Is federation enabled?

Infrastructure
1

Is How To: Federated Stars enabled?

Thank you for your work!

Matěj

2

Federation is not ready for production. The documentation advises no one install it on a production domain, because that domain could end up getting permanently burned. Currently Federation offers no usable functionality to end users. A lot of features have merged, but no product has shipped.

image
image1392×622 81.5 KB

3

Besides what Jeremy said, there are more active problems:

  • An active CVE around federation: #14271 - bug: Experimental Security Issue: federation activity spoofing via unbound HTTP signature - forgejo/forgejo - Codeberg.org
  • It publishes new unauthenticated endpoints on a host that open doors to scrapers:
    • . /.well-known/nodeinfo and /.well-known/webfinger (routers/web/web.go:641-646) — webfinger is a username-enumeration oracle
    • /api/v1/nodeinfo: instance stats and exact version; with forgejo_federation_share_user_stats: true (git.yaml:218) that includes user counts
    • /api/v1/activitypub/actor{,/inbox,/outbox}, /user-id/{id}/…, /repository-id/{id}/… (routers/api/v1/api.go:582-607): the instance actor is deliberately fetchable without a signature
    • admin pages /admin/federation/{hosts,users}
  • Remote parties can make your instance write rows and make outbound requests: A valid inbound Like runs FindOrCreateFederatedUser → fetches the remote’s /.well-known/nodeinfo and actor URL, then creates a federation host + a local federated-user row (repository_inbox_like.go L40).

Right now, there are no advantages to enable federation (and the federated star really isn’t worth it), likely also not in the near future. Yet there are a lot of downsides. We’d love to push federation, but unfortunately not much has moved in recent years in this area within Forgejo. Not sure if we see any usuable federation capabilities within the next 5 (?) years.
The fact that Forgejo doesn’t accept AI contributions will make this gap more visible compared to other Forges that also aim for federation capabilities (e.g. radicle or tangled).

1 Like
4

Thank you, this makes sense.