altq.net (PDS)

Hi there! 👋

If you use PDS Gatekeeper you will want to make this change manually to your /pds/composer.yaml instead of using pdsadmin update. Using pdsadmin update clears out your current compose with the one from the PDS repo. Should be a oneliner change

@baileytownsend.dev/pds-gatekeeper Microservice to bring 2FA to self hosted PDSes

This PDS server now supports two factor authentication via email. You can now activate 2FA in your account settings.

Thanks to tangled.org/@baileytowns... by @baileytownsend.dev

Hint for other PDS admins: When using Postfix as your mail server add ?tls=required at the end of the SMTP URL.

FYI #atproto: To use this new goat tool on the PDS server, create a shell alias like this:

$ alias goat="docker exec -it pds goat"

$ goat --version
goat version v0.1.2-rev-c43d54a

$ goat account --help
NAME:
goat account - commands for auth session and account management
[...]

The fact that the Bluesky PBC retroactively modifies the PLC directory should be given greater importance. Even if it is only a technical formality. #atproto 🚨

Screenshot of the properly escaped and non-functional attempt to trigger an alert via <script> tag.

It does not work, as in this does not trigger an alert box in this "guestbook" on altq.net ->

Script test:

<script>alert('This should not work.')</script>

A tiny scriptlet or web component will do the trick, see the "guestbook" on the altq.net page for inspiration -> github.com/fry69/altq.n...

Grafana dashboard showing billions of records written to the database

Diagram of backfill process

FTR the app-view is up and has been for a few weeks.
Ingesting terabytes of social media data is not trivial.
I've worked to re-implement some experimental work by Divy into rsky-ingester, rsky-backfiller, and rsky-indexer

When it's production ready, it'll move off of staging.blacksky.community

🫡

I'm still in Nuremberg, Germany 📍

Good to know that my datacenter has not moved.

AT service operators and moderation thinkers: I put together an early proposal around infra abuse notices across organizational boundaries.

really looking for feedback on this one, it is bait for counter-proposals and references to prior work!

FYI: Lexicon names are reverse DNS:

The lexicon app.mbdio.uk schema gets looked up via DNS as uk.mbdio.app

Details are here ->

The moment self-hosted PDS with exploitable plugins will become popular, the HTTP request log on servers will gain a few new entries in the top 20 -> fry69.dev/_php_log

Anyone can run a WordPress server, but few can maintain it and most will choose a managed solution for this reason (incl. "trusted" plugins through the hoster/service provider/etc).

Well, I think you cited WordPress as an example in another thread part.

That is fitting in a way, as click & install plugins without further maintenance will lead to similar problems. E.g. compromising PDS and accounts through highjacked or intentionally malicious plugins.

Also stability requirements are high with a PDS. This goes a bit counter to the idea of plugins.

There are not many PDS blacklisted yet, but I guess that will change when those start to become unreliable or malicious on significant scale.

That is probably when "DNSBLs" for PDS will become a thing.

A great idea If this does not lead to unfulfillable expectations.

While resource requirements for running a PDS are almost negligible, availability requirements are those of a web server (with graceful caching through relays/AppViews).

There is a reason why the mentioned status page exists.

Notes for estimating an atproto CAR file size | fry69 • Findings The PDS serves repository exports only through com.atproto.sync.getRepo, which opens the actor’s SQLite DB, instantiates a SqlRepoReader, and streams the CAR via writeCarStream (packages/p...

Here is a gist with how this estimate works -> whtwnd.com/fry69.dev/3m...

Notes for estimating an atproto CAR file size | fry69 • Findings The PDS serves repository exports only through com.atproto.sync.getRepo, which opens the actor’s SQLite DB, instantiates a SqlRepoReader, and streams the CAR via writeCarStream (packages/p...

Here is a gist with how this estimate works -> whtwnd.com/fry69.dev/3m...

Upon popular request, the status page -> altq.net/status.html now shows an estimate for the CAR file size when requesting an archive.

See also this 🧵 -> bsky.app/profile/altq...

altq.net/bin/generate-status.py at main · fry69/altq.net PDS modification for altq.net. Contribute to fry69/altq.net development by creating an account on GitHub.

OpenAI Codex was so nice to analyze the PDS source, come up with a proper/plausible algorithm for a CAR estimate and integrate it into the status script.

It's live -> altq.net/status.html

Code is here -> github.com/fry69/altq.n...

If I'd show the file size of the SQLite it would give a false impression IMHO.

The blob size is pretty much accurate.

GitHub - fry69/altq.net: PDS modification for altq.net PDS modification for altq.net. Contribute to fry69/altq.net development by creating an account on GitHub.

The CAR file size is hard to estimate/compute as the data on disk is a SQLite file, which bloats everything with indexes and is obviously not compressed/optimized.

Otherwise, the code is here -> github.com/fry69/altq.net

👋 from Germany -> altq.net/status.html

GitHub - fry69/aqfile: Upload files to AT Protocol PDS with metadata and checksums Upload files to AT Protocol PDS with metadata and checksums - fry69/aqfile

See here for more details about "net.altq.aqfile" -> github.com/fry69/aqfile

Screenshot of a working "net.altq.file" lexicon schema resolution. URI: at://did:plc:3zxgigfubnv4f47ftmqdsbal/net.altq.aqfile/3m35ufa3rm62d

You must own the mbdscribe.app domain for this to work.

I don't think it is registered yet?

See here for a working custom lexicon schema resolution -> pdsls.dev/at://did:plc...

Publishing ATProto Lexicons - Nick the Sick's blog. Writings, projects and ideas. Publishing ATProto Lexicons Created: 2025_05_07 07:53 Tags: ATProto ATProto has recently updated their specs to include a way to publish Lexicons in a similar way to their handle resolution. This is …

This might help -> nickthesick.com/blog/Publish...

Screenshot of an atproto "app.mbdscribe.record" collection record, which lexicon could not be resolved. Likely due to not being published correctly. URI: at://did:plc:l37td5yhxl2irrzrgvei4qay/app.mbdscribe.record/3m3yciud6y72u

Almost there -> pdsls.dev/at://did:plc...

put out a new 'goat' release (v0.1.2) with basic support for PDS administration ('goat pds admin ...').

if you run it from a PDS instance it should find admin auth info automatically.

hope to have this replace the 'pdsadmin' shell script over time