Installation

Installation

NewsCache needs a Unix system (it uses fork, signals and user switching). It is built with GNU autoconf and automake, and tested in CI on Ubuntu (x86_64 and ARM64), Debian 13, Fedora 43/44/45, Alpine (musl), FreeBSD and macOS. It also builds on Debian GNU/Hurd (not in CI). On Windows, use WSL 2 or the container image.

After installing, continue with Configuration: the shipped configurations let no client in until you allow one.

Build dependencies

System	Packages
Debian, Ubuntu	build-essential autoconf automake texinfo libgnutls28-dev libpam0g-dev libcrypt-dev
Fedora	gcc-c++ make autoconf automake libtool gnutls-devel pam-devel libxcrypt-devel texinfo (and redhat-rpm-config for Fedora's compiler flags)
Alpine	build-base autoconf automake texinfo gnutls-dev linux-pam-dev
FreeBSD	autoconf automake gmake texinfo gnutls (build with gmake)
macOS (Homebrew)	autoconf automake texinfo gnutls
Debian GNU/Hurd	as for Debian, and install libcrypt-dev yourself: libc0.3-dev doesn't pull it in, and without it the link fails at crypt

• GnuTLS is optional; it is needed for TLS connections to upstream servers and, from 1.3.23, for TLS clients (TLS for Clients).
• PAM is optional (--with-pam).
• texinfo is required: without makeinfo, make stops at the manual.
• Go 1.26 or later is only needed for the end-to-end tests in make check; without it they are skipped (as on the Hurd, which has no Go).

Building

From a release tarball (NewsCache-<version>.tar.gz, which already contains configure):

./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
make
make check          # optional
sudo make install

From a git checkout, run ./autogen first. It runs autoreconf and stops with an error if autoconf, automake or libtool is missing:

git clone https://github.com/go-while/NewsCache.git
cd NewsCache
./autogen
./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
make

Without --prefix or --sysconfdir the configuration file is /usr/local/etc/newscache.conf; packages usually want --prefix=/usr --sysconfdir=/etc. (Up to 1.3.22 a plain configure made the built-in path the literal NONE/etc/newscache.conf.)

configure options

Option	Effect
--with-gnutls / --without-gnutls	TLS to upstream servers and for clients (default: yes, if GnuTLS is found)
--with-pam[=service] / --without-pam	Authentication pam (default: no; PAM service name newscache). --without-pam needs no PAM headers; --with-pam= with an empty name is an error
--with-shadow	shadow password support for Authentication unix (default: auto, on where shadow.h exists)
--with-syslog / --without-syslog	log to syslog (default) or to files in LogDirectory
--with-md5, --with-md5auto	MD5 password hashes in the auth file (default: yes). --without-md5auto checks every stored hash as MD5, so crypt() hashes stop working. (Up to 1.3.22 configure knew only --with-md5_auto, which turned autodetection off.)
--enable-plainpass	plain-text passwords in the auth file
--enable-headerlog	log the headers of posted articles
--with-uniquename	newscacheclean and updatenews log under NewsCache's name (up to 1.3.22 the option had no effect)
--enable-debug	verbose debug logging

./configure --help lists all of them. newscache -o prints the options a binary was built with.

What make install installs

• newscache and newscacheclean in sbin, updatenews in bin
• the manual pages and the info manual (NewsCache.info)
• the samples newscache.conf-dist and newscache.auth-dist in sysconfdir

It installs no configuration, user, service file or spool directory; see below.

User and directories

NewsCache starts as root (to bind port 119), then switches to Username and Groupname from the configuration, usually news. Without Username it keeps running as root and logs a warning. The spool must belong to that user and be on a local file system (NewsCache uses file locks). For builds with --without-syslog, the programs open their log file before they switch, so the log directory needn't be writable for that user when they start as root.

# Fedora / systemd-sysusers; on Debian the user news already exists
echo 'u news - "News user" /var/cache/newscache -' |
    sudo tee /usr/lib/sysusers.d/newscache.conf
sudo systemd-sysusers
sudo install -d -o news -g news -m 755 /var/cache/newscache /var/log/newscache

Running it

systemd

The unit from the Debian package (debian/newscache.service):

[Unit]
Description=NewsCache caching news server
After=network-online.target remote-fs.target
Wants=network-online.target

[Service]
ExecStart=/usr/sbin/newscache -n
ExecReload=/bin/kill -HUP $MAINPID
IgnoreSIGPIPE=false
KillMode=process
Restart=on-failure

[Install]
WantedBy=multi-user.target

-n keeps the daemon in the foreground. systemctl stop sends SIGTERM: the daemon passes it on to its sessions, which send the reply to the command they were running (a post that went to the queue gets its 240), then 400 ... service discontinued, and end within about a second, also while they wait for the upstream server; after the signal they don't retry a command or reconnect to it. systemctl reload newscache re-reads the configuration (SIGHUP); if the new file has an error, the daemon logs it and keeps the old one. After installing a new binary, use systemctl restart. Under systemd no PidFile is needed.

Clean the spool regularly with newscacheclean, for example from a daily timer; see Caching and Large Groups.

inetd

news stream tcp nowait news /usr/sbin/newscache -i

Set ServerType inetd in the configuration. In inetd mode the client is called stdin, so the access list needs a Client stdin entry.

For TLS clients on port 563 (from 1.3.23), newscache -t does the TLS handshake on the socket inetd passes; the client is then matched by its address. See TLS for Clients.

nntps stream tcp nowait root /usr/sbin/newscache -t

Command-line options of newscache

Option	Meaning
-c file	configuration file
-i	inetd mode: serve one client on stdin/stdout
-t	inetd mode with TLS on the passed socket (from 1.3.23; needs TLSCertFile, TLSKeyFile)
-n	no fork: run the daemon in the foreground (systemd, containers)
-d	don't detach (the same as -n)

| -p | print the parsed configuration and exit (passwords hidden) | | -o | print the configure options; it doesn't read the configuration file, so it works when that is missing or broken (up to 1.3.22 it failed then) | | -f | print the fully qualified host name NewsCache uses | | -v | print the version | | -h | print a summary of the options |

The options of newscacheclean and updatenews are on Caching and Large Groups.

Debian and Ubuntu package

There is no official Debian package, but the repository builds one on Debian 13 and Ubuntu 24.04 (from a git checkout; the release tarballs don't contain debian/):

sudo apt-get build-dep ./
dpkg-buildpackage -us -uc -b
sudo apt install ../newscache_*.deb

The package runs NewsCache as news under systemd, cleans the spool with a daily timer (newscacheclean.timer), is built with GnuTLS and PAM, and ships an /etc/newscache.conf that reads from news.blueworldhosting.com over TLS and lets nobody in. See debian/README.Debian.

Fedora

Fedora's own newscache package is still 1.2rc6 from 2004. FEDORA.md shows how to build this version with Fedora's compiler flags and set it up with a sysusers entry, a systemd unit, a cleanup timer, PAM, firewalld and SELinux notes.

Container image (Docker, Podman)

The Dockerfile builds NewsCache on Ubuntu 24.04 and runs it in the foreground as news, logging to the container's output:

docker build -t newscache .
docker run -d --name newscache -p 119:119 \
    -v newscache-spool:/var/cache/newscache newscache
docker logs -f newscache

The built-in configuration (docker/newscache.conf) lets nobody in. Copy it, add a Client entry or a login, and mount it with -v /path/to/newscache.conf:/etc/newscache.conf:ro. Connections forwarded with -p from the host itself arrive from the container network (for example 172.17.0.1 with Docker, 10.88.0.1 with Podman). Purge the spool now and then with docker exec newscache newscacheclean.

The README has more on volumes, DNS problems in containers and Windows: README.md, "In a container".