RSS — Per-Channel Feed Subscriptions

GrumpyRss subscribes to RSS and Atom feeds and automatically posts new items to a Discord channel, optionally pinging a role.

---

Activation

In configs/config.yml:

addons:
  rss: true   # Default: true

No dedicated configs/modules/rss.yml — the module has no YAML config file. All settings (feeds, channels, ping roles) are stored per feed in the database via /rss add.

---

Security: SSRF Protection

To prevent the bot from being abused to probe internal network addresses (e.g. localhost, private IP ranges, cloud metadata endpoints), GrumpyRss validates every feed URL:

• On subscribe (/rss add): The URL is checked immediately — if it points to an internal/private address, the subscription is rejected (❌ unsafe-url).
• On every poll: The check runs again, including on every redirect hop. A hostname can change in between (DNS rebinding), so a one-time check at subscribe time isn't enough.

What this means for admins: Only publicly reachable http:///https:// feeds work. Feeds on internal servers, VPNs, or with localhost/127.0.0.1/private IPs are reliably blocked — this is intended behavior, not a bug.

---

Poll Behavior & Failure Backoff

• The bot checks all active feeds for new items every 10 minutes.
• First subscription: On a new feed's very first check, the currently newest item is only stored as a baseline reference — nothing is posted. This prevents subscribing to an old, active blog from dumping its entire history into the channel.
• A maximum of 5 new items per feed are posted per tick (oldest first), even if more new items are available — this prevents a message flood after an extended outage.
• Failure backoff: If fetching or parsing a feed fails 10 times in a row (e.g. domain offline, broken SSL certificate, permanently invalid XML), the bot automatically pauses that feed for 24 hours. Once the 24 hours have elapsed, the feed is automatically reactivated and polled normally again — no manual reactivation needed. A single successful fetch immediately resets the failure counter to 0.

---

Commands

All subcommands require the Manage Guild permission.

/rss add <url> [channel] [ping-role]

Subscribes to a new feed.

Option	Required	Description
url	yes	Feed URL (RSS or Atom), must start with http:// or https://
channel	no	Target channel for new items (Text or Announcement) — default: current channel
ping-role	no	Role to ping on new items

/rss add url:https://blog.example.com/feed.xml
/rss add url:https://blog.example.com/feed.xml channel:#news ping-role:@Updates

Limit: maximum 20 feeds per server. A feed can only be subscribed once per server (subscribing the same URL twice → error).

---

/rss remove <id>

Removes a subscription by ID (see /rss list).

/rss remove id:3

---

/rss list

Lists all of the server's feed subscriptions with ID, target channel, URL, and optional ping role.

/rss list

---

Posted Format

New items are posted as an embed:

• Title (linked, if the link is valid)
• Description (HTML tags stripped, truncated to 300 characters)
• Publish date (if present in the feed)
• Optional role ping as text content before the embed

If posting fails (e.g. missing channel permission), the internal progress marker still advances — the bot doesn't retry the same item forever. In that case, admins should check the bot's channel permissions.