Federation & Protocol Architecture
Indie in a Box bridges three distinct decentralized paradigms into a unified publishing and reading pipeline: the web-native IndieWeb standards, the actor-model ActivityPub Fediverse, and the flat-file Twtxt & Yarns microblogging format.
01 // IndieWeb Protocols Suite
The IndieWeb architecture centers around personal domain ownership, semantic HTML microformats2, and open REST endpoints:
Micropub (W3C Recommendation)
Enables third-party mobile and web clients (such as Indigenous, Micro.blog, or Quill) to create, update, and delete posts on your server using standard x-www-form-urlencoded, multipart media uploads, or JSON payloads.
Microsub (W3C SocialCG)
Decouples the feed-reading backend from client apps. Indie in a Box acts as your self-hosted Microsub server, managing feed subscriptions, channel categorization, and unread states across all devices.
Webmention (W3C Recommendation)
Modern, decentralized pingback protocol. When you link to another blog, your server pings their Webmention endpoint. When they link to you, your server receives the notification, verifies the source HTML microformats, and presents verified comments.
IndieAuth (W3C Recommendation)
OAuth 2.0 based authentication using your domain as your decentralized identity. Log into third-party IndieWeb applications without passwords or proprietary accounts.
02 // ActivityPub Server & Client Architecture
Indie in a Box implements both Server-to-Server (S2S) federation and Client-to-Server (C2S) ActivityPub protocols:
| ActivityStreams 2.0 Action | Direction | Behavior in Indie in a Box |
|---|---|---|
| Create(Note / Article) | Outbound & Inbound | Delivers new posts to followers across the Fediverse. Inbound notes from followed actors appear in your Microsub reader. |
| Follow / Accept | Outbound & Inbound | Handles remote follow requests automatically, updates local follower collections, and issues cryptographic Accept activities. |
| Like / Announce | Outbound & Inbound | Federated likes (favorites) and announces (boosts/reposts). Displays federated interaction counts on your permalinks. |
| Delete / Tombstone | Outbound & Inbound | When a post is deleted, issues a federated Tombstone activity signed with your private key to purge the remote cache. |
03 // Group Actors & Lemmy Interoperability (FEP-1b12)
Indie in a Box implements Fediverse Enhancement Proposal 1b12 for Group Actors. This allows your publication to function not only as an individual Person Actor, but also as an automated community Group Actor compatible with thread-based federated platforms like Lemmy, Kbin, and Guppe.
{
"@context": [
"https://www.w3.org/ns/activitystreams",
"https://w3id.org/security/v1",
{ "fep": "https://w3id.org/fep/1b12#" }
],
"id": "https://indieinabox.2lp.in/group/garden",
"type": "Group",
"name": "Digital Gardeners Community",
"preferredUsername": "garden",
"inbox": "https://indieinabox.2lp.in/group/garden/inbox",
"outbox": "https://indieinabox.2lp.in/group/garden/outbox"
}04 // 11-Platform Interoperability Matrix
Indie in a Box has been rigorously audited and tested for seamless bidirectional interoperability with 11 major decentralized networks and platforms:
| Platform | Protocols Used | Supported Interactions | Status |
|---|---|---|---|
| Mastodon | ActivityPub, WebFinger, HTTP Signatures | Follow, Boost, Favorite, Reply, Media, Mentions, Bio Tags | 100% VERIFIED |
| Lemmy / Kbin | ActivityPub (Group Actor FEP-1b12) | Post submission to communities, comments, upvotes | 100% VERIFIED |
| Pixelfed | ActivityPub (Image Attachments) | Photo posts, albums, descriptions, federated likes | 100% VERIFIED |
| Misskey / Firefish | ActivityPub, Markdown Extensions | Notes, reactions, emojis, mentions autolinking | 100% VERIFIED |
| PeerTube | ActivityPub (Video Object) | Video embed syndication, comments, author channel link | 100% VERIFIED |
| BookWyrm | ActivityPub (Read Activity) | Reading logs, reviews, progress updates | 100% VERIFIED |
| GoToSocial | ActivityPub (Lightweight S2S) | Strict HTTP Signatures, digest verification, compact payloads | 100% VERIFIED |
| WordPress (IndieWeb) | Webmention, Micropub, IndieAuth | Cross-site comments, facepiles, pingbacks | 100% VERIFIED |
| Micro.blog | Micropub, RSS, Webmention | External publishing, cross-timeline syndication | 100% VERIFIED |
| Twtxt & Yarn | Flat text timeline feeds, Yarns markdown & media | Plaintext microblogging, URI subject mentions (Full Guide →) | 100% VERIFIED |
| Gemini & Gopher | Gemini (Titan), Gopher (RFC 1436) | Native capsule serving, plain text gemtext (.gmi) | 100% VERIFIED |
05 // Cryptographic Security & HTTP Signatures
Every outbound federated HTTP request dispatched by Indie in a Box is signed using modern RFC 9421 / draft-cavage-http-signatures specifications. Inbound requests are strictly verified:
Inbound Verification Pipeline
1. Extracts Signature and Digest headers.
2. Computes SHA-256 payload digest and rejects mismatches.
3. Resolves the remote Actor's public key via HTTPS.
4. Verifies cryptographic signature using OpenSSL.
5. Checks defederation blacklist rules before processing.
Privacy & SSRF Protection
All outbound requests (Webmentions, feed subscriptions, media proxy, and federation) pass through an internal SSRF filter that blocks private LAN IP ranges (RFC 1918, link-local, loopback, and cloud metadata 169.254.169.254).