FediHome v1.11.0

[TemujinCalidius]

FediHome v1.11.0

Highlights

• Configure your site's appearance & features from the admin panel — no file editing, no restart. A new Site settings screen makes the display/feature config editable in-app: site name & description, the project landing page (on/off + headline/subhead/repo), the public Fediverse feed (on/off + title + hide follower/following lists), which nav sections show, and footer links (webring/badge/funding). Saved values live in the database as overrides on the env defaults — "Use env defaults" reverts — and apply across your site (homepage, nav, footer, /fediverse, RSS, PWA manifest, metadata) within a minute. Identity/secret config (SITE_URL, FEDI_HANDLE, ADMIN_SECRET) stays env-set. Advances the file-editing-free setup (Full first-run setup wizard + in-app admin/config panel (eliminate manual file editing) #59).
• Federation hardening: incoming activities are bound to the actor, not just its host (AP inbox: HTTP-signature verification binds to the actor's host, not the actor (same-host spoofing) #209). The inbox verified an HTTP signature and then only checked the signing key's host against the claimed actor — so any account on the same instance as someone you follow could forge activities as that other account. Verification now binds to the key's true owner and requires an exact actor match. Narrow threat model, but genuine hardening; adds the first dedicated signature-verification unit tests.

Upgrade

npm run update. Additive schema only (nullable SiteSettings columns) — no breaking changes.

Full changelog: the 1.11.0 section of CHANGELOG.md

---

This discussion was created from the release FediHome v1.11.0.