mirror of
https://github.com/Such-Software/smirk-backend-core.git
synced 2026-10-17 15:31:38 +02:00
jwinterm
17bb7bcc20
Completes the operator side of the relay integration: - deploy/relay/: reference docker-compose + config.toml for a locked-down nostr-rs-relay wired to the backend's gRPC admission (host networking so the loopback admission socket stays private). Clearly marked a template to pin/ verify against the operator's nostr-rs-relay version. - docs/operations/RELAY.md: what it is (inbox relay, not the only relay), the admission architecture, the three write policies + NIP-13 PoW, bundled vs external, verification, and the seam's modularity. Linked from OPERATOR_SETUP. - .env.example: the RELAY_* block (all off/placeholder). Backend relay integration (config → seam → policy → gRPC admission → capabilities → NIP-05 → packaging/docs) is now complete. Client DM stack next.
36 lines
1.5 KiB
YAML
36 lines
1.5 KiB
YAML
# Bundled, locked-down Nostr relay for a self-hosted Smirk backend.
|
|
#
|
|
# This runs nostr-rs-relay as the messaging-plane relay. WRITE ADMISSION is
|
|
# delegated to the Smirk backend's gRPC service (RELAY_ADMISSION_BIND, default
|
|
# 127.0.0.1:8090) via nostr-rs-relay's [grpc] event_admission_server hook — so
|
|
# the RELAY_WRITE_POLICY (inbox-outbox / author-allowlist / open) + NIP-13 PoW
|
|
# are enforced by the backend, not baked into this file.
|
|
#
|
|
# Networking: the relay uses the HOST network so it can reach the backend's
|
|
# loopback admission socket (127.0.0.1:8090) while keeping that socket private.
|
|
# host networking is Linux-only; on other hosts, bind RELAY_ADMISSION_BIND to a
|
|
# docker-reachable address behind your firewall and drop `network_mode: host`,
|
|
# adding `extra_hosts: ["host.docker.internal:host-gateway"]` + a port mapping.
|
|
#
|
|
# This is a REFERENCE template — verify the config keys against the nostr-rs-relay
|
|
# version you pin (https://github.com/scsibug/nostr-rs-relay).
|
|
services:
|
|
relay:
|
|
image: ghcr.io/scsibug/nostr-rs-relay:latest # pin a digest in production
|
|
restart: unless-stopped
|
|
network_mode: host # reach the backend admission socket on 127.0.0.1
|
|
user: "1000:1000"
|
|
volumes:
|
|
- ./config.toml:/usr/src/app/config.toml:ro
|
|
- relay-data:/usr/src/app/db
|
|
environment:
|
|
RUST_LOG: info
|
|
# Modest, self-host-friendly resource ceilings.
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 512M
|
|
|
|
volumes:
|
|
relay-data:
|