Fedify: ActivityPub server framework

🎉 Excited to announce that #Fedify is now on Open Collective! Support the project's development starting at:

• Backer (from $5/mo)
• Supporter (from $25/mo)
• Sponsor (from $100/mo)
• Corporate Sponsor (from $500/mo)
• Custom donations welcome

Your support will help us maintain and improve Fedify. Check it out here:

https://opencollective.com/fedify

#OpenCollective #support #backing #sponsor #donation

Fedify is an #ActivityPub server framework in #TypeScript & #JavaScript. It aims to eliminate the complexity and redundant boilerplate code when building a federated server app, so that you can focus on your business logic and user experience.

The key features it provides currently are:

• Type-safe objects for Activity Vocabulary (including some vendor-specific extensions)
• #WebFinger client and server
• HTTP Signatures & Linked Data Signatures & Object Integrity Proofs
• Middleware for handling webhooks
• #NodeInfo protocol
• #Node.js, #Deno, and #Bun support
• CLI toolchain for testing and debugging

If you're curious, take a look at the #Fedify website! There's comprehensive docs, a demo, a tutorial, example code, and more:

https://fedify.dev/

#Fedify, an #ActivityPub server framework, has released v0.12.0. It's a minor release in about a month, so there's quite a few changes:

• The fedify command can now also be installed with npm. It can be installed with npm i -g @fedify/cli in Node.js and bun i -g @fedify/cli in Bun.
• Added the fedify init command to help set up a new Fedify project.
• Incoming activities are now also queued and inbox listeners are now processed in the background worker. If you were already queuing outgoing activities, this will just take effect with a simple upgrade to v0.12.0.
• Retry policy for failed tasks processed in the background worker is now customizable and defaults to backoff with decorrelated jitter.
• Added ChatMessage, Move, Read, Travel, View, TentativeAccept, and TentativeReject classes. (Thanks to @moreal!)
• Improved multitenancy (virtual hosting) support: You can now easily determine the host of the current request via the hostname, host, and origin properties of the Context.
• When validating HTTP Signatures and Object Integrity Proofs, once fetched public keys are now cached.

It's available on JSR and npm now, and you can upgrade it using the deno add command on Deno:

deno add @fedify/fedify@^0.12.0

Or using the bun add command on Bun:

bun add @fedify/fedify@^0.12.0

Or using the npm add command on Bun:

npm add @fedify/fedify@^0.12.0

#fedidev

The Astro integration code has been reverted. It will come back in at some point once the blockers are resolved.

Since #Fedify v0.12.0, when verifying HTTP Signatures or Object Integrity Proofs, it will cache the public keys once fetched. It is okay even if a cached key becomes outdated because a verification failure due to a cached key will invalidate the cache and force a verification retry.

This feature is available for preview in v0.12.0-dev.307+235629d5 (JSR or npm).

#fedidev #ActivityPub

Due to the details of the behavior of Astro's middleware, it looks like the next #Fedify release (v0.12.0) may not be able to ship with the #Astro integration. 😅

Working on the `fedify init` command, the project setup wizard for #Fedify…

#fedidev

The fedify command is now available on #npm! You can install it using the following command:

npm install -g @fedify/cli

Or if you use #Bun:

bun install -g @fedify/cli

https://www.npmjs.com/package/@fedify/cli

#Fedify

@admin They are fixed in the unstable docs. For now, could you please use them instead? The stable docs will be fixed in the next release. Thanks!

https://unstable.fedify.dev/manual/federation

finally getting to the #fedify part of my deno-fedify experiment, first thing working is the nodeinfo support

#Fedify offers robust logging capabilities through integration with LogTape. This feature allows you to easily debug and monitor your Fedify app!

To enable #logging, simply install the @logtape/logtape package and configure it in your app's entry point:

import { configure, getConsoleSink } from "@logtape/logtape";

await configure({
  sinks: { console: getConsoleSink() },
  filters: {},
  loggers: [
    { category: "your-app", sinks: ["console"], level: "debug" },
    { category: "fedify",   sinks: ["console"], level: "info" },
  ],
});

Fedify uses hierarchical categories for fine-grained control over log output. Key categories include ["fedify", "federation", "http"] for HTTP requests/responses and ["fedify", "federation", "inbox"]/["fedify", "federation", "outbox"] for incoming/outgoing activities. (There are more categories.)

With #LogTape integration, you gain valuable insights into your Fedify app's behavior, making troubleshooting and optimization much more straightforward!

https://fedify.dev/manual/log

#fedidev

#Fedify's security policy is just written!

https://github.com/dahlia/fedify/security

I want to create good first issues for @fedify, but I don't have a good idea of appropriate tasks for first-time contributors. Any ideas?

#Fedify #fedidev #opensource

Ready to simplify your #fedidev? Check out #Fedify!

• Tutorial
• API reference
• Examples

Join us in building a more connected and decentralized web! 🌐 #ActivityPub

#Fedify also focuses on the practical side of #ActivityPub. Its docs includes guidance on using the vocabulary API in line with de facto norms set by popular implementations like #Mastodon. Build more interoperable apps with less headache! 🤝

Debugging #ActivityPub interactions can be tricky, but #Fedify's got your back! It includes a CLI toolchain for testing and debugging, making development and troubleshooting a breeze. Spend less time scratching your head and more time building awesome features! 🔍

Out of the box, #Fedify comes packed with features crucial for #fediverse development:

• #WebFinger client and server
• HTTP Signatures
• Object Integrity Proofs
• NodeInfo protocol
• No need to reinvent the wheel—Fedify has you covered for core #ActivityPub standards! 📦

Flexibility is key! #Fedify isn't a full-stack solution—it's designed to work alongside your favorite web frameworks. Whether you're using #Astro, #Hono, #Fresh, or others, Fedify has got you covered with easy integration options. Build your #fediverse app, your way! 🛠️

One of #Fedify's strongest features is its type-safe vocabulary objects. These represent the Activity Vocabulary and vendor-specific extensions, ensuring robust and safe code when working with ActivityPub objects and activities. Say goodbye to runtime errors and hello to confident coding! 💪🏼

Introducing #Fedify: A powerful #TypeScript library for building #ActivityPub server apps in the #fediverse! 🚀

Fedify aims to simplify the complex world of federated apps, allowing developers to focus on what matters most—their unique features and user experience. Let's explore what makes Fedify stand out! 🧵

In #Fedify's next release, v0.12.0, we'll be adding support for integration with Astro, a web framework for content-driven websites.

https://unstable.fedify.dev/manual/integration#astro

#Astro #fedidev

We released #Fedify 0.9.2, 0.10.1, and 0.11.1, which patched the last reported #vulnerability, CVE-2024-39687, but the vulnerability of SSRF attacks via DNS rebinding still exists, so we released Fedify 0.9.3, 0.10.2, and 0.11.2, which fixes it.

If you are using an earlier version, please update as soon as possible.

Thanks to @benaryorg for reporting the vulnerability!

#SSRF #security #fedidev

@ml Apparently they (Ghost) have a bug. We'll inform them!

We're releasing @fedify/h3! Now you can integrate #Fedify with h3, an HTTP server framework behind Nitro, Analog, Vinxi, SolidStart, TanStack Start, and other many web frameworks.

https://github.com/dahlia/fedify-h3

#fedidev #h3

@ml What Mastodon client app do you use?

@silverpill Yeah, they apparently missed to wrap it with Image object! See their code:

https://github.com/TryGhost/ActivityPub/blob/c82715db4529f9a71de8853d159ae26d576c385f/src/dispatchers.ts#L40

It should be changed as like below (from @hollo):

https://github.com/dahlia/hollo/blob/7b51666bfdfd6efea511c03cd305432643e423b7/src/federation/index.ts#L86-L88

Woah, #ghost is now live in the #fediverse with @index.

Absolutely outstanding progress! #fedify definitely deserves a great deal of recognition for making this possible. 😎

Feeling like we now have tooling in place to fediverse all things. 😅

looks like there will be lighter-weight alternatives to mastodon, thanks to @fedify — maybe I’ll hack together a simple one? 🙃

Finally, @ghost has open sourced their #ActivityPub implementation powered by #Fedify! For Fedify users, this means another production-grade example code.

If you'd like to follow updates on #Ghost's ActivityPub implementation, you can do so by following @index!

https://github.com/TryGhost/ActivityPub

#fedidev

Two big pieces of news in Ghost's progress on ActivtyPub integration:

1. You can now follow their newsletter from the Fediverse at this address: @index
2. They've open sourced their ActivityPub work!

We're many steps closer to being able to follow Ghost newsletters on the #Fediverse rather than cluttering up your email inbox 🙏🏻

https://activitypub.ghost.org/lets-fix-it-in-production/?ref=build-log-newsletter

@fedify users of Fedify still need to keep potential for SSRF in mind when requesting any URLs in Activities/Objects not through these APIs, e.g., when downloading media from a remote server for caching

I was planning to play around with #fedify but got sidetracked into learning #deno #fresh #preact #tailwindcss ...