Getting ready to turn off Google Reader

On the eve of July 1, the day when the most convenient, in my opinion, reader of rss feeds will be disconnected, I was puzzled by the choice of alternative. And given Google’s habit of turning off services that seemed to be a success, my choice was rather on the side of relatively independent decisions. I didn’t want to entrust the storage of my feeds to anyone other than Google, you never know what would happen to some effective Internet manager. In addition, I really wanted to also help friends who also used the google reader and just as I watchfully wait for its end. I will not dwell on the options that have arisen before me - this has already been written enough by others.
My choice fell on Tiny Tiny RSS - tt-rss.org/redmine/projects/tt-rss/wiki .

As written on the site tt-rss,

Tiny Tiny RSS is an open source aggregator and RSS / Atom feed reader designed to allow you to read news from anywhere with a feeling as close as possible to a real application on a computer.

. From which it follows that it is characterized by several requirements - the presence of either VPS (virtual private server), or hosting with php (with certain reservations) and the base of either mysql or postgre. Options, where to deploy it - the mass, ranging from any suitable hosting to Amazon EC2. However, for some reason, I already had a suitable option - a separate OpenVZ container for Proxmox (www.proxmox.com/) running on a server rented from Hetzner Online AG (www.hetzner.de/). Proxmox is an open source virtualization platform based on KVM and OpenVZ. I will not dwell on these technologies, as well as on the data center itself in the framework of this article - a lot has already been written about this.
So, I had an additional public IPv4 address, a server with Proxmox and some free time.
The first thing I did was create an OpenVZ container from a ready-made Debian template using the Proxmox web interface. Click “Create CT”, select the node, the number of the future virtual machine, its hostname, resource pool and root password, then select the template, in my case it is debian-6.0-standard_6.0-6_amd64.tar.gz, click “next” , we allocate resources for the container, in my case it’s 512 RAM, 512 swap, 1 processor and 8GB of space (this shouldn’t be a problem later - the size of the disk image changes very easily and quickly).
In the properties of the container, in the “Network” tab, we change the venet of the virtual network device ip-address to our public or, if necessary, i.e. we need a separate MAC address - we create a veth, virtual Ethernet device. In my case - one poppy will be enough.
All the same can be done from the console, using vzctl, hands and brain, but I am more accustomed to that .
It is more convenient to do further from the console of a Proxmox host.
We enter the virtual machine console - vzctl enter CTID , where CTID is the number of our container.
We configure the login to the machine via ssh, preferably by keys, and not with a password - I will not stop at this either, the topic has been exhausted as a whole.
Disconnect and go to the machine as a separate host. Raise the firewall, giving the opportunity to access the machine via ssh, http, https (for the future) and the update tt-rss daemon to update feeds without restrictions.
I am not an expert at iptables, but based on different articles I made the following script to run:

 #!/bin/sh #/etc/init.d/fw case "$1" in start) echo "Starting iptables" # Flushing all rules iptables -F # Setting default filter policy iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #ssh iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT # Allow unlimited traffic on loopback iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT #Allow outbound DNS iptables -A OUTPUT -p udp --dport 53 -j ACCEPT iptables -A INPUT -p udp --sport 53 -j ACCEPT #ping from iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT #http,https iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A OUTPUT -p tcp --sport 80 -j ACCEPT iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT iptables -A INPUT -p tcp --sport 80 --dport 1024:65535 -j ACCEPT iptables -A INPUT -p tcp --sport 443 --dport 1024:65535 -j ACCEPT #logging iptables -N LOGGING iptables -A INPUT -j LOGGING iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7 iptables -A LOGGING -j DROP # make sure nothing comes or goes out of this box iptables -A INPUT -j DROP iptables -A OUTPUT -j DROP ;; stop) echo "Stopping iptables" 

For autorun at system startup - update-rc.d fw defaults

Because Tiny Tiny RSS currently resides in debian unstable repositories, we need to add deb ftp.debian.org/debian unstable main contrib deb ftp.debian.org/debian unstable main contrib in /etc/apt/sources.list and create /etc/apt/apt.conf with the contents of APT::Default-Release "stable"; so that priority is still in the stable repositories.
Then update debian - aptitude update , then aptitude upgrade .
Lighttpd will be your web server, mysql will be your database. aptitude install lighttpd mysql-server php5-mysql . In theory, when installing tt-rss, dependencies will be pulled up, but in my case there was apache2 that I did not need.
Then aptitude install tt-rss and follow the installer’s instructions.
We edit /etc/tt-rss/config.php, where in this case it is enough to change SELF_URL_PATH to the server address or name, if you have your own domain. We /etc/init.d/tt-rss start and can go to the address of the server / tt-rss / for further configuration.
In wiki tt-rss it is recommended to install a php accelerator - php-apc or another similar, this is done very simply, however, to be honest, I didn’t notice a huge difference. Perhaps because he did it almost immediately.
Having started a user or, in my case, several, you can import feeds from Google Reader.
Export using google takeout is described in detail in many articles, for example mydebianblog.blogspot.ru/2013/03/google-reader.html
And by the way, gritttt-rss gritttt-rss.nicolashoening.de will help you import the received shared.json and starred.json from a google- roader.
It is also worth noting the presence of quite working and convenient clients for tt-rss in the Android Market, one of which is completely free. For the client to work, you must enable the external API in the tt-rss user settings.

I do not pretend to fully disclose the topic, just sharing my experience. I would be glad if there were clarifications, comments and criticism.
')
upd: As an add-on: another tt-rss update was released - 1.7.6, errors were fixed, the installer was simplified, the embedded mobile web application was added back as a plug-in.

upd2: As for downloading pages in case the rss feed of any site contains only headers and a link to the original article on another site - tt-rss.org/forum/viewtopic.php?f=8&t=327 . A very typical example is Hacker News, news.ycombinator.com .
This functionality will not be and the developer rightly answers why: “If the content owner wants you to follow the link to his site, then you should do so. The problem is not so much ethical, but how much is functional - i.e. This functionality is beyond the scope of the RSS reader. ”
Plus, the security problem that occurs when pumping. It is a pity of course, to be honest.

upd3: Once again about downloading pages - there is an embed_original plugin, it turns on when viewing a particular note, for example, hacker news - it works.