fingerjoin

fingerjoin serves as a WebFinger aggregation proxy in Kubernetes, enabling multiple fediverse applications (e.g., Mastodon) to share a single domain. It handles requests to '/.well-known/webfinger' by forwarding queries to all registered backends—identified via Gateway API HTTPRoute resources annotated with 'fingerjoin.naktis.eu/webfinger: "true"'—and merges their JSON Resource Descriptor (JRD) responses. Backend services are resolved to in-cluster FQDNs using HTTPRoute backendRefs. Requests are sent concurrently (max 10 in-flight, 5-second timeout), with response bodies capped at 256 KiB. Merging prioritizes higher-priority backends: the first subject is retained, properties use the first value per key, aliases are combined and deduplicated, and links are deduplicated by (rel, href). It adheres to RFC 7033 status codes: 200 (at least one success), 404 (all backends unknown), 410 (resource permanently gone), 502 (backend failure without success), and 503 (no backends registered). Additional endpoints include '/healthz' (liveness) and '/readyz' (readiness). Deployed via Helm chart, it requires cluster-wide permissions to watch HTTPRoute resources.