ActivityPub inbox requests causing Pitchfork worker timeouts

Contribute Bug

AI-generated summary

The discussion reports a bug where ActivityPub inbox requests are causing repeated Pitchfork worker timeouts on Discourse 2026.10.0-latest. scavin identifies that 12 out of 13 timeout warnings stem from remote actor resolution during HTTP signature verification, which runs synchronously and blocks workers when remote servers respond slowly. The provided backtrace highlights the blockage occurring in excon socket reads triggered by discourse_activity_pub/request.rb. Additionally, verbose logging revealed numerous failed attempts to resolve deleted Mastodon actors returning HTTP 410 Gone, leading to failed Delete activity processing. While it is unconfirmed if these specific failures directly cause the timeouts, the user questions whether synchronous resolution is expected behavior and suggests improving timeout handling or caching to prevent web worker blocking.

1

I’m seeing repeated Pitchfork worker timeouts on my Discourse instance (2026.10.0-latest).

After analyzing the production logs, 12 out of 13 timeout warnings were related to ActivityPub inbox requests, specifically during remote actor resolution for HTTP signature verification.

The relevant backtrace:

Pitchfork worker is about to timeout,
dumping backtrace for main thread

excon/socket.rb:368:in 'IO.select'
excon/socket.rb:79:in 'Excon::Socket#readline'
excon.rb:255:in 'Excon.get'

discourse_activity_pub/request.rb:70:in 'Request#perform'
discourse_activity_pub/request.rb:34:in 'Request#get_json_ld'
discourse_activity_pub/json_ld.rb:71:in 'JsonLd.request_object'
discourse_activity_pub/a_p/object.rb:251:in 'AP::Object.resolve'

signature_verification.rb:254:in 'actor_from_key_id'
signature_verification.rb:61:in 'signed_request_actor'
inboxes_controller.rb:31:in 'process_json'
inboxes_controller.rb:10:in 'create'

It appears that remote actor resolution runs synchronously during inbox processing, potentially blocking Pitchfork workers when remote servers respond slowly.

I also enabled activity_pub_verbose_logging for approximately 24 hours and noticed repeated attempts to resolve deleted Mastodon actors returning HTTP 410 Gone, resulting in numerous failed Delete activity processing warnings.

Example:

[Discourse Activity Pub] GET request to
https://mastodon.social/ap/users/115676297044305006
failed: {"error":"Gone"}

[Discourse Activity Pub] Failed to resolve actor
[Discourse Activity Pub] Failed to process Delete activity:
Unable to create actor

I haven’t confirmed whether these failed Delete activities are directly related to the worker timeouts.

Is synchronous remote actor resolution during inbox signature verification expected behavior? Could the timeout handling or caching be improved to prevent blocking web workers?

I’m happy to provide additional sanitized logs if needed.