# Is federation enabled?

**URL:** <https://forum.codefloe.com/t/is-federation-enabled/180>\
**Category:** Infrastructure\
**Created:** [September 18, 2026, 10:43am UTC](https://forum.codefloe.com/t/is-federation-enabled/180 "2026-09-18T10:43:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mcepl](https://forum.codefloe.com/user_avatar/forum.codefloe.com/mcepl/32/253_2.png) [@mcepl](https://forum.codefloe.com/u/mcepl)\
**Post date:** [September 18, 2026, 10:43am UTC](https://forum.codefloe.com/t/is-federation-enabled/180/1 "2026-09-18T10:43:00Z")

</div>

Is [How To: Federated Stars](https://domaindrivenarchitecture.org/blog/2024-06-05-howto-federated-stars/) enabled?

Thank you for your work!

Matěj

---

<div class="post-metadata">

**Author:** ![jeremyjh](https://forum.codefloe.com/user_avatar/forum.codefloe.com/jeremyjh/32/226_2.png) [@jeremyjh](https://forum.codefloe.com/u/jeremyjh)\
**Post date:** [September 19, 2026, 12:36am UTC](https://forum.codefloe.com/t/is-federation-enabled/180/2 "2026-09-19T00:36:07Z")

</div>

Federation is not ready for production. The documentation advises no one install it on a production domain, because that domain could end up getting permanently burned. Currently Federation offers no usable functionality to end users. A lot of features have merged, but no product has shipped.

> **[What about forge federation? - Forgejo FAQ | Forgejo – Beyond coding. We forge.](https://forgejo.org/faq/#what-about-forge-federation)**
>
> Forgejo (pronounced /forˈd͡ʒe.jo/ (hear an audio sample)) is inspired by forĝejo, the Esperanto word for forge. | Where does the name come from?

 ![image](https://cdn.forum.codefloe.com/original/1X/2bf89162a6501412db02e2a9af8c41b4a593b4fe.png)

---

<div class="post-metadata">

**Author:** ![codefloe](https://forum.codefloe.com/user_avatar/forum.codefloe.com/codefloe/32/42_2.png) [@codefloe](https://forum.codefloe.com/u/codefloe)\
**Post date:** [September 19, 2026, 6:22am UTC](https://forum.codefloe.com/t/is-federation-enabled/180/3 "2026-09-19T06:22:36Z")

</div>

Besides what Jeremy said, there are more active problems:

- An active CVE around federation: [#14271 - bug: Experimental Security Issue: federation activity spoofing via unbound HTTP signature - forgejo/forgejo - Codeberg.org](https://codeberg.org/forgejo/forgejo/issues/14271)
- It publishes new unauthenticated endpoints on a host that open doors to scrapers:
  - . `/.well-known/nodeinfo` and `/.well-known/webfinger` (`routers/web/web.go:641-646`) — webfinger is a username-enumeration oracle
  - `/api/v1/nodeinfo`: instance stats and exact version; with `forgejo_federation_share_user_stats: true` (git.yaml:218) that includes user counts
  - `/api/v1/activitypub/actor{,/inbox,/outbox}`, `/user-id/{id}/…`, `/repository-id/{id}/…` (`routers/api/v1/api.go:582-607`): the instance actor is deliberately fetchable _without_ a signature
  - admin pages `/admin/federation/{hosts,users}`

- Remote parties can make your instance write rows and make outbound requests: A valid inbound `Like` runs `FindOrCreateFederatedUser` → fetches the remote’s `/.well-known/nodeinfo` and actor URL, then creates a federation host + a local federated-user row ([repository\_inbox\_like.go L40](https://forum.codefloe.com/home/agent/.t3/worktrees/infrastructure-as-code/t3code-4847fedb/services/federation/repository_inbox_like.go:40)).

Right now, there are no advantages to enable federation (and the federated star really isn’t worth it), likely also not in the near future. Yet there are a lot of downsides. We’d **love to push federation** , but unfortunately not much has moved in recent years in this area within Forgejo. Not sure if we see any usuable federation capabilities within the next 5 (?) years.  
The fact that Forgejo doesn’t accept AI contributions will make this gap more visible compared to other Forges that also aim for federation capabilities (e.g. radicle or tangled).

---

<div class="post-metadata">

**Author:** ![mcepl](https://forum.codefloe.com/user_avatar/forum.codefloe.com/mcepl/32/253_2.png) [@mcepl](https://forum.codefloe.com/u/mcepl)\
**Post date:** [September 20, 2026, 9:56pm UTC](https://forum.codefloe.com/t/is-federation-enabled/180/4 "2026-09-20T21:56:06Z")

</div>

Thank you, this makes sense.