Mastodon

Configuration for Mastodon, the federated microblogging platform.

Here we document only a protection against abusive login attempts. If you have detected other abusive patterns, such as aggressive crawling, or federation attacks, please get in touch!

Mastodon doesn't log the IP in its application logs (those of mastodon-web). So we'll need to resort to the logs of the reverse proxy.

It answers to failed login attempts in an uncommon way, but it's still possible to differentiate it from successful logins.

The login form is at /auth/sign_in, and its action is on the same path.

• When the login is successful, it returns a 302 Found to redirect the user to their homepage, or the page they tried to access before encountering the login fence.
• When it is not, it returns... a 200 OK.

A regex for nginx can look like this:

@'^<ip> .* domain.name "POST /auth/sign_in HTTP/..." 200 '

Adjust domain.name according to your domain.

Example:

{
  streams: {
    nginx: {
      cmd: ['...'], // see ./nginx.md
      filters: {
        directus: {
          regex: [
            @'^<ip> .* mastodon.example.com "POST /auth/sign_in HTTP/..." 200 '
          ],
          retry: 6,
          retryperiod: '1h',
          actions: banFor('3h'),
        },
      },
    },
  },
}

This example makes the assumption that a function named banFor is defined. See the ipset example. It also makes the assumption that there is a pattern named ip.