Makes it so that all requests are signed, equivalent to
signToActivityPubGet always being true.

@@ -0,0 +7,4 @@
+import DbResolver from '@/remote/activitypub/db-resolver.js';
+import { getApId } from '@/remote/activitypub/type.js';
+
+export default async function checkFetch(req: IncomingMessage): Promise<number> {

@@ -189,3 +268,4 @@
 
 // emoji
 router.get('/emojis/:emoji', async ctx => {
+	const verify = await checkFetch(ctx.req);

@@ -203,1 +288,3 @@
-	ctx.set('Cache-Control', 'public, max-age=180');
+	const meta = await fetchMeta();
+	if (meta.secureMode || meta.privateMode) {
+		ctx.set('Cache-Control', 'private, max-age=0, must-revalidate');

@@ -134,0 +148,4 @@
+		set.secureMode = ps.secureMode;
+	}
+
+	if (ps.mascotImageUrl !== undefined) {

@@ -288,2 +298,4 @@
 		langs: instance.langs,
 		tosUrl: instance.ToSUrl,
+		repositoryUrl: instance.repositoryUrl,
+		feedbackUrl: instance.feedbackUrl,

@@ -67,6 +96,16 @@ function save() {
 	});
 }
 
+function saveInstance() {