Post by @Linux@planet.moe
littleFedi introducing littleMesh
We've been buried in littleFedi work lately, and there's one piece I want to talk about because it's the one I'm genuinely excited about: littleMesh.
The problem is an old one. Federation assumes you have a domain, a public IP, an open port, a TLS certificate. Fine if you're renting a VPS somewhere. Not fine if your instance lives on a Raspberry Pi in your house, behind CGNAT, with an ISP that will never hand you a real IP address no matter how nicely you ask. Until now, that simply meant no federation for you. Full stop.
littleMesh gets rid of that requirement entirely, without asking you to build any of the infrastructure above.
On first run, your instance generates its own Ed25519 keypair. That key becomes your identity, no domain required, because your instance's address is derived straight from your public key, in the form .mesh.. Then your node opens an outbound connection to a "lighthouse", a small, publicly reachable relay, and registers itself there. Since the connection is outbound, it works from behind any NAT, any CGNAT, with zero port forwarding. The ISP never even notices.
When someone wants to reach you, they ask the lighthouse to open a circuit. The lighthouse introduces both sides, you call back, and it splices the connection together, but it only ever sees encrypted bytes, never your actual traffic.
Once the introduction is made, if you happen to have a reachable address after all, both sides skip the relay and talk directly. If not, the relay just keeps carrying you, quietly, in the background.
And if you already run an instance with a real domain, you can still turn on littleMesh, purely to reach mesh-only instances. Your own identity doesn't change at all.
There will be a default pair of community lighthouses, so you don't even need to find or run your own relay to get started, just say yes during littleFedi init and you're on the mesh.
The fediverse shouldn't require you to be reachable. It should reach you.
@Linux@planet.moe the lighthouses can be self hosted and you can set multiple ones for failover. The first "official" two will share the same suffix, so they're totally swappable.
That works.
As long as someone can take control of their own relay and their own instance, this seems like an interesting idea.
@Linux@planet.moe littleMesh lets a littleFedi instance federate without a public IP address, a
DNS name, or an inbound port: from behind home NAT, behind CGNAT, on a laptop,
on a Pi plugged into a router nobody administers.
It is an additional transport, not a new protocol. ActivityPub, WebFinger, HTTP
Signatures, media fetches and the delivery queue all run over it unchanged.
Two kinds of machine take part:
- a node is an ordinary littleFedi instance that cannot accept incoming
connections; - a lighthouse is a small publicly reachable relay that introduces nodes to
each other and copies encrypted bytes between them. It stores no accounts,
reads no messages, and hosts no identities.
You need at least one lighthouse somewhere. It can be someone else's, a €3 VPS
of your own, or a machine you already run with a public address.
But we're also planning to run two "public" lighthouses and let the "littlefedi init" process to pre-configure them. Going online will really be a matter of seconds - without even needing a reverse proxy.