Initial QSfera import

Server/services/webfinger/pkg/command/health.go

@@ -0,0 +1,54 @@
+package command
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/qsfera/server/pkg/config/configlog"
+	"github.com/qsfera/server/pkg/log"
+	"github.com/qsfera/server/services/webfinger/pkg/config"
+	"github.com/qsfera/server/services/webfinger/pkg/config/parser"
+
+	"github.com/spf13/cobra"
+)
+
+// Health is the entrypoint for the health command.
+func Health(cfg *config.Config) *cobra.Command {
+	return &cobra.Command{
+		Use:   "health",
+		Short: "check health status",
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			return configlog.ReturnError(parser.ParseConfig(cfg))
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			logger := log.Configure(cfg.Service.Name, cfg.Commons, cfg.LogLevel)
+
+			resp, err := http.Get(
+				fmt.Sprintf(
+					"http://%s/healthz",
+					cfg.Debug.Addr,
+				),
+			)
+
+			if err != nil {
+				logger.Fatal().
+					Err(err).
+					Msg("Failed to request health check")
+			}
+
+			defer resp.Body.Close()
+
+			if resp.StatusCode != http.StatusOK {
+				logger.Fatal().
+					Int("code", resp.StatusCode).
+					Msg("Health seems to be in bad state")
+			}
+
+			logger.Debug().
+				Int("code", resp.StatusCode).
+				Msg("Health got a good state")
+
+			return nil
+		},
+	}
+}

Server/services/webfinger/pkg/command/root.go

@@ -0,0 +1,36 @@
+package command
+
+import (
+	"os"
+
+	"github.com/qsfera/server/pkg/clihelper"
+	"github.com/qsfera/server/services/webfinger/pkg/config"
+
+	"github.com/spf13/cobra"
+)
+
+// GetCommands provides all commands for this service
+func GetCommands(cfg *config.Config) []*cobra.Command {
+	return []*cobra.Command{
+		// start this service
+		Server(cfg),
+
+		// interaction with this service
+
+		// infos about this service
+		Health(cfg),
+		Version(cfg),
+	}
+}
+
+// Execute is the entry point for the qsfera webfinger command.
+func Execute(cfg *config.Config) error {
+	app := clihelper.DefaultApp(&cobra.Command{
+		Use:   "webfinger",
+		Short: "Serve webfinger API for КуСфера",
+	})
+	app.AddCommand(GetCommands(cfg)...)
+	app.SetArgs(os.Args[1:])
+
+	return app.ExecuteContext(cfg.Context)
+}

Server/services/webfinger/pkg/command/server.go

@@ -0,0 +1,136 @@
+package command
+
+import (
+	"context"
+	"fmt"
+	"os/signal"
+
+	"github.com/qsfera/server/pkg/config/configlog"
+	"github.com/qsfera/server/pkg/log"
+	"github.com/qsfera/server/pkg/runner"
+	"github.com/qsfera/server/pkg/tracing"
+	"github.com/qsfera/server/pkg/version"
+	"github.com/qsfera/server/services/webfinger/pkg/config"
+	"github.com/qsfera/server/services/webfinger/pkg/config/parser"
+	"github.com/qsfera/server/services/webfinger/pkg/metrics"
+	"github.com/qsfera/server/services/webfinger/pkg/relations"
+	"github.com/qsfera/server/services/webfinger/pkg/server/debug"
+	"github.com/qsfera/server/services/webfinger/pkg/server/http"
+	"github.com/qsfera/server/services/webfinger/pkg/service/v0"
+
+	"github.com/spf13/cobra"
+)
+
+// Server is the entrypoint for the server command.
+func Server(cfg *config.Config) *cobra.Command {
+	return &cobra.Command{
+		Use:   "server",
+		Short: fmt.Sprintf("start the %s service without runtime (unsupervised mode)", cfg.Service.Name),
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			return configlog.ReturnFatal(parser.ParseConfig(cfg))
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			logger := log.Configure(cfg.Service.Name, cfg.Commons, cfg.LogLevel)
+			traceProvider, err := tracing.GetTraceProvider(cmd.Context(), cfg.Commons.TracesExporter, cfg.Service.Name)
+			if err != nil {
+				return err
+			}
+
+			var cancel context.CancelFunc
+			if cfg.Context == nil {
+				cfg.Context, cancel = signal.NotifyContext(context.Background(), runner.StopSignals...)
+				defer cancel()
+			}
+			ctx := cfg.Context
+
+			m := metrics.New(metrics.Logger(logger))
+			m.BuildInfo.WithLabelValues(version.GetString()).Set(1)
+
+			gr := runner.NewGroup()
+			{
+				relationProviders, err := getRelationProviders(cfg)
+				if err != nil {
+					logger.Error().Err(err).Msg("relation provider init")
+					return err
+				}
+
+				svc, err := service.New(
+					service.Logger(logger),
+					service.Config(cfg),
+					service.WithRelationProviders(relationProviders),
+				)
+				if err != nil {
+					logger.Error().Err(err).Msg("handler init")
+					return err
+				}
+				svc = service.NewInstrument(svc, m)
+				svc = service.NewLogging(svc, logger) // this logs service specific data
+				svc = service.NewTracing(svc, traceProvider)
+
+				server, err := http.Server(
+					http.Logger(logger),
+					http.Context(ctx),
+					http.Config(cfg),
+					http.Service(svc),
+					http.TraceProvider(traceProvider),
+				)
+
+				if err != nil {
+					logger.Info().
+						Err(err).
+						Str("server", "http").
+						Msg("Failed to initialize server")
+
+					return err
+				}
+
+				gr.Add(runner.NewGoMicroHttpServerRunner(cfg.Service.Name+".http", server))
+			}
+
+			{
+				debugServer, err := debug.Server(
+					debug.Logger(logger),
+					debug.Context(ctx),
+					debug.Config(cfg),
+				)
+
+				if err != nil {
+					logger.Info().Err(err).Str("transport", "debug").Msg("Failed to initialize server")
+					return err
+				}
+
+				gr.Add(runner.NewGolangHttpServerRunner(cfg.Service.Name+".debug", debugServer))
+			}
+
+			grResults := gr.Run(ctx)
+
+			// return the first non-nil error found in the results
+			for _, grResult := range grResults {
+				if grResult.RunnerError != nil {
+					return grResult.RunnerError
+				}
+			}
+			return nil
+		},
+	}
+}
+
+func getRelationProviders(cfg *config.Config) (map[string]service.RelationProvider, error) {
+	rels := map[string]service.RelationProvider{}
+	for _, relationURI := range cfg.Relations {
+		switch relationURI {
+		case relations.OpenIDConnectRel:
+			rels[relationURI] = relations.OpenIDDiscovery(cfg.IDP, cfg.OIDCClientConfigs)
+		case relations.QsferaInstanceRel:
+			var err error
+			rels[relationURI], err = relations.QsferaInstance(cfg.Instances, cfg.QsferaURL)
+			if err != nil {
+				return nil, err
+			}
+		default:
+			return nil, fmt.Errorf("unknown relation '%s'", relationURI)
+		}
+	}
+
+	return rels, nil
+}

Server/services/webfinger/pkg/command/version.go

@@ -0,0 +1,49 @@
+package command
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/qsfera/server/pkg/registry"
+	"github.com/qsfera/server/pkg/version"
+	"github.com/spf13/cobra"
+
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
+	"github.com/qsfera/server/services/webfinger/pkg/config"
+)
+
+// Version prints the service versions of all running instances.
+func Version(cfg *config.Config) *cobra.Command {
+	return &cobra.Command{
+		Use:   "version",
+		Short: "print the version of this binary and the running service instances",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			fmt.Println("Version: " + version.GetString())
+			fmt.Printf("Compiled: %s\n", version.Compiled())
+			fmt.Println("")
+
+			reg := registry.GetRegistry()
+			services, err := reg.GetService(cfg.HTTP.Namespace + "." + cfg.Service.Name)
+			if err != nil {
+				fmt.Println(fmt.Errorf("could not get %s services from the registry: %v", cfg.Service.Name, err))
+				return err
+			}
+
+			if len(services) == 0 {
+				fmt.Println("No running " + cfg.Service.Name + " service found.")
+				return nil
+			}
+
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
+			for _, s := range services {
+				for _, n := range s.Nodes {
+					table.Append([]string{s.Version, n.Address, n.Id})
+				}
+			}
+			table.Render()
+			return nil
+		},
+	}
+}

Server/services/webfinger/pkg/config/config.go

@@ -0,0 +1,53 @@
+package config
+
+import (
+	"context"
+
+	"github.com/qsfera/server/pkg/shared"
+)
+
+// Config combines all available configuration parts.
+type Config struct {
+	Commons *shared.Commons `yaml:"-"` // don't use this directly as configuration for a service
+
+	Service Service `yaml:"-"`
+
+	LogLevel string `yaml:"loglevel" env:"OC_LOG_LEVEL;WEBFINGER_LOG_LEVEL" desc:"The log level. Valid values are: 'panic', 'fatal', 'error', 'warn', 'info', 'debug', 'trace'." introductionVersion:"1.0.0"`
+	Debug    Debug  `yaml:"debug"`
+
+	HTTP HTTP `yaml:"http"`
+
+	Instances           []Instance `yaml:"instances"`
+	Relations           []string   `yaml:"relations" env:"WEBFINGER_RELATIONS" desc:"A list of relation URIs or registered relation types to add to webfinger responses. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	IDP                 string     `yaml:"idp" env:"OC_URL;OC_OIDC_ISSUER;WEBFINGER_OIDC_ISSUER" desc:"The identity provider href for the openid-discovery relation." introductionVersion:"1.0.0"`
+	AndroidClientID     string     `yaml:"android_client_id" env:"OC_OIDC_CLIENT_ID;WEBFINGER_ANDROID_OIDC_CLIENT_ID" desc:"The OIDC client ID for Android app." introductionVersion:"6.0.0"`
+	AndroidClientScopes []string   `yaml:"android_client_scopes" env:"OC_OIDC_CLIENT_SCOPES;WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES" desc:"The OIDC client scopes the Android app should request." introductionVersion:"6.0.0"`
+	DesktopClientID     string     `yaml:"desktop_client_id" env:"OC_OIDC_CLIENT_ID;WEBFINGER_DESKTOP_OIDC_CLIENT_ID" desc:"The OIDC client ID for the КуСфера desktop application." introductionVersion:"6.0.0"`
+	DesktopClientScopes []string   `yaml:"desktop_client_scopes" env:"OC_OIDC_CLIENT_SCOPES;WEBFINGER_DESKTOP_OIDC_CLIENT_SCOPES" desc:"The OIDC client scopes the КуСфера desktop application should request." introductionVersion:"6.0.0"`
+	IOSClientID         string     `yaml:"ios_client_id" env:"OC_OIDC_CLIENT_ID;WEBFINGER_IOS_OIDC_CLIENT_ID" desc:"The OIDC client ID for the IOS app." introductionVersion:"6.0.0"`
+	IOSClientScopes     []string   `yaml:"ios_client_scopes" env:"OC_OIDC_CLIENT_SCOPES;WEBFINGER_IOS_OIDC_CLIENT_SCOPES" desc:"The OIDC client scopes the IOS app should request." introductionVersion:"6.0.0"`
+	// The WEB_OIDC_CLIENT_ID is kept for backware compatibility with the old settings from the `web` service and can be removed in a future release.
+	WebClientID string `yaml:"web_client_id" env:"OC_OIDC_CLIENT_ID;WEB_OIDC_CLIENT_ID;WEBFINGER_WEB_OIDC_CLIENT_ID" desc:"The OIDC client ID for the КуСфера web client. The 'WEB_OIDC_CLIENT_ID' setting is only here for backwards compatibility and will be remove in a future release." introductionVersion:"6.0.0"`
+	// The WEB_OIDC_SCOPE is kept for backware compatibility with the old settings from the `web` service and can be removed in a future release.
+	WebClientScopes []string `yaml:"web_client_scopes" env:"OC_OIDC_CLIENT_SCOPES;WEB_OIDC_SCOPE;WEBFINGER_WEB_OIDC_CLIENT_SCOPES" desc:"The OIDC client scopes the КуСфера web client should request. The 'WEB_OIDC_SCOPE' setting is only here for backwards compatibility and will be remove in a future release." introductionVersion:"6.0.0"`
+	QsferaURL    string   `yaml:"qsfera_url" env:"OC_URL;WEBFINGER_QSFERA_SERVER_INSTANCE_URL" desc:"The URL for the legacy server instance relation. It defaults to the OC_URL but can be overridden to support some reverse proxy corner cases. To shard the deployment, multiple instances can be configured in the configuration file." introductionVersion:"1.0.0"`
+	Insecure        bool     `yaml:"insecure" env:"OC_INSECURE;WEBFINGER_INSECURE" desc:"Allow insecure connections to the WEBFINGER service." introductionVersion:"1.0.0"`
+
+	OIDCClientConfigs map[string]OIDCClientConfig `yaml:"-"`
+
+	Context context.Context `yaml:"-"`
+}
+
+// Instance to use with a matching rule and titles
+type Instance struct {
+	Claim  string            `yaml:"claim"`
+	Regex  string            `yaml:"regex"`
+	Href   string            `yaml:"href"`
+	Titles map[string]string `yaml:"titles"`
+	Break  bool              `yaml:"break"`
+}
+
+type OIDCClientConfig struct {
+	ClientID string
+	Scopes   []string
+}

Server/services/webfinger/pkg/config/debug.go

@@ -0,0 +1,9 @@
+package config
+
+// Debug defines the available debug configuration.
+type Debug struct {
+	Addr   string `yaml:"addr" env:"WEBFINGER_DEBUG_ADDR" desc:"Bind address of the debug server, where metrics, health, config and debug endpoints will be exposed." introductionVersion:"1.0.0"`
+	Token  string `yaml:"token" env:"WEBFINGER_DEBUG_TOKEN" desc:"Token to secure the metrics endpoint." introductionVersion:"1.0.0"`
+	Pprof  bool   `yaml:"pprof" env:"WEBFINGER_DEBUG_PPROF" desc:"Enables pprof, which can be used for profiling." introductionVersion:"1.0.0"`
+	Zpages bool   `yaml:"zpages" env:"WEBFINGER_DEBUG_ZPAGES" desc:"Enables zpages, which can be used for collecting and viewing in-memory traces." introductionVersion:"1.0.0"`
+}

Server/services/webfinger/pkg/config/defaults/defaultconfig.go

@@ -0,0 +1,113 @@
+package defaults
+
+import (
+	"strings"
+
+	"github.com/qsfera/server/services/webfinger/pkg/config"
+	"github.com/qsfera/server/services/webfinger/pkg/relations"
+)
+
+var (
+	nativeAppScopes = []string{"openid", "profile", "email", "offline_access"}
+	webAppScopes    = []string{"openid", "profile", "email"}
+)
+
+// FullDefaultConfig returns a fully initialized default configuration
+func FullDefaultConfig() *config.Config {
+	cfg := DefaultConfig()
+	EnsureDefaults(cfg)
+	Sanitize(cfg)
+	return cfg
+}
+
+// DefaultConfig returns a basic default configuration
+func DefaultConfig() *config.Config {
+	return &config.Config{
+		Debug: config.Debug{
+			Addr:   "127.0.0.1:9279",
+			Token:  "",
+			Pprof:  false,
+			Zpages: false,
+		},
+		HTTP: config.HTTP{
+			Addr:      "127.0.0.1:9275",
+			Root:      "/",
+			Namespace: "qsfera.web",
+			CORS: config.CORS{
+				AllowedOrigins:   []string{"https://localhost:9200"},
+				AllowCredentials: false,
+			},
+		},
+		Service: config.Service{
+			Name: "webfinger",
+		},
+
+		QsferaURL: "https://localhost:9200",
+		Relations:    []string{relations.OpenIDConnectRel, relations.QsferaInstanceRel},
+		Instances: []config.Instance{
+			{
+				Claim: "sub",
+				Regex: ".+",
+				Href:  "{{.OC_URL}}",
+				Titles: map[string]string{
+					"en": "КуСфера Instance",
+				},
+			},
+		},
+		IDP:                 "https://localhost:9200",
+		Insecure:            false,
+		AndroidClientID:     "QsferaAndroid",
+		AndroidClientScopes: nativeAppScopes,
+		DesktopClientID:     "QsferaDesktop",
+		DesktopClientScopes: nativeAppScopes,
+		IOSClientID:         "QsferaIOS",
+		IOSClientScopes:     nativeAppScopes,
+		WebClientID:         "web",
+		WebClientScopes:     webAppScopes,
+	}
+}
+
+// EnsureDefaults adds default values to the configuration if they are not set yet
+func EnsureDefaults(cfg *config.Config) {
+	if cfg.LogLevel == "" {
+		cfg.LogLevel = "error"
+	}
+
+	if cfg.Commons != nil {
+		cfg.HTTP.TLS = cfg.Commons.HTTPServiceTLS
+	}
+
+	if (cfg.Commons != nil && cfg.Commons.QsferaURL != "") &&
+		(cfg.HTTP.CORS.AllowedOrigins == nil ||
+			len(cfg.HTTP.CORS.AllowedOrigins) == 1 &&
+				cfg.HTTP.CORS.AllowedOrigins[0] == "https://localhost:9200") {
+		cfg.HTTP.CORS.AllowedOrigins = []string{cfg.Commons.QsferaURL}
+	}
+}
+
+// Sanitize sanitized the configuration
+func Sanitize(cfg *config.Config) {
+	// sanitize config
+	if cfg.HTTP.Root != "/" {
+		cfg.HTTP.Root = strings.TrimSuffix(cfg.HTTP.Root, "/")
+	}
+
+	cfg.OIDCClientConfigs = map[string]config.OIDCClientConfig{
+		"android": {
+			ClientID: cfg.AndroidClientID,
+			Scopes:   cfg.AndroidClientScopes,
+		},
+		"desktop": {
+			ClientID: cfg.DesktopClientID,
+			Scopes:   cfg.DesktopClientScopes,
+		},
+		"ios": {
+			ClientID: cfg.IOSClientID,
+			Scopes:   cfg.IOSClientScopes,
+		},
+		"web": {
+			ClientID: cfg.WebClientID,
+			Scopes:   cfg.WebClientScopes,
+		},
+	}
+}

Server/services/webfinger/pkg/config/http.go

@@ -0,0 +1,20 @@
+package config
+
+import "github.com/qsfera/server/pkg/shared"
+
+// CORS defines the available cors configuration.
+type CORS struct {
+	AllowedOrigins   []string `yaml:"allow_origins" env:"OC_CORS_ALLOW_ORIGINS;WEBFINGER_CORS_ALLOW_ORIGINS" desc:"A list of allowed CORS origins. See following chapter for more details: *Access-Control-Allow-Origin* at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	AllowedMethods   []string `yaml:"allow_methods" env:"OC_CORS_ALLOW_METHODS;WEBFINGER_CORS_ALLOW_METHODS" desc:"A list of allowed CORS methods. See following chapter for more details: *Access-Control-Request-Method* at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Method. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	AllowedHeaders   []string `yaml:"allow_headers" env:"OC_CORS_ALLOW_HEADERS;WEBFINGER_CORS_ALLOW_HEADERS" desc:"A list of allowed CORS headers. See following chapter for more details: *Access-Control-Request-Headers* at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Headers. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	AllowCredentials bool     `yaml:"allow_credentials" env:"OC_CORS_ALLOW_CREDENTIALS;WEBFINGER_CORS_ALLOW_CREDENTIALS" desc:"Allow credentials for CORS.See following chapter for more details: *Access-Control-Allow-Credentials* at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials." introductionVersion:"1.0.0"`
+}
+
+// HTTP defines the available http configuration.
+type HTTP struct {
+	Addr      string                `yaml:"addr" env:"WEBFINGER_HTTP_ADDR" desc:"The bind address of the HTTP service." introductionVersion:"1.0.0"`
+	Namespace string                `yaml:"-"`
+	Root      string                `yaml:"root" env:"WEBFINGER_HTTP_ROOT" desc:"Subdirectory that serves as the root for this HTTP service." introductionVersion:"1.0.0"`
+	CORS      CORS                  `yaml:"cors"`
+	TLS       shared.HTTPServiceTLS `yaml:"tls"`
+}

Server/services/webfinger/pkg/config/parser/parse.go

@@ -0,0 +1,37 @@
+package parser
+
+import (
+	"errors"
+
+	occfg "github.com/qsfera/server/pkg/config"
+	"github.com/qsfera/server/services/webfinger/pkg/config"
+	"github.com/qsfera/server/services/webfinger/pkg/config/defaults"
+
+	"github.com/qsfera/server/pkg/config/envdecode"
+)
+
+// ParseConfig loads configuration from known paths.
+func ParseConfig(cfg *config.Config) error {
+	err := occfg.BindSourcesToStructs(cfg.Service.Name, cfg)
+	if err != nil {
+		return err
+	}
+
+	defaults.EnsureDefaults(cfg)
+
+	// load all env variables relevant to the config in the current context.
+	if err := envdecode.Decode(cfg); err != nil {
+		// no environment variable set for this config is an expected "error"
+		if !errors.Is(err, envdecode.ErrNoTargetFieldsAreSet) {
+			return err
+		}
+	}
+
+	defaults.Sanitize(cfg)
+
+	return Validate(cfg)
+}
+
+func Validate(_ *config.Config) error {
+	return nil
+}

Server/services/webfinger/pkg/config/service.go

@@ -0,0 +1,6 @@
+package config
+
+// Service defines the available service configuration.
+type Service struct {
+	Name string `yaml:"-"`
+}

Server/services/webfinger/pkg/metrics/metrics.go

@@ -0,0 +1,81 @@
+package metrics
+
+import "github.com/prometheus/client_golang/prometheus"
+
+var (
+	// Namespace defines the namespace for the defines metrics.
+	Namespace = "qsfera"
+
+	// Subsystem defines the subsystem for the defines metrics.
+	Subsystem = "webfinger"
+)
+
+// Metrics defines the available metrics of this service.
+type Metrics struct {
+	BuildInfo *prometheus.GaugeVec
+	Counter   *prometheus.CounterVec
+	Latency   *prometheus.SummaryVec
+	Duration  *prometheus.HistogramVec
+}
+
+// New initializes the available metrics.
+func New(opts ...Option) *Metrics {
+	options := newOptions(opts...)
+
+	m := &Metrics{
+		BuildInfo: prometheus.NewGaugeVec(prometheus.GaugeOpts{
+			Namespace: Namespace,
+			Subsystem: Subsystem,
+			Name:      "build_info",
+			Help:      "Build information",
+		}, []string{"version"}),
+		Counter: prometheus.NewCounterVec(prometheus.CounterOpts{
+			Namespace: Namespace,
+			Subsystem: Subsystem,
+			Name:      "webfinger_total",
+			Help:      "How many webfinger requests processed",
+		}, []string{}),
+		Latency: prometheus.NewSummaryVec(prometheus.SummaryOpts{
+			Namespace: Namespace,
+			Subsystem: Subsystem,
+			Name:      "webfinger_latency_microseconds",
+			Help:      "Webfinger request latencies in microseconds",
+		}, []string{}),
+		Duration: prometheus.NewHistogramVec(prometheus.HistogramOpts{
+			Namespace: Namespace,
+			Subsystem: Subsystem,
+			Name:      "webfinger_duration_seconds",
+			Help:      "Webfinger request time in seconds",
+		}, []string{}),
+	}
+
+	if err := prometheus.Register(m.BuildInfo); err != nil {
+		options.Logger.Error().
+			Err(err).
+			Str("metric", "BuildInfo").
+			Msg("Failed to register prometheus metric")
+	}
+
+	if err := prometheus.Register(m.Counter); err != nil {
+		options.Logger.Error().
+			Err(err).
+			Str("metric", "counter").
+			Msg("Failed to register prometheus metric")
+	}
+
+	if err := prometheus.Register(m.Latency); err != nil {
+		options.Logger.Error().
+			Err(err).
+			Str("metric", "latency").
+			Msg("Failed to register prometheus metric")
+	}
+
+	if err := prometheus.Register(m.Duration); err != nil {
+		options.Logger.Error().
+			Err(err).
+			Str("metric", "duration").
+			Msg("Failed to register prometheus metric")
+	}
+
+	return m
+}

Server/services/webfinger/pkg/metrics/options.go

@@ -0,0 +1,31 @@
+package metrics
+
+import (
+	"github.com/qsfera/server/pkg/log"
+)
+
+// Option defines a single option function.
+type Option func(o *Options)
+
+// Options defines the available options for this package.
+type Options struct {
+	Logger log.Logger
+}
+
+// newOptions initializes the available default options.
+func newOptions(opts ...Option) Options {
+	opt := Options{}
+
+	for _, o := range opts {
+		o(&opt)
+	}
+
+	return opt
+}
+
+// Logger provides a function to set the logger option.
+func Logger(val log.Logger) Option {
+	return func(o *Options) {
+		o.Logger = val
+	}
+}

Server/services/webfinger/pkg/relations/openid_discovery.go

@@ -0,0 +1,50 @@
+package relations
+
+import (
+	"context"
+
+	"github.com/qsfera/server/services/webfinger/pkg/config"
+	"github.com/qsfera/server/services/webfinger/pkg/service/v0"
+	"github.com/qsfera/server/services/webfinger/pkg/webfinger"
+)
+
+const (
+	OpenIDConnectRel   = "http://openid.net/specs/connect/1.0/issuer"
+	clientIDProp       = "http://qsfera.eu/ns/oidc/client_id"
+	scopesProp         = "http://qsfera.eu/ns/oidc/scopes"
+	legacyClientIDProp = "http://opencloud.eu/ns/oidc/client_id"
+	legacyScopesProp   = "http://opencloud.eu/ns/oidc/scopes"
+)
+
+type openIDDiscovery struct {
+	Href        string
+	OIDCClients map[string]config.OIDCClientConfig
+}
+
+// OpenIDDiscovery adds the Openid Connect issuer relation
+func OpenIDDiscovery(href string, clients map[string]config.OIDCClientConfig) service.RelationProvider {
+	return &openIDDiscovery{
+		Href:        href,
+		OIDCClients: clients,
+	}
+}
+
+func (l *openIDDiscovery) Add(_ context.Context, platform string, jrd *webfinger.JSONResourceDescriptor) {
+	if jrd == nil {
+		jrd = &webfinger.JSONResourceDescriptor{}
+	}
+	jrd.Links = append(jrd.Links, webfinger.Link{
+		Rel:  OpenIDConnectRel,
+		Href: l.Href,
+	})
+
+	if platform != "" {
+		if clientConfig, ok := l.OIDCClients[platform]; ok {
+			jrd.Properties = make(map[string]any)
+			jrd.Properties[clientIDProp] = clientConfig.ClientID
+			jrd.Properties[scopesProp] = clientConfig.Scopes
+			jrd.Properties[legacyClientIDProp] = clientConfig.ClientID
+			jrd.Properties[legacyScopesProp] = clientConfig.Scopes
+		}
+	}
+}

Server/services/webfinger/pkg/relations/openid_discovery_test.go

@@ -0,0 +1,59 @@
+package relations
+
+import (
+	"context"
+	"testing"
+
+	"github.com/qsfera/server/services/webfinger/pkg/config"
+	"github.com/qsfera/server/services/webfinger/pkg/webfinger"
+)
+
+func TestOpenidDiscovery(t *testing.T) {
+	clients := map[string]config.OIDCClientConfig{
+		"web": {
+			ClientID: "web",
+			Scopes:   []string{"openid", "profile", "email"},
+		},
+		"test": {
+			ClientID: "test",
+			Scopes:   []string{"test"},
+		},
+	}
+
+	provider := OpenIDDiscovery("http://issuer.url", clients)
+
+	jrd := webfinger.JSONResourceDescriptor{}
+
+	provider.Add(context.Background(), "", &jrd)
+
+	if len(jrd.Links) != 1 {
+		t.Errorf("provider returned wrong number of links: %v, expected 1", len(jrd.Links))
+	}
+	if jrd.Links[0].Href != "http://issuer.url" {
+		t.Errorf("provider returned wrong issuer link href: %v, expected %v", jrd.Links[0].Href, "http://issuer.url")
+	}
+	if jrd.Links[0].Rel != "http://openid.net/specs/connect/1.0/issuer" {
+		t.Errorf("provider returned wrong openid connect rel: %v, expected %v", jrd.Links[0].Href, OpenIDConnectRel)
+	}
+	if len(jrd.Properties) != 0 {
+		t.Errorf("provider returned properties for empty platform: %v, expected 0", len(jrd.Properties))
+	}
+
+	jrd = webfinger.JSONResourceDescriptor{}
+	provider.Add(context.Background(), "test", &jrd)
+	if len(jrd.Properties) != 4 {
+		t.Errorf("provider returned wrong number of properties for platform test: %v, expected 4", len(jrd.Properties))
+	}
+	if jrd.Properties["http://qsfera.eu/ns/oidc/client_id"] != "test" {
+		t.Errorf("provider returned wrong client_id property: %v, expected %v", jrd.Properties["http://qsfera.eu/ns/oidc/client_id"], "test")
+	}
+	if scopes, ok := jrd.Properties["http://qsfera.eu/ns/oidc/scopes"].([]string); !ok || len(scopes) != 1 || scopes[0] != "test" {
+		t.Errorf("provider returned wrong scopes property: %v, expected %v", jrd.Properties["http://qsfera.eu/ns/oidc/scopes"], []string{"test"})
+	}
+	if jrd.Properties["http://opencloud.eu/ns/oidc/client_id"] != "test" {
+		t.Errorf("provider returned wrong legacy client_id property: %v, expected %v", jrd.Properties["http://opencloud.eu/ns/oidc/client_id"], "test")
+	}
+	if scopes, ok := jrd.Properties["http://opencloud.eu/ns/oidc/scopes"].([]string); !ok || len(scopes) != 1 || scopes[0] != "test" {
+		t.Errorf("provider returned wrong legacy scopes property: %v, expected %v", jrd.Properties["http://opencloud.eu/ns/oidc/scopes"], []string{"test"})
+	}
+}

Server/services/webfinger/pkg/relations/qsfera_instance.go

@@ -0,0 +1,88 @@
+package relations
+
+import (
+	"context"
+	"net/url"
+	"regexp"
+	"strings"
+	"text/template"
+
+	"github.com/qsfera/server/pkg/oidc"
+	"github.com/qsfera/server/services/webfinger/pkg/config"
+	"github.com/qsfera/server/services/webfinger/pkg/service/v0"
+	"github.com/qsfera/server/services/webfinger/pkg/webfinger"
+)
+
+const (
+	QsferaInstanceRel = "http://webfinger.qsfera/rel/server-instance"
+)
+
+type compiledInstance struct {
+	config.Instance
+	compiledRegex *regexp.Regexp
+	hrefTemplate  *template.Template
+}
+
+type qsferaInstance struct {
+	instances    []compiledInstance
+	qsferaURL    string
+	instanceHost string
+}
+
+// QsferaInstance adds one or more КуСфера instance relations
+func QsferaInstance(instances []config.Instance, qsferaURL string) (service.RelationProvider, error) {
+	compiledInstances := make([]compiledInstance, 0, len(instances))
+	var err error
+	for _, instance := range instances {
+		compiled := compiledInstance{Instance: instance}
+		compiled.compiledRegex, err = regexp.Compile(instance.Regex)
+		if err != nil {
+			return nil, err
+		}
+		compiled.hrefTemplate, err = template.New(instance.Claim + ":" + instance.Regex + ":" + instance.Href).Parse(instance.Href)
+		if err != nil {
+			return nil, err
+		}
+		compiledInstances = append(compiledInstances, compiled)
+	}
+
+	u, err := url.Parse(qsferaURL)
+	if err != nil {
+		return nil, err
+	}
+	return &qsferaInstance{
+		instances:    compiledInstances,
+		qsferaURL:    qsferaURL,
+		instanceHost: u.Host + u.Path,
+	}, nil
+}
+
+func (l *qsferaInstance) Add(ctx context.Context, _ string, jrd *webfinger.JSONResourceDescriptor) {
+	if jrd == nil {
+		jrd = &webfinger.JSONResourceDescriptor{}
+	}
+	if claims := oidc.FromContext(ctx); claims != nil {
+		if value, ok := claims[oidc.PreferredUsername].(string); ok {
+			jrd.Subject = "acct:" + value + "@" + l.instanceHost
+		} else if value, ok := claims[oidc.Email].(string); ok {
+			jrd.Subject = "mailto:" + value
+		}
+		// allow referencing QSFERA_URL in the template
+		claims["QSFERA_URL"] = l.qsferaURL
+		claims["OC_URL"] = l.qsferaURL
+		for _, instance := range l.instances {
+			if value, ok := claims[instance.Claim].(string); ok && instance.compiledRegex.MatchString(value) {
+				var tmplWriter strings.Builder
+				instance.hrefTemplate.Execute(&tmplWriter, claims)
+				jrd.Links = append(jrd.Links, webfinger.Link{
+					Rel:    QsferaInstanceRel,
+					Href:   tmplWriter.String(),
+					Titles: instance.Titles,
+				})
+				if instance.Break {
+					break
+				}
+			}
+		}
+	}
+}

Server/services/webfinger/pkg/relations/qsfera_instance_test.go

@@ -0,0 +1,65 @@
+package relations
+
+import (
+	"context"
+	"testing"
+
+	"github.com/qsfera/server/pkg/oidc"
+	"github.com/qsfera/server/services/webfinger/pkg/config"
+	"github.com/qsfera/server/services/webfinger/pkg/webfinger"
+)
+
+func TestQsferaInstanceErr(t *testing.T) {
+	_, err := QsferaInstance([]config.Instance{}, "http://\n\rinvalid")
+	if err == nil {
+		t.Errorf("provider did not err on invalid url: %v", err)
+	}
+	_, err = QsferaInstance([]config.Instance{{Regex: "("}}, "http://qsfera.tld")
+	if err == nil {
+		t.Errorf("provider did not err on invalid regex: %v", err)
+	}
+	_, err = QsferaInstance([]config.Instance{{Href: "{{invalid}}ee"}}, "http://qsfera.tld")
+	if err == nil {
+		t.Errorf("provider did not err on invalid href template: %v", err)
+	}
+}
+
+func TestQsferaInstanceAddLink(t *testing.T) {
+	provider, err := QsferaInstance([]config.Instance{{
+		Claim: "customclaim",
+		Regex: ".+@.+\\..+",
+		Href:  "https://{{.otherclaim}}.domain.tld",
+		Titles: map[string]string{
+			"foo": "bar",
+		},
+		Break: true,
+	}}, "http://qsfera.tld")
+	if err != nil {
+		t.Error(err)
+	}
+
+	ctx := context.Background()
+	ctx = oidc.NewContext(ctx, map[string]any{
+		"customclaim": "some@fizz.buzz",
+		"otherclaim":  "someone",
+	})
+	jrd := webfinger.JSONResourceDescriptor{}
+	provider.Add(ctx, "", &jrd)
+
+	if len(jrd.Links) != 1 {
+		t.Errorf("provider returned wrong number of links: %v, expected 1", len(jrd.Links))
+	}
+	if jrd.Links[0].Href != "https://someone.domain.tld" {
+		t.Errorf("provider returned wrong issuer link href: %v, expected %v", jrd.Links[0].Href, "https://someone.domain.tld")
+	}
+	if jrd.Links[0].Rel != QsferaInstanceRel {
+		t.Errorf("provider returned qsfera server instance rel: %v, expected %v", jrd.Links[0].Rel, QsferaInstanceRel)
+	}
+	if len(jrd.Links[0].Titles) != 1 {
+		t.Errorf("provider returned wrong number of titles: %v, expected 1", len(jrd.Links[0].Titles))
+	}
+	if jrd.Links[0].Titles["foo"] != "bar" {
+		t.Errorf("provider returned wrong title: %v, expected bar", len(jrd.Links[0].Titles["foo"]))
+	}
+
+}

Server/services/webfinger/pkg/server/debug/option.go

@@ -0,0 +1,50 @@
+package debug
+
+import (
+	"context"
+
+	"github.com/qsfera/server/pkg/log"
+	"github.com/qsfera/server/services/webfinger/pkg/config"
+)
+
+// Option defines a single option function.
+type Option func(o *Options)
+
+// Options defines the available options for this package.
+type Options struct {
+	Logger  log.Logger
+	Context context.Context
+	Config  *config.Config
+}
+
+// newOptions initializes the available default options.
+func newOptions(opts ...Option) Options {
+	opt := Options{}
+
+	for _, o := range opts {
+		o(&opt)
+	}
+
+	return opt
+}
+
+// Logger provides a function to set the logger option.
+func Logger(val log.Logger) Option {
+	return func(o *Options) {
+		o.Logger = val
+	}
+}
+
+// Context provides a function to set the context option.
+func Context(val context.Context) Option {
+	return func(o *Options) {
+		o.Context = val
+	}
+}
+
+// Config provides a function to set the config option.
+func Config(val *config.Config) Option {
+	return func(o *Options) {
+		o.Config = val
+	}
+}

Server/services/webfinger/pkg/server/debug/server.go

@@ -0,0 +1,37 @@
+package debug
+
+import (
+	"net/http"
+
+	"github.com/qsfera/server/pkg/checks"
+	"github.com/qsfera/server/pkg/handlers"
+	"github.com/qsfera/server/pkg/service/debug"
+	"github.com/qsfera/server/pkg/version"
+)
+
+// Server initializes the debug service and server.
+func Server(opts ...Option) (*http.Server, error) {
+	options := newOptions(opts...)
+
+	checkHandler := handlers.NewCheckHandler(
+		handlers.NewCheckHandlerConfiguration().
+			WithLogger(options.Logger).
+			WithCheck("web reachability", checks.NewHTTPCheck(options.Config.HTTP.Addr)),
+	)
+
+	return debug.NewService(
+		debug.Logger(options.Logger),
+		debug.Name(options.Config.Service.Name),
+		debug.Version(version.GetString()),
+		debug.Address(options.Config.Debug.Addr),
+		debug.Token(options.Config.Debug.Token),
+		debug.Pprof(options.Config.Debug.Pprof),
+		debug.Zpages(options.Config.Debug.Zpages),
+		debug.Health(checkHandler),
+		debug.Ready(checkHandler),
+		debug.CorsAllowedOrigins(options.Config.HTTP.CORS.AllowedOrigins),
+		debug.CorsAllowedMethods(options.Config.HTTP.CORS.AllowedMethods),
+		debug.CorsAllowedHeaders(options.Config.HTTP.CORS.AllowedHeaders),
+		debug.CorsAllowCredentials(options.Config.HTTP.CORS.AllowCredentials),
+	), nil
+}

Server/services/webfinger/pkg/server/http/option.go

@@ -0,0 +1,85 @@
+package http
+
+import (
+	"context"
+
+	"github.com/qsfera/server/pkg/log"
+	"github.com/qsfera/server/services/webfinger/pkg/config"
+	svc "github.com/qsfera/server/services/webfinger/pkg/service/v0"
+
+	"github.com/spf13/pflag"
+	"go.opentelemetry.io/otel/trace"
+	"go.opentelemetry.io/otel/trace/noop"
+)
+
+// Option defines a single option function.
+type Option func(o *Options)
+
+// Options defines the available options for this package.
+type Options struct {
+	Name          string
+	Namespace     string
+	Logger        log.Logger
+	Context       context.Context
+	Config        *config.Config
+	Flags         []pflag.Flag
+	Service       svc.Service
+	TraceProvider trace.TracerProvider
+}
+
+// newOptions initializes the available default options.
+func newOptions(opts ...Option) Options {
+	opt := Options{}
+
+	for _, o := range opts {
+		o(&opt)
+	}
+
+	return opt
+}
+
+// Logger provides a function to set the logger option.
+func Logger(val log.Logger) Option {
+	return func(o *Options) {
+		o.Logger = val
+	}
+}
+
+// Context provides a function to set the context option.
+func Context(val context.Context) Option {
+	return func(o *Options) {
+		o.Context = val
+	}
+}
+
+// Config provides a function to set the config option.
+func Config(val *config.Config) Option {
+	return func(o *Options) {
+		o.Config = val
+	}
+}
+
+// Service provides a function to set the service option.
+func Service(val svc.Service) Option {
+	return func(o *Options) {
+		o.Service = val
+	}
+}
+
+// Flags provides a function to set the flags option.
+func Flags(flags ...pflag.Flag) Option {
+	return func(o *Options) {
+		o.Flags = append(o.Flags, flags...)
+	}
+}
+
+// TraceProvider provides a function to configure the trace provider
+func TraceProvider(traceProvider trace.TracerProvider) Option {
+	return func(o *Options) {
+		if traceProvider != nil {
+			o.TraceProvider = traceProvider
+		} else {
+			o.TraceProvider = noop.NewTracerProvider()
+		}
+	}
+}

Server/services/webfinger/pkg/server/http/server.go

@@ -0,0 +1,153 @@
+package http
+
+import (
+	"crypto/tls"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	chimiddleware "github.com/go-chi/chi/v5/middleware"
+	"github.com/go-chi/render"
+	"github.com/qsfera/server/pkg/cors"
+	"github.com/qsfera/server/pkg/middleware"
+	ohttp "github.com/qsfera/server/pkg/service/http"
+	"github.com/qsfera/server/pkg/tracing"
+	"github.com/qsfera/server/pkg/version"
+	serviceErrors "github.com/qsfera/server/services/webfinger/pkg/service/v0"
+	svc "github.com/qsfera/server/services/webfinger/pkg/service/v0"
+	"github.com/pkg/errors"
+	"github.com/riandyrn/otelchi"
+	"go-micro.dev/v4"
+)
+
+// Server initializes the http service and server.
+func Server(opts ...Option) (ohttp.Service, error) {
+	options := newOptions(opts...)
+	service := options.Service
+
+	newService, err := ohttp.NewService(
+		ohttp.TLSConfig(options.Config.HTTP.TLS),
+		ohttp.Logger(options.Logger),
+		ohttp.Namespace(options.Config.HTTP.Namespace),
+		ohttp.Name(options.Config.Service.Name),
+		ohttp.Version(version.GetString()),
+		ohttp.Address(options.Config.HTTP.Addr),
+		ohttp.Context(options.Context),
+		ohttp.Flags(options.Flags...),
+	)
+	if err != nil {
+		options.Logger.Error().
+			Err(err).
+			Msg("Error initializing http service")
+		return ohttp.Service{}, err
+	}
+
+	mux := chi.NewMux()
+
+	mux.Use(chimiddleware.RealIP)
+	mux.Use(chimiddleware.RequestID)
+	mux.Use(middleware.TraceContext)
+	mux.Use(middleware.NoCache)
+	mux.Use(
+		middleware.Cors(
+			cors.Logger(options.Logger),
+			cors.AllowedOrigins(options.Config.HTTP.CORS.AllowedOrigins),
+			cors.AllowedMethods(options.Config.HTTP.CORS.AllowedMethods),
+			cors.AllowedHeaders(options.Config.HTTP.CORS.AllowedHeaders),
+			cors.AllowCredentials(options.Config.HTTP.CORS.AllowCredentials),
+		))
+
+	mux.Use(middleware.Version(
+		options.Name,
+		version.String,
+	))
+
+	mux.Use(
+		otelchi.Middleware(
+			options.Name,
+			otelchi.WithChiRoutes(mux),
+			otelchi.WithTracerProvider(options.TraceProvider),
+			otelchi.WithPropagators(tracing.GetPropagator()),
+		),
+	)
+
+	var oidcHTTPClient = &http.Client{
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				MinVersion:         tls.VersionTLS12,
+				InsecureSkipVerify: options.Config.Insecure, //nolint:gosec
+			},
+			DisableKeepAlives: true,
+		},
+		Timeout: time.Second * 10,
+	}
+
+	mux.Use(middleware.OidcAuth(
+		middleware.WithLogger(options.Logger),
+		middleware.WithOidcIssuer(options.Config.IDP),
+		middleware.WithHttpClient(*oidcHTTPClient),
+	))
+
+	// this logs http request related data
+	mux.Use(middleware.Logger(
+		options.Logger,
+	))
+
+	mux.Route(options.Config.HTTP.Root, func(r chi.Router) {
+		r.Get("/.well-known/webfinger", WebfingerHandler(service))
+	})
+
+	err = micro.RegisterHandler(newService.Server(), mux)
+	if err != nil {
+		options.Logger.Fatal().Err(err).Msg("failed to register the handler")
+	}
+
+	newService.Init()
+	return newService, nil
+}
+
+func WebfingerHandler(service svc.Service) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+
+		// A WebFinger URI MUST contain a query component (see Section 3.4 of
+		// RFC 3986).  The query component MUST contain a "resource" parameter
+		// and MAY contain one or more "rel" parameters.
+		resource := r.URL.Query().Get("resource")
+		queryTarget, err := url.Parse(resource)
+		if resource == "" || err != nil {
+			// If the "resource" parameter is absent or malformed, the WebFinger
+			// resource MUST indicate that the request is bad as per Section 10.4.1
+			// of RFC 2616.
+			render.Status(r, http.StatusBadRequest)
+			render.PlainText(w, r, "absent or malformed 'resource' parameter")
+			return
+		}
+
+		rels := r.URL.Query()["rel"]
+
+		platform := r.URL.Query().Get("platform")
+
+		jrd, err := service.Webfinger(ctx, queryTarget, rels, platform)
+		if errors.Is(err, serviceErrors.ErrNotFound) {
+			// from https://www.rfc-editor.org/rfc/rfc7033#section-4.2
+			//
+			// If the "resource" parameter is a value for which the server has no
+			// information, the server MUST indicate that it was unable to match the
+			// request as per Section 10.4.5 of RFC 2616.
+			render.Status(r, http.StatusNotFound)
+			render.PlainText(w, r, err.Error())
+			return
+		}
+		if err != nil {
+			render.Status(r, http.StatusInternalServerError)
+			render.PlainText(w, r, err.Error())
+			return
+		}
+
+		w.Header().Set("Content-type", "application/jrd+json")
+		render.Status(r, http.StatusOK)
+		render.JSON(w, r, jrd)
+	}
+}

Server/services/webfinger/pkg/service/v0/errors.go

@@ -0,0 +1,5 @@
+package service
+
+import "errors"
+
+var ErrNotFound = errors.New("query target not found")

Server/services/webfinger/pkg/service/v0/instrument.go

@@ -0,0 +1,39 @@
+package service
+
+import (
+	"context"
+	"net/url"
+
+	"github.com/qsfera/server/services/webfinger/pkg/metrics"
+	"github.com/qsfera/server/services/webfinger/pkg/webfinger"
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+// NewInstrument returns a service that instruments metrics.
+func NewInstrument(next Service, metrics *metrics.Metrics) Service {
+	return instrument{
+		next:    next,
+		metrics: metrics,
+	}
+}
+
+type instrument struct {
+	next    Service
+	metrics *metrics.Metrics
+}
+
+// Webfinger implements the Service interface.
+func (i instrument) Webfinger(ctx context.Context, queryTarget *url.URL, rels []string, platform string) (webfinger.JSONResourceDescriptor, error) {
+	timer := prometheus.NewTimer(prometheus.ObserverFunc(func(v float64) {
+		us := v * 1000000
+
+		i.metrics.Latency.WithLabelValues().Observe(us)
+		i.metrics.Duration.WithLabelValues().Observe(v)
+	}))
+
+	defer timer.ObserveDuration()
+
+	i.metrics.Counter.WithLabelValues().Inc()
+
+	return i.next.Webfinger(ctx, queryTarget, rels, platform)
+}

Server/services/webfinger/pkg/service/v0/logging.go

@@ -0,0 +1,32 @@
+package service
+
+import (
+	"context"
+	"net/url"
+
+	"github.com/qsfera/server/pkg/log"
+	"github.com/qsfera/server/services/webfinger/pkg/webfinger"
+)
+
+// NewLogging returns a service that logs messages.
+func NewLogging(next Service, logger log.Logger) Service {
+	return logging{
+		next:   next,
+		logger: logger,
+	}
+}
+
+type logging struct {
+	next   Service
+	logger log.Logger
+}
+
+// Webfinger implements the Service interface.
+func (l logging) Webfinger(ctx context.Context, queryTarget *url.URL, rels []string, platform string) (webfinger.JSONResourceDescriptor, error) {
+	l.logger.Debug().
+		Str("query_target", queryTarget.String()).
+		Strs("rel", rels).
+		Msg("Webfinger")
+
+	return l.next.Webfinger(ctx, queryTarget, rels, platform)
+}

Server/services/webfinger/pkg/service/v0/option.go

@@ -0,0 +1,47 @@
+package service
+
+import (
+	"github.com/qsfera/server/pkg/log"
+	"github.com/qsfera/server/services/webfinger/pkg/config"
+)
+
+// Option defines a single option function.
+type Option func(o *Options)
+
+// Options defines the available options for this package.
+type Options struct {
+	Logger            log.Logger
+	Config            *config.Config
+	RelationProviders map[string]RelationProvider
+}
+
+// newOptions initializes the available default options.
+func newOptions(opts ...Option) Options {
+	opt := Options{}
+
+	for _, o := range opts {
+		o(&opt)
+	}
+
+	return opt
+}
+
+// Logger provides a function to set the logger option.
+func Logger(val log.Logger) Option {
+	return func(o *Options) {
+		o.Logger = val
+	}
+}
+
+// Config provides a function to set the config option.
+func Config(val *config.Config) Option {
+	return func(o *Options) {
+		o.Config = val
+	}
+}
+
+func WithRelationProviders(val map[string]RelationProvider) Option {
+	return func(o *Options) {
+		o.RelationProviders = val
+	}
+}

Server/services/webfinger/pkg/service/v0/service.go

@@ -0,0 +1,105 @@
+package service
+
+import (
+	"context"
+	"net/url"
+
+	"github.com/qsfera/server/pkg/log"
+	"github.com/qsfera/server/services/webfinger/pkg/config"
+	"github.com/qsfera/server/services/webfinger/pkg/webfinger"
+)
+
+// Service defines the extension handlers.
+type Service interface {
+	// Webfinger is the endpoint for retrieving various href relations.
+	//
+	//	GET /.well-known/webfinger?
+	//	     resource=acct%3Acarol%40example.com&
+	//	     rel=http%3A%2F%2Fwebfinger.qsfera%rel%2Fserver-instance
+	//	     HTTP/1.1
+	//	Host: example.com
+	//
+	// The server might respond like this:
+	//
+	//	HTTP/1.1 200 OK
+	//	Access-Control-Allow-Origin: *
+	//	Content-Type: application/jrd+json
+	//
+	//	{
+	//	  "subject" : "acct:carol@example.com",
+	//	  "links" :
+	//	  [
+	//	    {
+	//	      "rel" : "http://webfinger.qsfera/rel/server-instance",
+	//	      "href" : "https://instance.example.com",
+	//	      "titles": {
+	//	        "en": "Readable Instance Name"
+	//	      }
+	//	    },
+	//	    {
+	//	      "rel" : "http://webfinger.qsfera/rel/server-instance",
+	//	      "href" : "https://otherinstance.example.com",
+	//	      "titles": {
+	//	        "en": "Other Readable Instance Name"
+	//	      }
+	//	    }
+	//	  ]
+	//	}
+	Webfinger(ctx context.Context, queryTarget *url.URL, rels []string, platform string) (webfinger.JSONResourceDescriptor, error)
+}
+
+type RelationProvider interface {
+	Add(ctx context.Context, platform string, jrd *webfinger.JSONResourceDescriptor)
+}
+
+// New returns a new instance of Service
+func New(opts ...Option) (Service, error) {
+	options := newOptions(opts...)
+
+	// TODO use fallback implementations of InstanceIdLookup and InstanceLookup?
+	// The InstanceIdLookup may have to happen earlier?
+
+	return svc{
+		log:               options.Logger,
+		config:            options.Config,
+		relationProviders: options.RelationProviders,
+	}, nil
+}
+
+type svc struct {
+	config            *config.Config
+	log               log.Logger
+	relationProviders map[string]RelationProvider
+}
+
+// TODO implement different implementations:
+// static one returning the href or a configurable domain
+// regex one returning different instances based on the regex that matches
+// claim one that reads a claim and then fetches the instance?
+// that is actually two interfaces / steps:
+// - one that determines the instances/schools id (read from claim, regex match)
+// - one that looks up in instance by id (use template, read from json, read from ldap, read from graph)
+
+// Webfinger implements the service interface
+func (s svc) Webfinger(ctx context.Context, queryTarget *url.URL, rel []string, platform string) (webfinger.JSONResourceDescriptor, error) {
+
+	jrd := webfinger.JSONResourceDescriptor{
+		Subject: queryTarget.String(),
+	}
+
+	if len(rel) == 0 {
+		// add all configured relation providers
+		for _, relation := range s.relationProviders {
+			relation.Add(ctx, platform, &jrd)
+		}
+	} else {
+		// only add requested relations
+		for _, r := range rel {
+			if relation, ok := s.relationProviders[r]; ok {
+				relation.Add(ctx, platform, &jrd)
+			}
+		}
+	}
+
+	return jrd, nil
+}

Server/services/webfinger/pkg/service/v0/tracing.go

@@ -0,0 +1,38 @@
+package service
+
+import (
+	"context"
+	"net/url"
+
+	"github.com/qsfera/server/services/webfinger/pkg/webfinger"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
+)
+
+// NewTracing returns a service that instruments traces.
+func NewTracing(next Service, tp trace.TracerProvider) Service {
+	return tracing{
+		next: next,
+		tp:   tp,
+	}
+}
+
+type tracing struct {
+	next Service
+	tp   trace.TracerProvider
+}
+
+// Webfinger implements the Service interface.
+func (t tracing) Webfinger(ctx context.Context, queryTarget *url.URL, rels []string, platform string) (webfinger.JSONResourceDescriptor, error) {
+	spanOpts := []trace.SpanStartOption{
+		trace.WithSpanKind(trace.SpanKindServer),
+		trace.WithAttributes(
+			attribute.KeyValue{Key: "query_target", Value: attribute.StringValue(queryTarget.String())},
+			attribute.KeyValue{Key: "rels", Value: attribute.StringSliceValue(rels)},
+		),
+	}
+	ctx, span := t.tp.Tracer("webfinger").Start(ctx, "Webfinger", spanOpts...)
+	defer span.End()
+
+	return t.next.Webfinger(ctx, queryTarget, rels, platform)
+}

Server/services/webfinger/pkg/webfinger/webfinger.go

@@ -0,0 +1,64 @@
+package webfinger
+
+// Link represents a link relation object as per https://www.rfc-editor.org/rfc/rfc7033#section-4.4.4
+type Link struct {
+	// Rel is either a URI or a registered relation type (see RFC 5988)
+	//
+	// The "rel" member MUST be present in the link relation object.
+	Rel string `json:"rel"`
+	// Type indicates the media type of the target resource
+	//
+	// The "type" member is OPTIONAL in the link relation object.
+	Type string `json:"type,omitempty"`
+	// Href contains a URI pointing to the target resource.
+	//
+	// The "href" member is OPTIONAL in the link relation object.
+	Href string `json:"href,omitempty"`
+	// The "properties" object within the link relation object comprises
+	// zero or more name/value pairs whose names are URIs (referred to as
+	// "property identifiers") and whose values are strings or null.
+	//
+	// Properties are used to convey additional information about the link
+	// relation.  As an example, consider this use of "properties":
+	//
+	//  "properties" : { "http://webfinger.example/mail/port" : "993" }
+	//
+	// The "properties" member is OPTIONAL in the link relation object.
+	Properties map[string]string `json:"properties,omitempty"`
+	// Titles comprises zero or more name/value pairs whose
+	// names are a language tag or the string "und"
+	//
+	// Here is an example of the "titles" object:
+	//
+	//  "titles" :
+	//  {
+	//    "en-us" : "The Magical World of Steve",
+	//    "fr" : "Le Monde Magique de Steve"
+	//  }
+	//
+	// The "titles" member is OPTIONAL in the link relation object.
+	Titles map[string]string `json:"titles,omitempty"`
+}
+
+// JSONResourceDescriptor represents a JSON Resource Descriptor (JRD) as per https://www.rfc-editor.org/rfc/rfc7033#section-4.4
+type JSONResourceDescriptor struct {
+	// Subject is a URI that identifies the entity that the JRD describes
+	//
+	// The "subject" member SHOULD be present in the JRD.
+	Subject string `json:"subject,omitempty"`
+	// Aliases is an array of zero or more URI strings that identify the same
+	// entity as the "subject" URI.
+	//
+	// The "aliases" array is OPTIONAL in the JRD.
+	Aliases []string `json:"aliases,omitempty"`
+	// Properties is an object comprising zero or more name/value pairs whose
+	// names are URIs (referred to as "property identifiers") and whose
+	// values are strings or null.
+	//
+	// The "properties" member is OPTIONAL in the JRD.
+	Properties map[string]any `json:"properties,omitempty"`
+	// Links is an array of objects that contain link relation information
+	//
+	// The "links" array is OPTIONAL in the JRD.
+	Links []Link `json:"links,omitempty"`
+}