Private Nostr Relay: strfry with an npub write allowlist (community package)

[marcusquinn]

I've packaged strfry (GPL-3.0), a fast C++ Nostr relay, as a Cloudron community app. "Private" here means private writes: only the public keys you list can publish, and every other write is rejected. It won't turn into an open public relay that strangers fill up.

What it's for

A Nostr relay is a shared noticeboard. Clients post signed events to it, and other clients read them back. Your posts, profile and follow list reach other people because their clients read them from relays. With this package, one of those relays is yours:

• Your own outbox. Add it to your Nostr client next to public relays. Your posts, profile and follows have a copy on your own server that no one else can moderate away, and others can still read them there.
• A small group's relay. List the keys of family, a team, or a club. Only those members can post, and nobody needs an account on your server.
• Bots and services. Give an automation its own key and a relay it can always publish to.

What it isn't: a private messaging server. Messages are private only when your client encrypts them (for example NIP-17 direct messages). The relay then stores ciphertext, but who messaged whom can still be visible. Restricting DM reads to the people involved needs a strfry release that isn't out yet.

Install (Cloudron 9.1 or later): from Community Apps, or add this versions URL under Community apps in your dashboard settings, or run:

cloudron install --versions-url https://raw.githubusercontent.com/marcusquinn/cloudron-nostr-relay-app/main/CloudronVersions.json --location relay

Your relay is then wss://<your-app-domain>. Add keys to /app/data/allowlist.txt with the app's File Manager or Web Terminal: one npub or 64-character hex key per line, # for comments. Changes apply to the next event, no restart.

What the package does

• Starts closed. An empty, missing or unreadable allowlist rejects every write, and an invalid or partly written entry never grants access. Rejected clients see blocked: pubkey is not on the relay allowlist.
• The check uses the event's signing key. Replies and reactions from people who aren't on the list are not stored, even when they reference your events.
• The strfry LMDB database, generated config and allowlist live under /app/data and are in Cloudron backups.
• NIP-11 relay information (name, description, contact, operator key) is set with app environment variables (RELAY_NAME, RELAY_DESCRIPTION, RELAY_CONTACT, RELAY_OPERATOR_PUBKEY).
• Client IPs come from Cloudron's proxy, and Cloudron terminates TLS.
• strfry 1.1.3 is built from the pinned upstream tag on cloudron/base:6.0.0. The default memory limit is 512 MB.

Please read before relying on it:

• Reads are public. Anyone who knows the address can read stored events. Treat what you publish as public unless it is encrypted. Writes don't need a login: every event is signed, and the relay checks that the signing key is on your list.
• Never put a private key (nsec) in the allowlist. It is ignored, and the file is readable by anyone with app access.
• The database has no size cap of its own. It grows with stored events, within your server's disk.

Tested on a live Cloudron: install from the versions URL; allowlisted writes accepted and others rejected over wss://; NIP-11 settings; persistence across restart; backup and restore; and the 0.1.0 → 0.1.1 update from the published catalog with data intact. Results are in the repository's test/QUALIFICATION.md.

Source, docs and issues: https://github.com/marcusquinn/cloudron-nostr-relay-app. It's packaged independently of the strfry project; the packaging files are MIT. Feedback welcome, especially from people running it with many clients or a large event history.