trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(infra): enable federation on the flagship (social-federation 12.5)

Browse source 
Wiring follows the IS_FLAGSHIP pattern: the compose env defaults every
FEDERATION_* var to empty (off — the safe self-host default; all
federation surfaces 404), and cd-apps.yml appends
FEDERATION_ENABLED=true + FEDERATION_LOG_LEVEL=info to the flagship's
app.env. FEDERATION_KEY_ENCRYPTION_KEY was already in SOPS.

Rollout 12.2/12.3 soaked on staging against a real Mastodon
(2026-06-06/07); the trails↔trails Accept bug found by the §11 harness
is fixed and deployed. Rollback: drop the two echo lines, merge, rerun
cd-apps — instant off, follow rows persist.

First boot with the flag enqueues backfill-user-keypairs (idempotent)
and registers the federation jobs. Applied via manual cd-apps dispatch
after merge since workflow-file changes don't trigger the path filter.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ullrich Schäfer 2026-06-07 14:46:32 +02:00
parent b7ae8d2aa0
commit f3a17cf78c
3 changed files with 18 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
infrastructure/docker-compose.yml
View file

@ -53,6 +53,15 @@ services:
WAHOO_CLIENT_ID: ${WAHOO_CLIENT_ID:-}
WAHOO_CLIENT_SECRET: ${WAHOO_CLIENT_SECRET:-}
WAHOO_WEBHOOK_TOKEN: ${WAHOO_WEBHOOK_TOKEN:-}
# Federation (ActivityPub, social-federation rollout 12.5). Empty
# = off: every federation surface 404s — the safe self-host
# default. The flagship turns it on via cd-apps.yml (same pattern
# as IS_FLAGSHIP); the encryption key comes from SOPS. Rollback is
# dropping the flag and redeploying — instant, follow rows
# persist. See docs/deployment.md "Federation runbook".
FEDERATION_ENABLED: ${FEDERATION_ENABLED:-}
FEDERATION_KEY_ENCRYPTION_KEY: ${FEDERATION_KEY_ENCRYPTION_KEY:-}
FEDERATION_LOG_LEVEL: ${FEDERATION_LOG_LEVEL:-}
INTEGRATION_SECRET: ${INTEGRATION_SECRET:?INTEGRATION_SECRET must be set in SOPS secrets.app.env}
# Demo-activity-bot. Disabled by default everywhere; flip to "true"
# only in prod. When unset, DEMO_BOT_PERSONA uses the built-in