Selfhosted

39945 readers

470 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago

MODERATORS

Self-hosted lemmy without serving arbitrary federated content? (reddthat.com)

submitted 1 year ago by [email protected] to c/selfhosted

22 comments fedilink hide all child comments

I want to self-host lemmy and participate in federation. However, I wonder whether it's possible to have a setup where only I, and trusted users, are allowed to browse federated-content.

Basically, guests should not be allowed to use my instance to browse other federated content. So requests to "mydomain.tld/c/[email protected]" should not be possible. Only users, logged-in on my instance, should be able to do that.

Despite that, guests should be allowed to see posts of communities posted on my instance, and users of other instances should be allowed to comment.

I know I can choose with which other instances mine should link with, but this would make the experience inconvenient to me. Because then I would need to adjust the config if I want to subscribe to a community on an instance I have not yet linked with.

Is such setup possible? Could not find the answer in the docs unfortunately

The only thing I can think of is something like blocking UI requests, and allow them only from localhost (so I would create a "ssh -L" tunnel on the server). Federation API endpoints would not be blocked. But this seems shaky, does Lemmy support a cleaner, built-in solution?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 1 points 1 year ago (2 children)

Not OP, but I do feel dumb for not thinking of that assuming it would defederate me. Oh well, got a cool domain out of it

[–] [email protected] 5 points 1 year ago* (last edited 1 year ago)

It might. Some mods/instance admins might see your comments, decided to check your instance, and found it suspicious because it's protected behind basic auth and decided to block your instance. You can see in the modlog that people sometimes bans private instance (instance that don't let you see anything unless you're logged in) out of suspicion that they are a source of bots traffics.

A better way is probably to only protect your search page behind basic auth so no one can hook in new communities in your instance.

[–] [email protected] 5 points 1 year ago* (last edited 1 year ago) (1 children)

It would not affect federation as the endpoints are still open. But a word of caution. This only protects the lemmy-ui from being accessed without the basic auth credentials. If someone tries to access your instance via API, it will still work.

[–] [email protected] 2 points 1 year ago

You could also route any calls to /api through authentication. However I am not sure if that can cause any problems. Is there a list of endpoints that need to be reachable for federation to work?