Self-hosted ALTCHA captcha + API sign-up block for Mastodon

Browse Source

Built for anti-social.online 2026-09-17 after a bot-farm registration wave.
Blocks POST /api/v1/accounts entirely (that's what the bot actually used)
and adds a self-hosted proof-of-work captcha to the web sign-up form as a
second layer. See README for deploy steps and the two gotchas that caused
a follow-up outage the same day (wrong widget build variant, and missing
cache-busting on the vendored JS).

...

This commit is contained in:

shadowdao

2026-09-17 16:07:18 -07:00

commit 17bac2ac2f

4 changed files with 483 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

altcha.min.js

Vendored

+1

File diff suppressed because one or more lines are too long