1. The "It's Foss" site is designed somewhat carelessly, where many things that could be static aren't, and so it goes under with even a bit of load.
2. Mastodon link preview is badly designed and not spec-compliant. Because the link previews are not triggered by a user request they should respect robots.txt (https://github.com/mastodon/mastodon/issues/21738), or they should start being triggered by a user request (https://github.com/mastodon/mastodon/issues/23662).
Some OP advice to "get a damn CDN" seems to be a responce rather than a correction of the issue.
Even poorly designed websites shouldn't face DDoS scale access by a social network sharing a link. The social network should mitigate it's massive parallelization.
Off-topic, but I love how "mastedon" sounds.
1. You make a post that includes example.com/cats
2. Your post is federated to the instances your followers are on.
3. Those instances fetch example.com/cats in a fully automated way, and observe its preview image is example.com/tabby.jpg and fetch that as well. They save this locally.
4. When your followers view your federated post they see a short text extract from example.com/cats and a thumbnail of example.com/tabby.jpg
Step 3 is where the 'DDOS' is happening, and it's not a request issued by an agent of the original poster.
Thinking about other similar distributed systems, if I put a link to an html page in an RSS feed or a mailing list message, it's not normal for subscribers to be using clients that fetch linked pages. But if they did it's clearly as an agent of that user, and not as an agent of the poster?
I get paid to basically solve this sort of scaling problems so I'm not a great barometer but it isn't that hard to handle a traffic spike like this.