Fedify: an ActivityPub server framework

🎉 Excited to announce that #Fedify is now on Open Collective! Support the project's development starting at:

• Backer (from $5/mo)
• Supporter (from $25/mo)
• Sponsor (from $100/mo)
• Corporate Sponsor (from $500/mo)
• Custom donations welcome

Your support will help us maintain and improve Fedify. Check it out here:

https://opencollective.com/fedify

#OpenCollective #support #backing #sponsor #donation

Fedify is an #ActivityPub server framework in #TypeScript & #JavaScript. It aims to eliminate the complexity and redundant boilerplate code when building a federated server app, so that you can focus on your business logic and user experience.

The key features it provides currently are:

• Type-safe objects for Activity Vocabulary (including some vendor-specific extensions)
• #WebFinger client and server
• HTTP Signatures & Linked Data Signatures & Object Integrity Proofs
• Middleware for handling webhooks
• #NodeInfo protocol
• #Node.js, #Deno, and #Bun support
• CLI toolchain for testing and debugging

If you're curious, take a look at the #Fedify website! There's comprehensive docs, a demo, a tutorial, example code, and more:

https://fedify.dev/

#Fedify offers robust logging capabilities through integration with LogTape. This feature allows you to easily debug and monitor your Fedify app!

To enable #logging, simply install the @logtape/logtape package and configure it in your app's entry point:

import { configure, getConsoleSink } from "@logtape/logtape";

await configure({
  sinks: { console: getConsoleSink() },
  filters: {},
  loggers: [
    { category: "your-app", sinks: ["console"], level: "debug" },
    { category: "fedify",   sinks: ["console"], level: "info" },
  ],
});

Fedify uses hierarchical categories for fine-grained control over log output. Key categories include ["fedify", "federation", "http"] for HTTP requests/responses and ["fedify", "federation", "inbox"]/["fedify", "federation", "outbox"] for incoming/outgoing activities. (There are more categories.)

With #LogTape integration, you gain valuable insights into your Fedify app's behavior, making troubleshooting and optimization much more straightforward!

https://fedify.dev/manual/log

#fedidev

#Fedify's security policy is just written!

https://github.com/dahlia/fedify/security

I want to create good first issues for @fedify, but I don't have a good idea of appropriate tasks for first-time contributors. Any ideas?

#Fedify #fedidev #opensource

Ready to simplify your #fedidev? Check out #Fedify!

• Tutorial
• API reference
• Examples

Join us in building a more connected and decentralized web! 🌐 #ActivityPub

#Fedify also focuses on the practical side of #ActivityPub. Its docs includes guidance on using the vocabulary API in line with de facto norms set by popular implementations like #Mastodon. Build more interoperable apps with less headache! 🤝

Debugging #ActivityPub interactions can be tricky, but #Fedify's got your back! It includes a CLI toolchain for testing and debugging, making development and troubleshooting a breeze. Spend less time scratching your head and more time building awesome features! 🔍

Out of the box, #Fedify comes packed with features crucial for #fediverse development:

• #WebFinger client and server
• HTTP Signatures
• Object Integrity Proofs
• NodeInfo protocol
• No need to reinvent the wheel—Fedify has you covered for core #ActivityPub standards! 📦

Flexibility is key! #Fedify isn't a full-stack solution—it's designed to work alongside your favorite web frameworks. Whether you're using #Astro, #Hono, #Fresh, or others, Fedify has got you covered with easy integration options. Build your #fediverse app, your way! 🛠️

One of #Fedify's strongest features is its type-safe vocabulary objects. These represent the Activity Vocabulary and vendor-specific extensions, ensuring robust and safe code when working with ActivityPub objects and activities. Say goodbye to runtime errors and hello to confident coding! 💪🏼

Introducing #Fedify: A powerful #TypeScript library for building #ActivityPub server apps in the #fediverse! 🚀

Fedify aims to simplify the complex world of federated apps, allowing developers to focus on what matters most—their unique features and user experience. Let's explore what makes Fedify stand out! 🧵

In #Fedify's next release, v0.12.0, we'll be adding support for integration with Astro, a web framework for content-driven websites.

https://unstable.fedify.dev/manual/integration#astro

#Astro #fedidev

We released #Fedify 0.9.2, 0.10.1, and 0.11.1, which patched the last reported #vulnerability, CVE-2024-39687, but the vulnerability of SSRF attacks via DNS rebinding still exists, so we released Fedify 0.9.3, 0.10.2, and 0.11.2, which fixes it.

If you are using an earlier version, please update as soon as possible.

Thanks to @benaryorg for reporting the vulnerability!

#SSRF #security #fedidev

@ml Apparently they (Ghost) have a bug. We'll inform them!

We're releasing @fedify/h3! Now you can integrate #Fedify with h3, an HTTP server framework behind Nitro, Analog, Vinxi, SolidStart, TanStack Start, and other many web frameworks.

https://github.com/dahlia/fedify-h3

#fedidev #h3

@ml What Mastodon client app do you use?

@silverpill Yeah, they apparently missed to wrap it with Image object! See their code:

https://github.com/TryGhost/ActivityPub/blob/c82715db4529f9a71de8853d159ae26d576c385f/src/dispatchers.ts#L40

It should be changed as like below (from @hollo):

https://github.com/dahlia/hollo/blob/7b51666bfdfd6efea511c03cd305432643e423b7/src/federation/index.ts#L86-L88

Woah, #ghost is now live in the #fediverse with @index.

Absolutely outstanding progress! #fedify definitely deserves a great deal of recognition for making this possible. 😎

Feeling like we now have tooling in place to fediverse all things. 😅

looks like there will be lighter-weight alternatives to mastodon, thanks to @fedify — maybe I’ll hack together a simple one? 🙃

Finally, @ghost has open sourced their #ActivityPub implementation powered by #Fedify! For Fedify users, this means another production-grade example code.

If you'd like to follow updates on #Ghost's ActivityPub implementation, you can do so by following @index!

https://github.com/TryGhost/ActivityPub

#fedidev

Two big pieces of news in Ghost's progress on ActivtyPub integration:

1. You can now follow their newsletter from the Fediverse at this address: @index
2. They've open sourced their ActivityPub work!

We're many steps closer to being able to follow Ghost newsletters on the #Fediverse rather than cluttering up your email inbox 🙏🏻

https://activitypub.ghost.org/lets-fix-it-in-production/?ref=build-log-newsletter

@fedify users of Fedify still need to keep potential for SSRF in mind when requesting any URLs in Activities/Objects not through these APIs, e.g., when downloading media from a remote server for caching

I was planning to play around with #fedify but got sidetracked into learning #deno #fresh #preact #tailwindcss ...

To #Hollo users: please update your #Hollo to 0.1.0-dev.46, a #security patch which addresses @fedify's #vulnerability CVE-2024-39687, as soon as possible!

https://hollo.social/@fedify/019080c7-c784-755d-a6f2-d1f91f2c5709

To #Fedify users: please update your Fedify as soon as possible!

https://hollo.social/@fedify/019080c7-c784-755d-a6f2-d1f91f2c5709

CVE-2024-39687, a vulnerability that could potentially allow a Server Side Request Forgery (SSRF) attack, was discovered in #Fedify and a security patch has been applied to fix it. The patched versions are 0.9.2, 0.10.1, and 0.11.1, respectively. If you are using an earlier version, please update as soon as possible.

Thanks to @thisismissem for reporting the vulnerability!

Hooray, #Fedify's GitHub repository just hit 300 stars!

I've been using fedify for the last few months and I'm absolutely loving it. It makes it really easy to prototype new ideas.

I jsut wrote a detailed post on my blog about @ghost's #funding for @fedify! (Both English and Korean available.)

https://writings.hongminhee.org/2024/07/ghost-funds-fedify/

#Fedify #fedidev

#Fedify now has a queue for incoming activities and they are automatically retried when they fail. The default retry strategy is good enough (exponential backoff + decorrelated jitter), and it's even fully customizable. Updated also the docs:

https://unstable.fedify.dev/manual/inbox#making-inbox-listeners-non-blocking

You can give it a try by installing 0.12.0-dev.265+cb851932, the latest unstable release:

https://jsr.io/@fedify/fedify@0.12.0-dev.265+cb851932
https://www.npmjs.com/package/@fedify/fedify/v/0.12.0-dev.265

#fedidev #ActivityPub

In the next version of #Fedify, the #RetryPolicy type is introduced to let you fully customize the retry policy of the task queue for incoming and outgoing activities. Of course, you can also simply adjust the parameters of the built-in exponential backoff + decorrelated jitter policy.

#fedidev #ActivityPub