Mastodon has no RBL/DNSBL support — nothing in it consults an outside
list when deciding whether to accept a signup, confirmed against v4.7.1
(the only outbound lookup in that path is EmailMxValidator's MX
resolution, which feeds the local email_domain_blocks table). So a
shared blocklist has to be imported rather than queried live, the same
way Garden Fence and other community lists propagate. These are the
pieces that make ours importable.
- ?format=txt on both per-list endpoints: one entry per line under a '#'
comment header, the form blocklists are traded in and the form a cron
job can consume without a JSON parser. The combined /api/blocks stays
JSON-only — a text rendering would mix CIDRs with domains in one file,
defeating the point. An unrecognised ?format is a 400 rather than a
silent fallback to JSON, and the enabled-gate still runs first so a
disabled deployment 404s either way.
- Access-Control-Allow-Origin: * on blocklist responses, so browser-side
admin tooling can read them. The data is already public.
- bin/yttrx-blocklist-import: standard-library-only importer another
admin can run against their own instance. Dry run unless --apply;
422 from Mastodon counts as "already blocked", not an error.
The importer defaults IP entries to sign_up_requires_approval rather
than the sign_up_block yttrx uses itself. The entries are whole ASN
routes, which suits yttrx because a flagged signup here is nearly always
datacenter/VPN/proxy space — that calibration isn't transferable, so an
importer gets the reviewable severity by default and has to opt into the
hard one.
