this post was submitted on 11 Jul 2023
26 points (90.6% liked)

Selfhosted

40246 readers
1014 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
26
Self-hosted lemmy without serving arbitrary federated content? (reddthat.com)
submitted 1 year ago by EthernalExplorer@reddthat.com to c/selfhosted@lemmy.world
22 comments fedilink hide all child comments
 

I want to self-host lemmy and participate in federation. However, I wonder whether it's possible to have a setup where only I, and trusted users, are allowed to browse federated-content.

Basically, guests should not be allowed to use my instance to browse other federated content. So requests to "mydomain.tld/c/whatever@otherdomain.tld" should not be possible. Only users, logged-in on my instance, should be able to do that.

Despite that, guests should be allowed to see posts of communities posted on my instance, and users of other instances should be allowed to comment.

I know I can choose with which other instances mine should link with, but this would make the experience inconvenient to me. Because then I would need to adjust the config if I want to subscribe to a community on an instance I have not yet linked with.

Is such setup possible? Could not find the answer in the docs unfortunately

The only thing I can think of is something like blocking UI requests, and allow them only from localhost (so I would create a "ssh -L" tunnel on the server). Federation API endpoints would not be blocked. But this seems shaky, does Lemmy support a cleaner, built-in solution?

you are viewing a single comment's thread
view the rest of the comments
[–] jcg@halubilo.social 6 points 1 year ago

Anonymous users can't actually lookup other instance communities through yours in the same way logged in users can. They'll only be able to see a remote community if a user who's already been logged in on your instance has searched it up before and/or is subscribed, but they can't just arbitrarily make your instance look up other instance communities.

Then I guess you could configure nginx to not allow /c/ requests that have an @ unless the "jwt" cookie is present and do the same with your search endpoints. Of course, someone could just add an arbitrary jwt cookie to try and bypass it but if the point is more to make the average anon user not waste your server resources I think that should do. Without search and without the communities visible via /c/ everything within it wouldn't be indexed in search results so the only way for them to see a federated post through your instance would be a direct link to one.