Index: src/routes/activitypub.js
===================================================================
--- src/routes/activitypub.js	(revision 75ab393b61dbacf266594c3d44c01d8ad60781a1)
+++ src/routes/activitypub.js	(revision 356caeb698355af00d6930ae0248cb1aaf78e0fd)
@@ -17,6 +17,11 @@
 import AP from '../services/ActivityPubService.js';
 import { apReadLimiter, apInboxLimiter } from '../middleware/rate-limit.js';
+import { apEnabled } from '../services/SettingsService.js';
 
 const router = express.Router();
+// The whole fediverse layer can be turned off (solo "no federation" mode):
+// then /ap/*, WebFinger and NodeInfo are simply gone — the site is undiscoverable
+// and unfederatable.
+router.use((req, res, next) => { if (!apEnabled()) return res.status(404).end(); next(); });
 // Generous per-IP baseline over all /ap/* (reads). The inbox POST gets an
 // additional, tighter cap inline (it triggers outbound fetches).