Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →The reliable way to self-host Tiny Tiny RSS (TT-RSS) on a VPS is to run the project’s official Docker Compose stack privately on localhost, then let host-level Nginx terminate HTTPS and reverse-proxy requests to it. Set TTRSS_SELF_URL_PATH to the exact public URL, forward X-Forwarded-Proto, and keep PostgreSQL data in persistent storage before exposing the service.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What you are building
Tiny Tiny RSS is a free, GPLv3-licensed, web-based RSS/Atom reader and aggregator. The project’s recommended deployment method is Docker. Its current Compose example separates the database, application, updater, and web-Nginx services, while a second Nginx instance on the VPS handles the public hostname and TLS.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
The resulting request path is:
- A browser connects to
https://rss.example.comorhttps://rss.example.com/tt-rss/. - Host Nginx accepts ports 80 and 443, manages the certificate, and forwards the request to
127.0.0.1:8280. - The TT-RSS web-Nginx container receives the request and passes it to the app container.
- The app, updater, and PostgreSQL services communicate over the private Docker network.
Only host Nginx is internet-facing. Binding the Compose port to loopback prevents a direct public connection to the container and leaves one clear place to manage TLS, headers, logs, and firewall exposure.
Choose the public URL before installing
TT-RSS builds links and redirects from TTRSS_SELF_URL_PATH. Decide whether it will live at the root of a dedicated hostname or below a path on an existing site, then use that exact URL everywhere.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
| Layout | Public URL | Nginx location | Advantages | Typical failure |
|---|---|---|---|---|
| Dedicated subdomain | https://rss.example.com |
location / |
Shortest URLs and no interaction with other applications’ path rules; a normal certificate for the hostname is sufficient. | A DNS record or server block points elsewhere, so the certificate or proxy is issued for the wrong host. |
| Subpath | https://example.com/tt-rss/ |
location ^~ /tt-rss/ |
Uses an existing hostname and certificate. | The environment URL, location path, and proxy_pass URI differ, producing broken assets, redirects, or login loops. |
For a new installation, a dedicated subdomain is usually the least ambiguous. A subpath works well when the hostname already serves other applications, but every trailing slash and path segment must agree.
VPS prerequisites
- A current Linux VPS with enough resources for Docker, PostgreSQL, and the TT-RSS services.
- Docker Engine and the Docker Compose plugin installed and working for the account that will operate the stack.
- A DNS A or AAAA record pointing your chosen hostname to the VPS.
- Inbound TCP access to ports 80 and 443 for certificate issuance and web traffic. Keep the application port private.
- A modern browser for the web interface.
- A private deployment directory that is not a publicly served web directory.
Use the current Docker installation instructions for your Linux distribution. Verify the installation with docker version and docker compose version before copying the TT-RSS files.
Obtain the official Compose stack
The TT-RSS installation guide supplies the Compose file and its matching .env template. Copy those current files into your private deployment directory rather than reconstructing service definitions from an old blog post. Image names, tags, supported versions, and defaults change as the project evolves.
- Create a directory owned by the account that will run deployments, for example
mkdir -p ~/services/tt-rss, then change into it. - Place the current official Compose file and environment template in that directory.
- Read the comments in the template and retain the service names and volume declarations supplied upstream.
- Protect the environment file because it contains database credentials. Do not commit it to a public Git repository or paste it into support forums.
The official example can use Docker Hub or GitHub Container Registry images. Choose one supported image source and keep its tags consistent across updates; do not mix arbitrary tags copied from different dates.
Configure the environment file
At minimum, set a strong PostgreSQL password, the database name, the database user, the loopback port, and the public URL. The variable names in the official template are authoritative; do not rename them.
Rank #2
- Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
HTTP_PORT=127.0.0.1:8280
TTRSS_SELF_URL_PATH=https://rss.example.com
POSTGRES_PASSWORD=replace-with-a-long-random-secret
POSTGRES_USER=tt-rss
POSTGRES_DB=tt-rssThe values above illustrate the important settings. Keep the exact PostgreSQL variable names and any additional variables present in the current upstream template. If you choose a subpath, use the complete path including its leading segment:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsHTTP_PORT=127.0.0.1:8280
TTRSS_SELF_URL_PATH=https://example.com/tt-rssDo not add a trailing slash to the subpath value unless the current TT-RSS documentation explicitly requires it; the Nginx example below uses a trailing slash in the request location and upstream URI. For a dedicated hostname, the value is simply the HTTPS origin with no extra path.
TTRSS_SELF_URL_PATH is not an internal Docker address. It must be the URL a user enters in a browser, including https and the public path. TT-RSS uses it when generating links, redirects, feed URLs, and other browser-facing addresses.
Start and validate the containers
- From the deployment directory, review the rendered configuration with
docker compose config. Check that the database volume and application volume are present and that the published port is bound to127.0.0.1, not0.0.0.0. - Start the stack in detached mode:
docker compose up -d. - List service state with
docker compose ps. The database, app, updater, and web-Nginx services should be running before you add the public proxy. - Inspect startup output if a service repeatedly restarts:
docker compose logs --tail=200. Resolve database credentials, missing volumes, or image-pull errors before proceeding. - From the VPS itself, confirm that the web service answers on loopback at the port you selected. A successful local response proves that host Nginx has an upstream to reach; it does not yet prove that the public URL or HTTPS settings are correct.
The official stack includes PostgreSQL, an application/FPM service, an updater, and a web-Nginx service. Keep those services on the Compose network; only the web service needs the host port mapping.
Configure host Nginx as the reverse proxy
Install Nginx from your Linux distribution, create a server block for the chosen hostname, and make sure DNS already resolves to the VPS. The proxy must send the original host, client address, and scheme to TT-RSS.
Rank #3
- CanaKit Raspberry Pi 5 Essentials Starter Kit
Dedicated subdomain at the root
server {
server_name rss.example.com;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:8280/;
break;
}
}The root layout keeps the upstream URI unchanged. The public URL in the environment file must therefore be https://rss.example.com.
TT-RSS below /tt-rss/
server {
server_name example.com;
location ^~ /tt-rss/ {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:8280/tt-rss/;
break;
}
}Here the public value is https://example.com/tt-rss. The ^~ modifier gives this location priority over regular-expression locations, which matters on servers that already contain a broad PHP handler. The location and the URI portion of proxy_pass deliberately contain the same path.
After creating the file, test and reload Nginx:
sudo nginx -t
sudo systemctl reload nginxproxy_pass selects the upstream, while each proxy_set_header controls the request metadata sent to it. In particular, X-Forwarded-Proto $scheme tells TT-RSS that the browser used HTTPS even though the hop from Nginx to the container is plain HTTP. Omitting that header commonly causes HTTP links, mixed-content warnings, or redirect loops.
Issue the HTTPS certificate with Certbot
Obtain a certificate only after DNS resolves correctly and the HTTP server block is active. On Ubuntu, the documented Nginx route is the Certbot snap and its Nginx plugin:
sudo snap install --classic certbot
sudo certbot --nginx -d rss.example.comFor a subpath deployment, request the certificate for the hostname that owns the path, such as example.com; certificates cover hostnames, not individual URL paths. The Nginx plugin finds the matching server block, adds TLS directives, and reloads Nginx. Nginx requires an SSL listener plus ssl_certificate and ssl_certificate_key; keep the private key readable by the Nginx master process but inaccessible to untrusted users.
Rank #4
- All-in-One Complete Kit: This SANOOV RPi 5 bundle comes with Raspberry Pi 5 4GB RAM single board, active cooler, durable ABS case and screwdriver. No extra parts needed, ready to use right out of the box for beginners and hobbyists
- Powerful Single Board Computer: Equipped with 4GB RAM and high-performance processor, delivers fast running speed for 4K playback, AI projects, programming and daily computing tasks. SANOOV for raspberry pi 5 4GB is equipped with broadcom 64 quad-core Arm Cortex A76 processor with gigabit ethernet and upgraded with IEEE 802.11ac Wi-Fi, Bluetooth 5.0 dual-band 2.4Ghz and 5Ghz and Power Over Ethernet (POE). Upgrading delivers 2-3 x speed vs Pi 4, redefining the experience
- Efficient Active Cooler: Effectively lowers operating temperature and prevents performance throttling. Runs quietly even under long-time heavy load, ensures stable operation all day long. SANOOV RPi 5 4GB kit offer an active cooler, which combines an aluminium heatsink with a high-performance PWM fan. Active cooler is fully compatible with the Pi OS, which can effectively reduce the temperature of RPi5 and ensure its good performance during long-term high load operation
- Sturdy ABS Protective Case: Well-fitted for Raspberry Pi 5 board, can be secured with 4 screws to effectively protect the Pi 5 motherboard from damage, reserves full access to all ports and buttons. SANOOV uses ABS material to produce the case, which has a softer texture and feel. Meanwhile, SANOOV case adopts a layered design for easy disassembly and installation. (Tip: The Case cannot install M.2 HAT Add on Board and Solid State Drive!)
- Wide Application & Full Compatibility: Seamlessly compatible with official OS and mainstream peripheral accessories for Raspberry Pi 5. Whether you are a beginner, student, electronics hobbyist or professional developer, this all-in-one kit meets your diverse needs. It excels in IoT projects, robotics design, retro gaming devices, home media servers and other DIY creations. Backed by a large global community, you can easily find guides, technical support and shared projects online
Test both the certificate and application URL in a browser after issuance. If the page appears but links begin with http://, revisit all three values together: the HTTPS TTRSS_SELF_URL_PATH, the public Nginx location and proxy_pass path, and X-Forwarded-Proto $scheme.
Persist PostgreSQL and application data
Container filesystems are disposable. The official Compose example declares persistent storage for the PostgreSQL database and TT-RSS application data; keep those volume declarations intact when editing the file.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Use the named or host-mounted volumes from the current upstream Compose file for the
dbandappservices. - Never remove the database volume as part of a routine container recreation.
- Before changing Compose files, verify the volume attachment with
docker compose configand inspect the running containers withdocker compose ps. - Store backups outside the VPS when possible, and periodically test that a backup can be restored to a separate instance.
The upstream example includes an optional backups service. Enable and configure that service according to the current project instructions if you want scheduled database backups. A backup that has never been restored is only an assumption, so perform a test restore before relying on it for an upgrade or a disaster.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Update TT-RSS without losing the database
TT-RSS follows continuous development and recommends staying current with recent Docker images or the main branch. Treat an update as a change-management task rather than an automatic weekly pull.
- Read the current TT-RSS installation and migration notes, especially anything concerning the image tag or PostgreSQL version.
- Confirm that a recent, restorable database backup exists.
- Record the currently running images with
docker compose imagesand review changes to the official Compose file. - Pull the intended images, then recreate the stack using the updated Compose definition. A typical sequence is
docker compose pullfollowed bydocker compose up -d; use the project’s current instructions if they specify a different procedure. - Watch
docker compose psanddocker compose logsuntil the database, app, updater, and web-Nginx services are stable. - Open the public URL, sign in, load a feed, and confirm that background updating still works.
PostgreSQL major versions require special care. Official PostgreSQL containers do not migrate an existing data directory between major versions automatically. Do not change the database image from one major release to another simply because a newer tag exists. Follow the upstream migration procedure, which may require a dump, a new data directory, and an explicit restore.
Best Value
- 【What you Get】You will get 1*Pi 5 8GB Single Board,1*RasTech Case,1*Active Cooler,1*Screwdriver,1*Installation instructions,12-month free warranty, lifetime service, 24-hour prompt and friendly response.
- 【More Connectors】There are two USB 3.0 ports(5Gbps simultaneously) and two USB 2.0 ports, which triple total bandwidth ,support any combination of up to two cameras or displays. Peak SD card performance is doubled through support for the SDR104 high-speed mode. It provides a smooth desktop experience for you. Offer Gigabit Ethernet and a PCIe interface, along with dual-band Wi-Fi and Bluetooth 5.0/BLE wireless capability. The RasTech Pi 5 Kit use the new 27W 5.1V 5A USB-C power connector.
- 【 Support Dual 4Kp60 Display 】Each of the two microHDMI sockets can control a 4K display at 60 Hertz, now support HDR, offering super HD video for media streaming projects. RPi 5 is the first RPi model that comes with a PCI Express port (PCIe 2.0 x1 with 500 MB/s) to attach SSDs (requires separate M.2 HAT).
- 【 Excellent Chips And Applications】Pi 5 is a full-size Pi computer using silicon built in-house at Pi. The RP1 “southbridge” provides the bulk of the I/O capabilities for Pi 5. Pi 5 is more friendly and convenient in the development of Internet of Things, Web development, machine identification, automatic control and other electronic equipment applications and network.
- 【 Faster CPU, Better GPU 】 Pi 5 features a Broadcom BCM2712 64-bit quad-core Arm Cortex-A76 processor running at 2.4GHz, it delivers a 2–3× increase in CPU performance relative to RaspberryPi 4. The 800MHz VideoCore VII GPU is compatible to OpenGL ES 3.1 and Vulkan 1.2, substantial uplift in graphics performance. Pi 5 Offers lightning-fast CPU speed, a PCI Express interface, a Real Time Clock (RTC) and a power button and runs significantly cooler than Pi 4.
Secure the deployment
- Expose only ports 80 and 443 publicly. The TT-RSS port should remain bound to
127.0.0.1:8280(or another loopback port you selected). - Use a long, unique PostgreSQL password and restrict permissions on the environment file.
- Keep Docker, the host operating system, Nginx, and the TT-RSS images updated deliberately.
- Use the HTTPS URL for all browser access; do not publish a second unsecured URL that bypasses the TLS server block.
- Review Nginx and Docker logs after changes so failed authentication, proxy errors, or repeated container restarts are noticed quickly.
Troubleshoot the common failures
502 Bad Gateway
Confirm that the web-Nginx container is running and that host Nginx can reach 127.0.0.1:8280. Check the published port in docker compose ps, then inspect container logs. A port published on a different address or a stopped web service produces the same symptom.
HTTP redirects, mixed content, or a redirect loop
Set TTRSS_SELF_URL_PATH to the public HTTPS URL, not an internal address. Ensure the proxy sends X-Forwarded-Proto $scheme and that the browser is reaching the TLS server block you edited. A stale server block for the same hostname can send requests to the wrong upstream.
Assets fail only under a subpath
Compare the three strings character by character: the public environment URL, the Nginx location, and the URI in proxy_pass. For /tt-rss/, all must represent that same path. Keep the ^~ location if another PHP rule is intercepting requests.
The database appears empty after recreation
Do not assume that recreating containers deleted data. First verify that the original PostgreSQL volume is still attached to the db service and that the database environment values match the volume’s initialization. If the volume was removed, restore from the latest tested backup rather than initializing a new database over the old deployment.
An upgrade fails after changing PostgreSQL
Stop and return to the previous database image only if the data directory remains compatible, then consult the current PostgreSQL migration instructions. A major-version change needs an explicit migration; the official container will not perform it for you.
Certbot cannot validate the hostname
Check DNS from outside the VPS, confirm that inbound port 80 reaches the correct Nginx server block, and remove conflicting DNS records or proxy services. Issue the certificate only after the hostname resolves to this server.
Quick Recap
Operational checklist
- DNS points the selected hostname to the VPS.
- Docker Engine and Compose are installed and return version information.
- The official current Compose file and environment template are stored privately.
HTTP_PORTbinds to loopback, not all interfaces.TTRSS_SELF_URL_PATHexactly matches the HTTPS URL and path users will open.- PostgreSQL credentials are strong and not committed to a public repository.
- The database, app, updater, and web-Nginx services are running.
- Host Nginx forwards Host, client address, and
X-Forwarded-Proto. - The certificate is valid and the browser loads the HTTPS URL without redirects to HTTP.
- Database and application volumes persist across
docker compose up -d. - A backup exists and has been restored successfully in a test environment.
- Every image or PostgreSQL major-version update is reviewed before deployment.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
