Fediverse => Bluesky: automatic custom domain handles for all users on an instance

[snarfed]

Got an interesting request today: a fediverse instance would like to give all of their users who enable the bridge a custom domain handle on their instance's domain, eg @user@insta.nce would get the username user.insta.nce on their bridged Bluesky account.

Doable! It'd take some work though, and some custom development on the instance's end. Notably, they'd have to get each user's DID from Bridgy Fed and either put it into the corresponding DNS record or serve it over HTTPS on that custom domain.

Related: #1305

[wbz0100]

I would definitely shorten my username if I could!
I'd also like to see .ap.brid.gy removed from existing account usernames.

[snarfed]

I would definitely shorten my username if I could!

You can! https://fed.brid.gy/docs#bluesky-enhanced

[wbz0100]

Uh... I'm not sure I understand, but does this mean that you change the domain of the original account and bridge to the existing account instead of the bot account?

[snarfed]

@wbz0100 maybe this will help: https://bsky.social/about/blog/4-28-2023-domain-handle-tutorial

For Bridgy Fed specifically, it just changes the handle (ie domain ie username) of the bridged Bluesky account. The account itself stays the same.

[shiribailem]

Was looking at these options and I think I have an idea of how to implement this broadly and easily.

It does require some cooperation from whomever is operating the domain and might vary a little based on the webserver they're using, but they could either use reverse proxy (such as via nginx) or a tiny little php stub that takes a call on the HTTPS verification url and just reverse proxies that to the bridge.

So something like:

Then shiri.bsky.foggyminds.com/.well-known/atproto-did will reverse proxy something like bsky.brid.gy/httpsdid/shiri@foggyminds.com to spit out the correct DID for the bridge.

And for the bridge to know what names to use, the DNS could have a TXT record like _bridgyfed.foggyminds.com = bsky.foggyminds.com (telling it that everything @foggyminds.com should be converted to .bsky.foggyminds.com)

This feels like it would be relatively minimal on the side of the bridge, can even be done in parts. The first simplest part alone means that an admin can just tell their users to message the bridge username .bsky.foggyminds.com to switch their names.

No need to try and auto-convert users, but on new connections it can just have an added check to the TXT record. Maybe a dummy account just to test it before doing anything else (ie. it'd call verify_bridgyfed.bsky.foggyminds.com which would ideally reply with a generic proof line).

From there we can easily set up our own wildcard ssl certificates (as well as forwarding web requests to the appropriate bluesky profile page)