Mastodon

Mastodon is a free, open-source, decentralized social network platform built on the ActivityPub protocol. It lets individuals and organizations run their own servers that interoperate seamlessly with thousands of other instances across the Fediverse — a global network where users on different servers can follow, reply to, and share each other’s content without any central authority.

Unlike commercial social networks, Mastodon puts control in the hands of server operators and their communities. Each instance sets its own rules, moderation policies, and content standards. There are no engagement-driven algorithms surfacing content; timelines display posts in strict chronological order, giving every voice equal visibility.

The platform is built with a Ruby on Rails backend for the REST API, PostgreSQL for data persistence, Redis and Sidekiq for background job processing, and a dedicated Node.js streaming server for real-time WebSocket updates. The React 19 and Redux frontend delivers a responsive, single-page experience with full TypeScript coverage and a comprehensive Storybook component library.

Mastodon ships with Docker and docker-compose configurations out of the box and supports deployment on platforms like Heroku, Scalingo, and bare metal via detailed documentation. With over 50,000 GitHub stars, 400+ contributors, and releases published consistently since 2016, it is the most widely adopted implementation of ActivityPub and the cornerstone of the open social web.

What You Get

• ActivityPub Federation - Communicates natively with any platform that implements the W3C ActivityPub standard, enabling cross-server follows, replies, boosts, and likes with Pixelfed, PeerTube, Pleroma, Misskey, and hundreds of other Fediverse projects.
• Real-Time Chronological Timelines - Home, local, and federated timelines update instantly via WebSocket streaming with no ranking algorithm — posts appear in the order they were published.
• Comprehensive Moderation Toolkit - Server admins and moderators get phrase filtering, domain blocks, account suspensions, appeal workflows, report queues, warning presets, and webhook integrations for connecting external moderation systems.
• Rich Media Attachments - Supports images, video, audio, and GIF-like silent video uploads with alt text for accessibility, custom thumbnail selection, content warning overlays, and blurhash placeholder previews while media loads.
• OAuth2 REST and Streaming APIs - Full OAuth2 provider with a documented REST API and Server-Sent Events streaming endpoint, enabling a rich ecosystem of third-party mobile clients, bots, bridges, and integrations.
• Decentralized Identity and Portability - User handles take the form username@server.domain; accounts can be migrated to a different server with follower transfer, preserving identity without lock-in to a single host.
• Notification Policies and Filtering - Fine-grained notification rules let users filter mentions from non-followers, new accounts, or accounts without a profile photo, keeping timelines free from unsolicited contact.
• Quote Posts and Collections - Supports quoting statuses with approval controls and user-curated collections for grouping content, extending standard microblogging with structured curation features.

Common Use Cases

• Hosting a community instance - A technical community spins up a dedicated Mastodon server for its members, applying custom content policies and local-only posting to create a focused, ad-free space while still federating with the broader Fediverse.
• Organization communications channel - A nonprofit or open-source project runs an official Mastodon account on joinmastodon.org or its own instance to publish updates, engage followers, and maintain an authenticated, verifiable presence under their own domain.
• Journalist or creator independence - An independent journalist self-hosts a single-user Mastodon instance to publish long-form threads, share links, and build an audience without depending on a platform that can deplatform or demote content.
• Federated developer community - A software company deploys Mastodon for its developer relations team, using the REST API to auto-post release announcements, changelog entries, and blog links directly from CI/CD pipelines.
• Academic or institutional network - A university establishes a Mastodon instance for faculty and researchers to share findings, discuss publications, and engage with the global academic Fediverse through verified institutional accounts.
• Privacy-first social presence - A privacy-conscious user migrates away from commercial platforms by self-hosting a personal Mastodon instance, retaining full ownership of their data with no third-party data collection or advertising targeting.

Under The Hood

Architecture Mastodon follows a layered Rails monolith pattern where business logic is encapsulated in a service-object layer — discrete *Service classes handle every significant domain operation such as posting statuses, processing incoming ActivityPub payloads, fan-out delivery to followers, and account migrations. Controllers remain thin, delegating to services and serializers. A separate Node.js streaming server handles real-time WebSocket and Server-Sent Events connections, cleanly decoupling persistent connection management from the Rails request cycle. Sidekiq workers with multiple named queues handle asynchronous processing, including federation delivery, notification dispatch, and media processing. The architecture scales horizontally by adding web, Sidekiq, and streaming processes independently, a deliberate design decision that enables large instances serving hundreds of thousands of users.

Tech Stack The backend runs on Ruby on Rails 8.1 with Ruby 4.x, using ActiveRecord with PostgreSQL 14+ as the primary database and Chewy for Elasticsearch indexing that powers full-text search with multilingual analyzers. Redis 7.0 and Sidekiq handle caching, rate limiting, timeline feeds, and background job queuing with scheduling extensions. The streaming server is a standalone Node.js 22 service using Express, the ws WebSocket library, and direct Redis pub/sub subscriptions. The frontend is built with React 19, Redux Toolkit, and Immutable.js for state management, compiled with Vite 8 and TypeScript 6. The production Docker image uses multi-stage builds targeting both AMD64 and ARM64, and optional libvips or ImageMagick integration handles image processing with blurhash generation.

Code Quality Mastodon maintains an extensive test suite using RSpec for Ruby with fabricators, shared examples, and request specs covering models, services, serializers, and API endpoints. On the JavaScript side, Vitest drives unit and component tests with testing-library, MSW for API mocking, Playwright for browser-level integration, and Storybook with Chromatic for visual regression testing across CI. TypeScript strict mode is enforced across the entire frontend with typed Redux state, typed action creators, and comprehensive interface definitions. The codebase applies RuboCop with frozen string literals, ESLint with accessibility and formatting rules, Stylelint for SCSS, and Oxfmt for formatting — all enforced in CI with dedicated workflow jobs. CodeQL security scanning and bundler-audit dependency auditing run automatically on each push.

What Makes It Unique Mastodon is the reference implementation of ActivityPub for microblogging and its federation layer is architecturally central, not bolted on. Incoming activities from remote servers are processed through a rich ProcessCollectionService pipeline that validates cryptographic HTTP signatures, handles object updates, deletions, and collection synchronization. The fan-out delivery system intelligently routes posts to local feeds, hashtag subscribers, public streams, and remote servers via per-server queues with retry logic. The streaming server maintains per-account and per-list channel subscriptions backed by Redis pub/sub, delivering updates with sub-second latency at scale. The admin panel includes relay management for subscribing to firehose streams from relay servers, enabling small instances to surface federated content without needing direct followers from each remote server.

Self-Hosting

Mastodon is licensed under the GNU Affero General Public License version 3 (AGPLv3). This is a strong copyleft license: you can use, modify, and self-host Mastodon freely for any purpose, including commercially, but if you distribute a modified version or run it as a network service accessible to others, you must make the modified source code available under the same license. For most organizations running a private internal instance or a public community server, this requirement has no practical impact. The AGPL specifically closes the ‘ASP loophole’ — modifications served over a network must be disclosed — which is why some organizations prefer hosting the unmodified upstream code.

Running Mastodon in production requires meaningful infrastructure: a PostgreSQL database (14+), Redis (7.0+), at minimum two Ruby web processes and a Sidekiq worker pool, a separate Node.js streaming server, and a file storage backend such as S3 or a compatible object store for media. A production instance for a few hundred active users can run on a single VPS with 4+ GB RAM, but scaling to thousands of users typically means separating database, Redis, and application tiers across dedicated machines or managed services. You are responsible for database backups, SSL certificate renewal, Ruby and Node.js upgrades, schema migrations on new releases, and Elasticsearch management if full-text search is enabled. The Mastodon project publishes detailed upgrade notes with each release, and migrations occasionally require downtime or pre-migration data tasks.

There is no official paid enterprise tier for self-hosted Mastodon — the software is the same regardless of instance size. Mastodon gGmbH, the nonprofit behind the project, operates mastodon.social and offers paid managed hosting through partners listed on joinmastodon.org, which abstracts away operational burden in exchange for a monthly fee. Self-hosted operators gain complete data sovereignty, the ability to apply custom branding via CSS overrides, and full control over federation decisions including blocking entire domains. Managed hosting provides automatic updates, included storage, SLA-backed uptime, and support — trade-offs that matter most to organizations without dedicated infrastructure teams.