reading immediately, with folders and unread state preserved.
• Backend for mobile reading apps: Point a Fever-compatible mobile client at the instance so phones and tablets sync against a private, self-owned feed store.

## Features

Feed subscription with automatic discovery, folder organisation, per-feed and per-folder unread views, full-text search across articles, readability view for clean article extraction, OPML import and export, a Fever-compatible API for third-party mobile apps, and a responsive interface that works on phones as a progressive web app.

## AWS Integration

Deploy on any EC2 instance type. Place the reader in a VPC subnet with security-group control over inbound access, terminate TLS with your own domain and certificate at the nginx layer, and snapshot or resize the dedicated data volume independently of the OS disk using EBS or AWS Backup.

## Getting Started

1. Launch the AMI on your chosen instance type.

2. SSH in and read the generated admin credential from the root-only file indicated in the login banner.

3. Open the web interface in your browser and sign in.

4. Browse the pre-loaded demo feeds to explore the UI.

5. Add your own feeds with the plus button in the sidebar, organise them into folders, or import an OPML file to bring existing subscriptions across.

For a guided deployment walkthrough or help with TLS termination and mobile app configuration, contact cloudimg support at any time.

## cloudimg Support

24/7 technical support by email and chat. Help with deployment, TLS termination, credential management, OPML import and export, and connecting Fever-compatible mobile apps.

This is a repackaged open source software product with additional charges for cloudimg support services. yarr is distributed under the MIT license.