d-u.net/fedi-signup-bot
Watch
2
0
Fork
You've already forked fedi-signup-bot
 0
Code Releases 25 Packages 1 Activity Actions
25 releases 34 tags
  • v3.1.0 e2459dad7f

    v3.1.0 Stable

    david.gabriel released this 2026-09-23 15:34:55 +00:00 | 4 commits to main since this release

    v3.1.0

    • You can now identify the bot in your instance's logs. A new
      user_agent setting in bot.yaml changes the name the bot presents
      with on every call it makes to your Mastodon instances. Out of the box
      it shows the bot name and its current version.
    • Check the running version at any time. The new python bot.py --version command prints the bot's version and exits — handy for
      deployments, updates, and support requests.
    • Every release now carries its version number. The startup log,
      --version, and the default User-Agent all report the real version,
      even from a source checkout — no more "dev".
    • Troubleshooting rate limits is a little easier. When the bot's
      periodic account sweep recovers after a run of failures, it now logs a
      single line saying it is back — an episode in the logs closes visibly
      instead of ending in silence.
    Downloads
  • v3.0.0 e2459dad7f

    v3.0.0 Stable

    david.gabriel released this 2026-09-19 16:41:10 +00:00 | 4 commits to main since this release

    Changes

    • Account state is now checked in one batch per instance. Instead of
      polling every signup individually, the bot reads each instance's
      pending list in a single pass on a fixed schedule. A pile-up of stuck
      signups costs only a few requests per cycle instead of hundreds, and
      an incomplete read can never produce a false verdict. The previous
      per-account polling remains available as an opt-out fallback.
    • The bot paces its own API traffic and backs off cleanly. All calls
      to one instance share a single budget, so a signup wave can no longer
      push the instance into its rate limit on its own. When the instance
      answers with a rate limit, all traffic to it pauses for a cooldown that
      grows until the limit clears, then resumes automatically — and the log
      shows one summary per episode instead of a line per account. Pacing can
      be tuned globally or per instance.
    • Failed moderation actions are retried until they succeed. An
      approve or reject that fails because of rate limiting, a server error,
      or a network blip is stored on disk and retried automatically — across
      restarts — until it succeeds, the account turns out to be gone, or the
      retry cap is reached, at which point the bot raises a loud alert.
      Nothing is silently dropped; pending retries are visible in the web UI
      and their file location is configurable.
    • The web UI gains a third view: System status. A read-only dashboard
      of stuck and failed work — each instance's rate-limit state, every
      signup still waiting for e-mail confirmation (with the time left until
      its deadline), and the pending action retries. While any such signups
      exist, the pending list shows a one-line hint linking to the view.
    • The webhook replay cache location is now configurable in bot.yaml.
      The file that keeps the anti-replay window across restarts can be moved
      to any absolute path; the command-line flag and environment variable
      overrides still win, and an unusable path warns at startup instead of
      blocking.
    • Internal tidy-up, no behaviour change. Dead code removed; config
      validation now flags settings that can never take effect; minor docs
      and example-config fixes.
    Downloads
  • v2.8.1 dda9706b15

    v2.8.1 Stable

    david.gabriel released this 2026-09-16 13:39:06 +00:00 | 5 commits to main since this release

    Changelog

    • Manually deleted signups are now recognised as gone. When a
      moderator rejects or deletes a pending signup directly in Mastodon,
      the bot notices promptly instead of logging repeated "could not reach
      the API" warnings, and removes the review from the queue with the
      usual notice in the Matrix thread.
    • Acting on an already-deleted account no longer reports a bare
      failure.       If the signup was manually rejected or deleted after its
      review card was posted, clicking Accept or Reject now explains that
      the account no longer exists — and for approvals asks you to check
      the admin panel — instead of saying the action failed. The web UI
      shows the same outcome as a one-line note after the click, and real
      failures include the server's error code in the message.
    • Suspended signups are picked up like any other manual action. A
      pending signup that a moderator suspends in Mastodon is removed from
      the queue with a notice, instead of staying listed until it times
      out.
    Downloads
  • v2.8.0 f4e196ff4c

    v2.8.0 Stable

    david.gabriel released this 2026-09-15 12:04:07 +00:00 | 6 commits to main since this release

    Changes

    • Test suite rebuilt on pytest. The in-repo test suite used to verify
      every release was migrated to the standard pytest framework. No behavior
      change — all scenarios are covered exactly as before, with clearer failure
      reports and the ability to re-run individual scenarios.
    Downloads
  • v2.7.1 749c91ba24

    v2.7.1 Stable

    david.gabriel released this 2026-09-14 14:48:37 +00:00 | 8 commits to main since this release

    Changes

    • Behind a reverse proxy, the access log now records the real client.
      When the bot is told to trust a reverse proxy (the trust_proxy option),
      each HTTP request in the access log shows the originating client's address
      instead of the proxy's own, so logs identify who actually connected.
    • Moderation confirmations name who acted. The message posted after an
      account is approved or rejected now includes the moderator (or web-UI
      caller) who performed the action, making it clear from the thread who took
      it.
    Downloads
  • v2.7.0 bffd53df58

    v2.7.0 Stable

    david.gabriel released this 2026-09-14 12:10:53 +00:00 | 9 commits to main since this release

    Changes

    • Pending signups can now survive a restart (opt-in). When enabled, the
      bot remembers every signup that has not yet been reviewed — including ones
      still waiting for their e-mail to be confirmed — across a restart or a
      redeploy. On the next start the review list is repopulated and processing
      picks up where it left off, so no signup is lost and none has to be
      re-triggered by hand.
    • Switch it on however you prefer. Persistence and its storage location
      can be set from the config file, environment variables, or command-line
      options — in that order of precedence. If the configured location does not
      exist or is not writable, the bot refuses to start and tells you exactly
      what is wrong.
    • Off by default. Existing deployments are unaffected unless they opt in;
      current behaviour is unchanged.
    Downloads
  • v2.6.1 2812a64026

    v2.6.1 Stable

    david.gabriel released this 2026-09-10 14:26:13 +00:00 | 10 commits to main since this release

    Changes

    • The "reject + block email domain" setting now uses one name at
      every level of bot.yaml.       It was previously spelled differently for
      the global default than for a per-instance override; both now share a
      single option, so there is one spelling to use and one place to look.
    • Existing configurations keep working. The previous form is still
      recognised and switched over automatically when the bot starts, with a
      note in the log that it has been replaced by the new option.
    Downloads
  • v2.6.0 abf20aa6a0

    v2.6.0 Stable

    david.gabriel released this 2026-09-09 14:27:16 +00:00 | 11 commits to main since this release

    Changes

    • Untrusted signup data is sanitized before it is displayed. Values that
      come from a new account — its username, email domain, and IP address — are
      cleaned before they appear in moderation messages and the web UI, so an
      applicant can no longer use them to change what a moderator sees.
    • Email addresses are no longer written to the logs in plain text. A full
      address is recorded only when PII logging is explicitly switched on;
      otherwise a short fingerprint is used. This now holds for every log line, not
      just most of them.
    • Pending signups survive temporary Mastodon errors. If the bot's
      background check of a pending account hits a one-off failure — a timeout, a
      dropped connection, or a maintenance window — it retries instead of assuming
      the account was rejected, so a legitimate signup is not silently removed and
      moderators are not shown a false reason.
    • The external email-reputation lookup is hardened. The address sent to the
      UserCheck service is validated and encoded before the request is built, the
      same way the IP lookup already works.
    Downloads
  • v2.5.0 9d029d58b4

    v2.5.0 Stable

    david.gabriel released this 2026-09-07 14:30:33 +00:00 | 12 commits to main since this release

    Changes

    • Command-line options. The bot now accepts command-line flags as well as
      bot.yaml and environment variables. Run python bot.py --help for a short
      description of what the bot does and a list of every option.
    • Settings can be set from the command line — for example the config file
      path, the log level (use DEBUG when troubleshooting), whether full email
      addresses are logged, and where the replay cache is stored. A command-line
      option overrides an environment variable, which overrides bot.yaml.
    • Mistyped options are caught. An unknown or invalid flag now stops the bot
      with a clear error instead of being silently ignored, so it no longer starts
      with unintended settings.
    Downloads
  • v2.4.0 18b265d217

    v2.4.0 Stable

    david.gabriel released this 2026-09-07 09:48:36 +00:00 | 13 commits to main since this release

    Changes

    • Config validation at startup. The bot now checks bot.yaml (and its
      environment) before starting and reports every problem at once — missing or
      empty required values, wrong types or out-of-range numbers, misspelled keys
      (with a "did you mean …" hint), unfilled example values, and env-var issues.
    • New python bot.py --check command to validate a config file on its own,
      with no server started and no Matrix login — handy for CI and as a dry run
      before pointing a webhook or reverse proxy at the bot. Add --strict to also
      fail on unknown keys (warnings by default).
    • Code hygiene: stripped leftover internal investigation markers from
      comments, docstrings, test labels, and scenario names across bot.py and
      tests/.
    Downloads