Upgraded to 4.7 with dash of quadlet magic. Have at it.

https://codeberg.org/darkpixel/Mastodon-Podman-Quadlets

#rootless #quadlets #quadlet #podman #containers #mastodon #sysadmin #mastoadmin #mastodev #deployment

Alt...

A sceenshot of theme split running Mastodon 4.7 using Podman quadlets with no issues.

Is tootctl status remove broken in 4.7 or did it hit a bad db lock or something weird 🤔

#MastoAdmin

After spending an age examining cloud hosting providers that are EU sovereign, I'm currently leaning towards OVHCloud. It'll probably be their public cloud config rather than their VPS, but I'll be sure to test beforehand.

I also looked at Hertzner:
- very cheap, but some concerning reviews and very restrictive TOS that is unsuitable for a social network.

and Scaleway:
- cloud servers are very expensive, VPS servers have no guarantee that you keep you assigned IP4

#MastoAdmin

Mastodon 4.7.0 upgrade done ✅
This requires DB migration... bring some time. #mastoadmin

Hallo? Noch alle da? Da war grade eine kleine Erschütterung der Macht (Macht das Update! ;) )

Was ich sagen sollte: brettspiel.space läuft jetzt auf 4.7.0 *woopwoop*

Im Hintergrund laufen noch ein paar Index-Erstellungen, aber die lasse ich jetzt einfach laufen und segle dann mit der Jackdow nach Nassau ;)

#mastoadmin

v4.7.0

This version introduces very few user-facing changes but substantially reworks Mastodon's internals to increase security, support new protocols, and pave the way for new features. Updating to this version will be required for zero-downtime...

https://github.com/glitch-soc/mastodon/releases/tag/v4.7.0

#glitchsoc #glitch #mastodon #mastoadmin

v4.7.0

This version introduces very few user-facing changes but substantially reworks Mastodon's internals to increase security, support new protocols, and pave the way for new features. Updating to this version will be required for zero-downtime...

https://github.com/mastodon/mastodon/releases/tag/v4.7.0

#mastodon #mastoadmin

Liebe Leute. Unser Server läuft jetzt frisch und fröhlich auf Version 4.7.0.

Bitte frisch und fröhlich weiter tooten.

#AfterSpace #MastoAdmin

We just released Mastodon 4.7.0!

This version contains very few user-facing changes, but significantly reworks the backend code to improve security and support new protocol features.

You can read more about it on our blog: https://blog.joinmastodon.org/2026/08/mastodon-4.7/

Note for admins: the database migrations might take a long time, this is expected (see the release notes).

Release notes and upgrade instructions are available here: https://github.com/mastodon/mastodon/releases/tag/v4.7.0

#mastoadmin

All aboard the Fediverse Express! 🚂

🆕 security_risk_domains.csv

A list of Fediverse domains running software that is at least one year out of date or past its supported lifecycle, and may therefore contain known security vulnerabilities. This includes instances running outdated versions of Misskey, Mastodon, and other Fediverse software.

This list is separate from my other blocklists because these domains are included due to software security concerns, not content or user behavior. 😉

Of course, I have also updated block_spam_scam_users.csv. Your Misskey or Mastodon feed will be so much cleaner and clutter-free once you remove those repeating spam and scam users! 🥳

How to use:

1) Pick a source of your choice.

2) Copy and paste or download the file as a CSV (example, blocks.csv).

3) Upload and merge.

Sources:

GitHub: https://github.com/Fediverse-Express/Fediverse

GitLab: https://gitlab.com/Fediverse-Express/Fediverse

GitFlic: https://gitflic.ru/project/fediverse-express/fediverse

As always, enjoy the Fediverse! 😇

#Mastodon #Misskey #FediAdmin #MastoAdmin #ActivityPub #Fediverse #FediBlock

Whoop. WHoop. Wir sind auf v4.7.0-rc.1

Bitte brav weitertooten.

#AfterSpace #MastoAdmin #ReleaseCandidate

If the UI becomes good enough, there might not be a need for Mastodon Bird UI anymore. However, most likely our instance and the repository for forks will have some way to keep using the "old" one with the Bird UI, if possible.

Or Mastodon Bird UI will just evolve with the changes.

I guess we will see.

#MastodonBirdUI #MastoAdmin #Mastodon

RE: https://mastodon.social/@Mastodon/117117221397911074

"Future-gazing: We're looking at ways to enable custom color schemes, both for end users and for server admins."

👀

#MastoAdmin #Mastodon

AodeRelay boosted

Mastodon » 🌐 2026-08-18
@Mastodon@mastodon.social

After publishing the results of Discovery Week, we can now give you a first sneak peak at Mastodon 5.0, our next big version. It will bring a new visual look to your screens, a refreshed and calmer layout, as well as a new composer.

https://blog.joinmastodon.org/2026/08/5.0-laying-the-foundation/

#mastodon #mastodon5.0

@ClearlyClaire Yes! https://mementomori.social/@rolle/117100130789192093

Second issue one of our user found: when you filter tagged posts for any user, it loads ALL posts every time. For me, it's 30k+ posts, so it takes 20s+... Test it out: https://mementomori.social/@rolle/tagged/MastoAdmin?boosts=1&replies=1

Sorry for not having the time to post issues about these, glad you asked.

#MastoAdmin

toot.io relay service boosted

Rolle Laukkarinen » 🌐 2026-08-15
@rolle@mementomori.social

Last night mementomori.social got a bit slow. Not terrible, but noticeable. Load average hit 26 on 8 cores and page loads took several seconds. The cause was an nginx caching failure I had not run into before, so I am writing it down.

A crawler was hitting us from about 1500 IPs in a Singapore datacenter range. The problem was the requests sent bogus "Authorization: Basic" headers with every request.

Mastodon answers several public API endpoints with "Vary: Authorization". That is correct, since the response differs for logged in and anonymous callers. But nginx honors Vary, so a request carrying an Authorization header is a different cache entry than one without it. On our setup every distinct header value got its own entry. Each crawler request produced a cache key nobody had ever asked for, missed, and went straight through to Puma, uncached. Oof.

This was difficult to spot. Request volume looked normal for a social media server, PostgreSQL was idle, and nothing in the logs screamed "overload, overload!". The cache just stopped working on the busiest endpoints and the app servers took the whole load.

You can check your own instance in a few seconds. First without an Authorization header:

```
curl -sI https://your.instance/api/v1/trends/tags
```

Then the same request with a junk header:

```
curl -sI -H "Authorization: Basic dGVzdDp4" https://your.instance/api/v1/trends/tags
```

X-Cached only appears if you have `add_header X-Cached $upstream_cache_status` in your config, which is worth adding. Otherwise watch Age. I tried this against a few other instances and the pattern holds: without the header you get a cache hit, with it you do not.

The fix is one rule. Mastodon uses OAuth Bearer tokens and federation uses HTTP Signatures. Basic auth is never used, so any Basic header is bogus and can be rejected at the edge for no upstream cost:

```
location @proxy {
if ($http_authorization ~* "^Basic") { return 401; }
...
}
```

Check it before trusting it. Real Bearer tokens still 200, anonymous browsing still 200, POST /inbox still reaches Mastodon, and preview bots (Mastodon, Slack, Discord, Telegram, WhatsApp, facebookexternalhit) all still 200. Load went from 26 to normal (under 6 usually for our busy server) and CPU idle from 1.4 percent to 34 percent.

What actually identified this as automated was not request volume, which looks like normal browsing. In 57 minutes that one range fetched 1722 distinct hashtags. Everyone else on the instance, about a thousand real users plus all federation, fetched 1353. But one IP range went through more hashtags than the entire rest of the server, which is telling.

We now log $upstream_cache_status and $request_time to a separate file, so next time this is a ten second check instead of an hour of guessing.

If your instance feels slow and your database is idle, check your cache hit rate before you scale anything.

#MastoAdmin #SysOp #SysOps #SysAdmin #mementoMoriSocial

RE: https://mementomori.social/@rolle/116733125961481817

This feature is now live and opt-in in settings. Here's how it works: you will see a small "+" icon on the avatars of people you do not follow yet, so you can follow them directly with a simple click. You can find the setting "Show follow buttons on avatars" in your preferences.

#MementomoriSocial #MastoAdmin #Mastodon

Documentation of this feature: https://help.mementomori.social/mementomori.social/instance-features#follow-buttons-on-avatars

#MastoAdmin

Йо, ни у кого из селфхостеров инстанса mastodon-sidekiq не протекал памятью? У меня ласт месяц раз в 1-2 дня утекает за 6гб
аномально...

---

Yo, has anyone who self-hosts a Mastodon instance had memory leaks with sidekiq? For the past month, mine has been leaking over 6GB abnormally every couple of days...

#mastoadmin |

Last night mementomori.social got a bit slow. Not terrible, but noticeable. Load average hit 26 on 8 cores and page loads took several seconds. The cause was an nginx caching failure I had not run into before, so I am writing it down.

A crawler was hitting us from about 1500 IPs in a Singapore datacenter range. The problem was the requests sent bogus "Authorization: Basic" headers with every request.

Mastodon answers several public API endpoints with "Vary: Authorization". That is correct, since the response differs for logged in and anonymous callers. But nginx honors Vary, so a request carrying an Authorization header is a different cache entry than one without it. On our setup every distinct header value got its own entry. Each crawler request produced a cache key nobody had ever asked for, missed, and went straight through to Puma, uncached. Oof.

This was difficult to spot. Request volume looked normal for a social media server, PostgreSQL was idle, and nothing in the logs screamed "overload, overload!". The cache just stopped working on the busiest endpoints and the app servers took the whole load.

You can check your own instance in a few seconds. First without an Authorization header:

```
curl -sI https://your.instance/api/v1/trends/tags
```

Then the same request with a junk header:

```
curl -sI -H "Authorization: Basic dGVzdDp4" https://your.instance/api/v1/trends/tags
```

X-Cached only appears if you have `add_header X-Cached $upstream_cache_status` in your config, which is worth adding. Otherwise watch Age. I tried this against a few other instances and the pattern holds: without the header you get a cache hit, with it you do not.

The fix is one rule. Mastodon uses OAuth Bearer tokens and federation uses HTTP Signatures. Basic auth is never used, so any Basic header is bogus and can be rejected at the edge for no upstream cost:

```
location @proxy {
if ($http_authorization ~* "^Basic") { return 401; }
...
}
```

Check it before trusting it. Real Bearer tokens still 200, anonymous browsing still 200, POST /inbox still reaches Mastodon, and preview bots (Mastodon, Slack, Discord, Telegram, WhatsApp, facebookexternalhit) all still 200. Load went from 26 to normal (under 6 usually for our busy server) and CPU idle from 1.4 percent to 34 percent.

What actually identified this as automated was not request volume, which looks like normal browsing. In 57 minutes that one range fetched 1722 distinct hashtags. Everyone else on the instance, about a thousand real users plus all federation, fetched 1353. But one IP range went through more hashtags than the entire rest of the server, which is telling.

We now log $upstream_cache_status and $request_time to a separate file, so next time this is a ten second check instead of an hour of guessing.

If your instance feels slow and your database is idle, check your cache hit rate before you scale anything.

#MastoAdmin #SysOp #SysOps #SysAdmin #mementoMoriSocial

It is update day. There are lots of migrations this time... like, this is going to take some time with our vCPUs...

#Mastodon #MastoAdmin #MementoMoriSocial

Alt...

Interstellar scene: This little maneuver is gonna cost us 51 years

v4.7.0-rc.1

WarningThis is a pre-release! This has not been as widely tested as regular releases, although it is still tested on mastodon.social and some other servers. If you update to this release, you will not be able to safely downgrade to the existing...

https://github.com/glitch-soc/mastodon/releases/tag/v4.7.0-rc.1

#glitchsoc #glitch #mastodon #mastoadmin

Untungnya penggunaan nama mastodon di subdomain dibolehkan dan sudah diklarifikasi oleh mereka

https://blog.joinmastodon.org/2026/08/sharing-guidelines-about-mastodons-trade-mark-policy/

#mastodon #mastoadmin

v4.7.0-rc.1

WarningThis is a pre-release! This has not been as widely tested as regular releases, although it is still tested on mastodon.social and some other servers. If you update to this release, you will not be able to safely downgrade to the existing...

https://github.com/mastodon/mastodon/releases/tag/v4.7.0-rc.1

#mastodon #mastoadmin

We released the Release Candidate for Mastodon 4.7 today.

It contains very few user-facing changes, but significantly reworks the backend code to improve security and support new protocol features.

We plan to release the final 4.7 version next week, so if you like being on the edge please test this RC and send us your feedback!

The database migrations might take a long time, this is expected.

Release notes and upgrade instructions are available here: https://github.com/mastodon/mastodon/releases/tag/v4.7.0-rc.1

#mastoadmin

RE: https://mastodon.social/@Mastodon/117083691112770390

Extremely disappointed about this.

Some months ago, I had to delete a #Mastodon instance, because it had "Mastodon" in it's domain name and I didn't receive any response from their legal department on my request for MONTHS. Therefore, I had to delete it, all money and time wasted.

If I hadn't delete it and kept it running (illegally), it would have been legal now, because suddenly all servers that existed before 2026-05-13 receive a permission automatically.

#mastoadmin #instanceshutdown

fedicat boosted

Mastodon » 🌐 2026-08-12
@Mastodon@mastodon.social

Today we're sharing additional guidelines about our Trade Mark Policy based on community feedback that we received.

The new guidelines, and more background about these changes, are available on our blog:
https://blog.joinmastodon.org/2026/08/sharing-guidelines-about-mastodons-trade-mark-policy/

#Mastodon #Fediverse #SocialWeb #FediDev #MastoDev #FediAdmin #MastoAdmin

pros of having your fedi handle as an email: its cool
cons of having your fedi handle as an email:

#email #postmaster #fediadmin #mastoadmin

Alt...

A screenshot of an email client. The spam folder contains 2,539 emails.

v4.4.23

NoteWhile we continue to support Mastodon 4.4 and release patches for it, please note that Mastodon 4.6 is available with new features, changes and fixes. We encourage administrators to update to the latest 4.6 version when they...

https://github.com/glitch-soc/mastodon/releases/tag/v4.4.23

#glitchsoc #glitch #mastodon #mastoadmin

I think I have fallen in love with #Ansible.

Upgrading to the latest version of @Mastodon is now as easy as:

ansible-playbook playbooks/30-mastodon-compose.yml -e mastodon_upgrade_apply=true

Which I can run from my phone. While on vacation.

As I have, of course, just done.

#mastoadmin

We just released Mastodon 4.6.6, 4.5.16 and 4.4.23.

They contain minor bug fixes and we advise server administrators to update when they can.

Full release notes and update instructions are available on the GitHub releases page. https://github.com/mastodon/mastodon/releases

#mastoadmin

Today we're sharing additional guidelines about our Trade Mark Policy based on community feedback that we received.

The new guidelines, and more background about these changes, are available on our blog:
https://blog.joinmastodon.org/2026/08/sharing-guidelines-about-mastodons-trade-mark-policy/

#Mastodon #Fediverse #SocialWeb #FediDev #MastoDev #FediAdmin #MastoAdmin

Hey friends, it's me again

We have more news to share today, though I must admit, this news is a little less fun.

Recently, the @Mastodon team received a fair number of questions about our trade mark policy. We realised we could add some guidelines to help make the Policy more clear, so over the last few months, we did just that! I'll post a "plain English" version of the guidelines as a comment.

You can read more background about the changes we made, and see the guidelines themselves, in this blog post:
https://blog.joinmastodon.org/2026/08/sharing-guidelines-about-mastodons-trade-mark-policy/

And the trade mark policy page is updated too:
https://joinmastodon.org/trademark

#Mastodon #Fediverse #MastoAdmin #MastoDev #SocialWeb

We released the first beta for Mastodon 4.7 today. It contains very few user-facing changes, but contains significant reworks of the backend code to improve security and support new protocol features.

This update includes substantial database migrations that might take up to a couple of hours on very large servers, but will not cause downtime if the upgrade instructions are followed.

Release notes and upgrade instructions are available here: https://github.com/mastodon/mastodon/releases/tag/v4.7.0-beta.1

#mastoadmin

For those #Mastoadmin 's that use the Universeodon relay, we've been seeing some issues it seems overnight. I've made some changes to our infrastructure to try to cope with what looks like a huge amount of traffic now. You may need to disable and re-enable the relay if it isn't working on your server.