hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
No description
18,380 commits 2 branches 0 tags 251 MiB
Find a file
Lain Soykaf 20354e0aee
 fix(fetcher): require fetched documents to have the fetched id 
The fetcher accepted any document whose id was on the same host as the
fetch URL. Anyone who can place a JSON file on a host, for example
through an upload, could pass it off as another object or actor from
that host.

The id of a fetched document must now be the URL it came from (after
redirects), ignoring a trailing slash, the fragment, the host case and
differences that our URL encoding removes.
If it differs, as for Mastodon's /@user/123 display URLs, we refetch
once from that id, which must be on the same host. The refetch must
not redirect and must match exactly.

Test mocks that served a document under a different URL now serve it
from its own id.

Based on Akkoma 8684964c5 and 940792f8b.
2026-10-27 21:58:41 +04:00
.forgejo comment out stuff 2026-02-18 13:37:10 +01:00
.gitlab
.woodpecker Merge branch 'develop' into audit-mix-audit-report 2026-10-21 19:24:32 +02:00
benchmarks
changelog.d fix(fetcher): require fetched documents to have the fetched id 2026-10-27 21:58:41 +04:00
ci Replace Elixir 1.17 with 1.18 for build unit-testing pipelines 2025-05-24 22:17:38 +02:00
config Merge branch 'audit-mix-audit-report' (#69) into release/2.11 2026-10-22 16:37:08 +04:00
docs fix(federation): do not deliver to instances rejected by SimplePolicy 2026-10-27 12:38:18 +04:00
installation Merge pull request 'OpenRC: Automatically run migrations before starting pleroma' (#7680) from gitlab-mr-iid-4303 into develop 2026-07-29 11:07:32 +00:00
lib fix(fetcher): require fetched documents to have the fetched id 2026-10-27 21:58:41 +04:00
priv feat(oauth): support the profile scope 2026-10-26 12:29:51 +04:00
rel Merge pull request 'OpenRC: Automatically run migrations before starting pleroma' (#7680) from gitlab-mr-iid-4303 into develop 2026-07-29 11:07:32 +00:00
restarter
supplemental/search/fastembed-api
test fix(fetcher): require fetched documents to have the fetched id 2026-10-27 21:58:41 +04:00
tools Woodpecker CI: Update check-changelog script for Woodpecker 2026-03-31 14:32:52 +00:00
.buildpacks
.credo.exs
.dialyzer_ignore.exs
.dockerignore
.formatter.exs
.gitattributes
.gitignore Add spoofing regression tests 2026-04-30 14:31:06 +04:00
.gitlab-ci.yml GitlabCI: Fix. 2025-12-31 11:40:27 +04:00
.mailmap
.rgignore
AGPL-3
CC-BY-4.0
CC-BY-SA-4.0
CHANGELOG.md Prepare 2.11.1 release 2026-10-26 22:02:51 +04:00
COPYING
coveralls.json
docker-entrypoint-e2e.sh Seed E2E admin before API readiness 2026-05-25 16:06:21 +04:00
docker-entrypoint.sh
Dockerfile Bump minimum Elixir version to 1.17. 2026-09-08 22:39:36 +02:00
Dockerfile-e2e Add custom Docker image for FE E2E tests 2026-05-05 21:34:10 +02:00
elixir_buildpack.config
logo-with-name.png Fix missing readme logo 2026-07-26 21:14:29 +02:00
mix.exs Prepare 2.11.1 release 2026-10-26 22:02:51 +04:00
mix.lock Sec: Update hackney to version 4.9.1 2026-10-26 21:52:03 +04:00
Procfile
README.md Fix missing readme logo 2026-07-26 21:14:29 +02:00
SECURITY.md

README.md

About

Pleroma is a microblogging server software that can federate (= exchange messages with) other servers that support ActivityPub. What that means is that you can host a server for yourself or your friends and stay in control of your online identity, but still exchange messages with people on larger servers. Pleroma will federate with all servers that implement ActivityPub, like Friendica, GNU Social, Hubzilla, Mastodon, Misskey, Peertube, and Pixelfed.

Pleroma is written in Elixir and uses PostgresSQL for data storage. It's efficient enough to be ran on low-power devices like Raspberry Pi (though we wouldn't recommend storing the database on the internal SD card ;) but can scale well when ran on more powerful hardware (albeit only single-node for now).

For clients it supports the Mastodon client API with Pleroma extensions (see the API section on https://docs-develop.pleroma.social).

Installation

OTP releases (Recommended)

If you are running Linux (glibc or musl) on x86/arm, the recommended way to install Pleroma is by using OTP releases. OTP releases are as close as you can get to binary releases with Erlang/Elixir. The release is self-contained, and provides everything needed to boot it. The installation instructions are available here.

From Source

If your platform is not supported, or you just want to be able to edit the source code easily, you may install Pleroma from source.

OS/Distro packages

Currently Pleroma is packaged for YunoHost, NixOS, Gentoo through GURU and Archlinux through AUR. You may find more at https://repology.org/project/pleroma/versions.
If you want to package Pleroma for any OS/Distros, we can guide you through the process on our community channels. If you want to change default options in your Pleroma package, please discuss it with us first.

Docker

While we don’t provide docker files, other people have written very good ones. Take a look at https://github.com/angristan/docker-pleroma or https://glitch.sh/sn0w/pleroma-docker.

Raspberry Pi

Community maintained Raspberry Pi image that you can flash and run Pleroma on your Raspberry Pi. Available here https://github.com/guysoft/PleromaPi.

Compilation Troubleshooting

If you ever encounter compilation issues during the updating of Pleroma, you can try these commands and see if they fix things:

  • mix deps.clean --all
  • mix local.rebar
  • mix local.hex
  • rm -r _build

If you are not developing Pleroma, it is better to use the OTP release, which comes with everything precompiled.

Documentation

Community Channels