/actor retrun 404

[yingziwu]

Recently, my instance, bgme.me, meet problem when federate with the instance that enable secure mood.

After investigation, I found /actor return 404 Not found response, instead of normal 200 response.

$ curl -v "https://bgme.me/actor#main-key" -H "Accept: application/activity+json"
*   Trying 2a01:4f8:c0c:cdc1::1:443...
*   Trying 116.202.187.136:443...
* Connected to bgme.me (2a01:4f8:c0c:cdc1::1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=bgme.me
*  start date: Jan 18 15:56:32 2022 GMT
*  expire date: Apr 18 15:56:31 2022 GMT
*  subjectAltName: host "bgme.me" matched cert's "bgme.me"
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify ok.
* Using HTTP2, server supports multiplexing
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x561b56f45d00)
> GET /actor HTTP/2
> Host: bgme.me
> user-agent: curl/7.81.0
> accept: application/activity+json
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* Connection state changed (MAX_CONCURRENT_STREAMS == 250)!
< HTTP/2 404
< alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
< cache-control: no-cache
< content-type: application/json; charset=utf-8
< permissions-policy: interest-cohort=()
< referrer-policy: same-origin
< server: Caddy
< strict-transport-security: max-age=31536000;
< vary: Accept,Accept-Encoding
< x-content-type-options: nosniff
< x-frame-options: DENY
< x-request-id: dfbe7042-35ba-4aac-befb-1a508fc9c20a
< x-runtime: 0.042852
< x-xss-protection: 0
< date: Mon, 28 Feb 2022 09:22:01 GMT
<
* Connection #0 to host bgme.me left intact
{"error":"Not Found"}%

$ curl -v "https://mastodon.social/actor#main-key" -H "Accept: application/activity+json"
*   Trying 136.243.102.156:443...
* Connected to mastodon.social (136.243.102.156) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=mastodon.social
*  start date: Feb 20 01:09:29 2022 GMT
*  expire date: May 21 01:09:28 2022 GMT
*  subjectAltName: host "mastodon.social" matched cert's "mastodon.social"
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify ok.
* Using HTTP2, server supports multiplexing
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x56397ff38d00)
> GET /actor HTTP/2
> Host: mastodon.social
> user-agent: curl/7.81.0
> accept: application/activity+json
>
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
< HTTP/2 200
< date: Mon, 28 Feb 2022 09:43:46 GMT
< content-type: application/activity+json; charset=utf-8
< server: Mastodon
< x-frame-options: DENY
< x-content-type-options: nosniff
< x-xss-protection: 0
< permissions-policy: interest-cohort=()
< vary: Accept,Accept-Encoding
< cache-control: max-age=600, public
< set-cookie: _mkra_stck=postgres%3A1646041431.7675009; path=/; max-age=10; expires=Mon, 28 Feb 2022 09:43:56 GMT; secure; HttpOnly; SameSite=Lax
< etag: W/"35e0c20c4076f3b51a94f54cb8ab6410"
< x-request-id: a09537c6-ebf8-426a-b0ac-21cef2a594dd
< x-runtime: 0.017672
< strict-transport-security: max-age=63072000; includeSubDomains
< x-cached: EXPIRED
< strict-transport-security: max-age=31536000
<
{"@context":["https://www.w3.org/ns/activitystreams","https://w3id.org/security/v1",{"manuallyApprovesFollowers":"as:manuallyApprovesFollowers","toot":"http://joinmastodon.org/ns#","featured":{"@id":"toot:featured","@type":"@id"},"featuredTags":{"@id":"toot:featuredTags","@type":"@id"},"alsoKnownAs":{"@id":"as:alsoKnownAs","@type":"@id"},"movedTo":{"@id":"as:movedTo","@type":"@id"},"schema":"http://schema.org#","PropertyValue":"schema:PropertyValue","value":"schema:value","discoverable":"toot:discoverable","Device":"toot:Device","Ed25519Signature":"toot:Ed25519Signature","Ed25519Key":"toot:Ed25519Key","Curve25519Key":"toot:Curve25519Key","EncryptedMessage":"toot:EncryptedMessage","publicKeyBase64":"toot:publicKeyBase64","deviceId":"toot:deviceId","claim":{"@type":"@id","@id":"toot:claim"},"fingerprintKey":{"@type":"@id","@id":"toot:fingerprintKey"},"identityKey":{"@type":"@id","@id":"toot:identityKey"},"devices":{"@type":"@id","@id":"toot:devices"},"messageFranking":"toot:messageFranking","messageType":"toot:* Connection #0 to host mastodon.social left intact
messageType","cipherText":"toot:cipherText","suspended":"toot:suspended"}],"id":"https://mastodon.social/actor","type":"Application","inbox":"https://mastodon.social/actor/inbox","outbox":"https://mastodon.social/actor/outbox","preferredUsername":"mastodon.social","url":"https://mastodon.social/about/more?instance_actor=true","manuallyApprovesFollowers":true,"publicKey":{"id":"https://mastodon.social/actor#main-key","owner":"https://mastodon.social/actor","publicKeyPem":"-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxgaTsw2L7KAJVEi2yu/M\nxOTleg9h3GBgi13YhyqaCw20wgSXhvd5C5Q8tMTlv5otUrYOB4CtwpkbD9gcSk3Y\n4wQAGPjmkyp9XvzckRX1FJBm7Z9owNtvcu87OaIO3JZOXH0AB3BO+j5qvDJr9KlT\neY8pbxNRAwegoFomFHWtTNQzrennkmWMbAya4IYwDUsTDHfYRR4MiWfKxhNI2HA8\nrYPRSKfKBHZBGvX+nWzLvL0Km8mCHTGGiKiHB+x6GpFkve49uB3QYRtuYeNqgyNI\n4Mn2/+JB9vJVw1HBiTVV4Gy2lc4NeY4GnrEEMQgeRj6YPm9u42auxApBl31TIs6J\nxQIDAQAB\n-----END PUBLIC KEY-----\n"},"endpoints":{"sharedInbox":"https://mastodon.social/inbox"}}

The log of mastodon-web.service.

-- Journal begins at Sun 2022-02-27 18:28:26 UTC, ends at Mon 2022-02-28 09:24:51 UTC. --
Feb 28 09:22:01 git bundle[573407]: [dfbe7042-35ba-4aac-befb-1a508fc9c20a]   Account Load (2.6ms)  SELECT "accounts"."id", "accounts"."username", "accounts"."domain", "accounts"."private_key", "accounts"."public_key", "accounts"."created_at", "accounts"."updated_at", "accounts"."note", "accounts"."display_name", "accounts"."uri", "accounts"."url", "accounts"."avatar_file_name", "accounts"."avatar_content_type", "accounts"."avatar_file_size", "accounts"."avatar_updated_at", "accounts"."header_file_name", "accounts"."header_content_type", "accounts"."header_file_size", "accounts"."header_updated_at", "accounts"."avatar_remote_url", "accounts"."locked", "accounts"."header_remote_url", "accounts"."last_webfingered_at", "accounts"."inbox_url", "accounts"."outbox_url", "accounts"."shared_inbox_url", "accounts"."followers_url", "accounts"."protocol", "accounts"."memorial", "accounts"."moved_to_account_id", "accounts"."featured_collection_url", "accounts"."fields", "accounts"."actor_type", "accounts"."discoverable", "accounts"."also_known_as", "accounts"."silenced_at", "accounts"."suspended_at", "accounts"."trust_level", "accounts"."hide_collections", "accounts"."avatar_storage_schema_version", "accounts"."header_storage_schema_version", "accounts"."devices_url", "accounts"."sensitized_at", "accounts"."suspension_origin" FROM "accounts" WHERE "accounts"."id" = -99 LIMIT 1
Feb 28 09:22:01 git bundle[573407]: [dfbe7042-35ba-4aac-befb-1a508fc9c20a]   User Load (4.4ms)  SELECT "users"."id", "users"."email", "users"."created_at", "users"."updated_at", "users"."encrypted_password", "users"."reset_password_token", "users"."reset_password_sent_at", "users"."sign_in_count", "users"."current_sign_in_at", "users"."last_sign_in_at", "users"."admin", "users"."confirmation_token", "users"."confirmed_at", "users"."confirmation_sent_at", "users"."unconfirmed_email", "users"."locale", "users"."encrypted_otp_secret", "users"."encrypted_otp_secret_iv", "users"."encrypted_otp_secret_salt", "users"."consumed_timestep", "users"."otp_required_for_login", "users"."last_emailed_at", "users"."otp_backup_codes", "users"."filtered_languages", "users"."account_id", "users"."disabled", "users"."moderator", "users"."invite_id", "users"."chosen_languages", "users"."created_by_application_id", "users"."approved", "users"."sign_in_token", "users"."sign_in_token_sent_at", "users"."webauthn_id", "users"."sign_up_ip", "users"."skip_sign_in_token" FROM "users" WHERE "users"."account_id" = -99 LIMIT 1
Feb 28 09:22:01 git bundle[573407]: [dfbe7042-35ba-4aac-befb-1a508fc9c20a] method=GET path=/actor format=json controller=InstanceActorsController action=show status=404 duration=29.98 view=1.02 db=6.98

I try to run the SQL mentioned by above log. The first SQL return one line and the second SQL return none.

What's wrong with my instance ? And how to fix it ?

[Gargron]

Make sure you have run rails db:seed at least once before

[yingziwu]

After run rails db:seed , the problem still exist.

[ClearlyClaire]

This is a known issue that occurred somewhat briefly in main, introduced in #17385 and fixed in #17457, merge upstream changes or cherry-pick the fix!

[yingziwu]

Thank you very much!