commit 2201e0e

Add FEDERATION.md

Signed-off-by: Andy Piper <andypiper@ownmail.net>

 1@@ -0,0 +1,65 @@
 2+# Federation
 3+
 4+## Protocols and standards
 5+
 6+- [ActivityPub](https://www.w3.org/TR/activitypub/) (S2S)
 7+- [WebFinger](https://webfinger.net/)
 8+- [HTTP Signatures](https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures).
 9+  - Outgoing requests are RSA-SHA256 signed; incoming requests must verify, including optional `(created)` and `(expires)` components.
10+- [NodeInfo](https://nodeinfo.diaspora.software/)
11+  - 2.0 and 2.1.
12+- [Webmention](https://www.w3.org/TR/webmention/)
13+  - Receive-only. `/webmention-hook` accepts notifications and records them for relevant timelines.
14+
15+## FEP support
16+
17+- [FEP-f1d5: NodeInfo in Fediverse Software](https://codeberg.org/fediverse/fep/src/branch/main/fep/f1d5/fep-f1d5.md)
18+- [FEP-67ff: FEDERATION.md](https://codeberg.org/fediverse/fep/src/branch/main/fep/67ff/fep-67ff.md)
19+
20+## ActivityPub details
21+
22+### Actor discovery
23+
24+- Local actor IDs match `https://<domain>/<user>` and the same URL is persisted as the canonical identifier.
25+- WebFinger exposes `acct:<user>@<domain>` entries using the host-meta template.
26+- `/authorize_interaction` and `/share` endpoints are available.
27+
28+### Collections and endpoints
29+
30+- `GET /<user>` returns the actor document (`application/ld+json`) including inbox/outbox/followers/following/featured collection URLs and the actor's public key.
31+- `GET /<user>/outbox` exposes most recent public posts in `orderedItems`.
32+- `GET /<user>/featured` publishes user's pinned posts collection.
33+- `GET /<user>/followers` and `/following` return empty collections unless the user enables `show_contact_metrics`, in which case only totals are shared.
34+- Individual public objects are available via `/p/<id>`, and their replies collections under `/r/<id>`, with optional paging.
35+- `POST /<user>/inbox` and `/shared-inbox` accept signed JSON objects; shared inbox traffic is queued for the appropriate local recipients.
36+
37+### Supported activities and objects
38+
39+- **Inbound**: `Follow`, `Accept`, `Create`, `Update`, `Delete`, `Announce`, `Like`, `EmojiReact`, `Undo` (for Follow/Like/Announce), and `Move` covering `Note`, `Question`, `Page`, `Article`, `Event`, and `Video`.
40+- **Outbound**: the same set, except for `EmojiReact` (normalised into `Like` internally) and `Create` currently emits `Note` and `Question` objects.
41+- Ordered collections: outboxes present the latest entries; follower/following collections hide membership by default.
42+
43+### Delivery and moderation
44+
45+- Outbound requests are signed over `(request-target) host digest date`; inbound signatures must validate or message is dropped.
46+- `Digest` headers on inbound POSTs are checked; mismatches receive HTTP 400.
47+- Deliveries use a retry queue with parameters `queue_retry_max`, `queue_retry_minutes`, `queue_timeout`, and `queue_timeout_2` in `server.json`.
48+- Messages are rejected if they originate from muted or limited actors, blocked hashtags, or blocked servers.
49+
50+### Audience and account features
51+
52+- Visibility modes include Public, Unlisted, Followers-only, and Direct (addressed only to mentioned accounts). Direct replies retain the mention list.
53+- Users may require follow approvals, hide follower counts, mark accounts as bots, and adjust other publishing preferences.
54+- Account migration emits ActivityPub `Move` messages to followers and follows the new identity when a compliant `Move` is received.
55+
56+### Shared inbox handling
57+
58+- `/shared-inbox` receives the same signature verification, queuing, and moderation treatment as user inboxes.
59+
60+## Additional documentation
61+
62+- Full documentation: <https://comam.es/snac-doc/>
63+  - User manual: `doc/snac.1`
64+  - Data formats: `doc/snac.5`
65+  - Administrator manual: `doc/snac.8`
66+- Release history and other notes: `RELEASE_NOTES.md`