Add sidecar-nostr-relay example and fix openwrt CI path

Add a complete example running a strfry Nostr relay exclusively over the FIPS mesh using the sidecar pattern. Includes Docker Compose stack, network isolation via iptables, .fips DNS resolution, nak CLI, build script with cross-compilation support, and documentation. Also fix the package-openwrt.yml workflow path to match the openwrt → openwrt-ipk directory rename.
2026-07-30 19:46:15 +00:00 · 2026-03-19 16:23:13 +00:00
parent 8c349f524e
commit c8b7459fbc
24 changed files with 731 additions and 1 deletions
@@ -0,0 +1,49 @@
+# nostr-rs-relay configuration for FIPS mesh deployment.
+# Full reference: https://github.com/scsibug/nostr-rs-relay
+
+[info]
+# Shown in NIP-11 relay information document.
+relay_url = ""          # Set to ws://[<your-fips-ipv6>]:8080 after first start
+name = "FIPS Nostr Relay"
+description = "A Nostr relay accessible over the FIPS mesh network."
+pubkey = ""             # Optional: your npub (hex) as relay operator
+contact = ""            # Optional: contact address
+
+[database]
+# SQLite database path inside the container (mapped to relay-data volume).
+data_directory = "/usr/src/app/db"
+
+[network]
+# Bind on all interfaces (IPv4 + IPv6) — FIPS delivers traffic via the fips0
+# TUN as IPv6 (fd00::/8). Using 0.0.0.0 with port 8080; the relay also needs
+# to accept IPv6 connections so we set port separately and rely on the OS
+# dual-stack socket (IPV6_V6ONLY=0).
+# nostr-rs-relay address field is just the IP, port is separate.
+address = "0.0.0.0"
+port = 8080
+ping_interval_seconds = 300
+
+[limits]
+# Adjust to taste. These are conservative defaults for a personal relay.
+messages_per_sec = 10
+subscriptions_per_min = 20
+max_blocking_threads = 4
+max_event_bytes = 131072       # 128 KiB per event
+max_ws_message_bytes = 131072
+max_ws_frame_bytes = 131072
+broadcast_buffer = 16384
+event_persist_buffer = 4096
+
+[authorization]
+# Set to true to require NIP-42 AUTH before accepting events.
+# Useful for a private relay — only authenticated users can publish.
+nip42_auth = false
+nip42_dms = false
+
+[verified_users]
+# NIP-05 verification (optional).
+mode = "disabled"
+
+[pay_to_relay]
+# Lightning payments for relay access (optional).
+enabled = false
@@ -0,0 +1,71 @@
+##
+## strfry configuration for FIPS mesh deployment.
+## Full reference: https://github.com/hoytech/strfry
+##
+
+db = "/usr/src/app/strfry-db/"
+
+dbParams {
+    # Maximum size of the database (bytes). 10 GiB is a safe default.
+    mapsize = 10737418240
+}
+
+relay {
+    # Bind on all interfaces so the FIPS TUN (IPv4 + IPv6) can reach it.
+    bind = "0.0.0.0"
+    port = 7777
+
+    nofiles = 0
+
+    info {
+        name = "FIPS Nostr Relay"
+        description = "A Nostr relay accessible over the FIPS mesh network."
+        pubkey = ""
+        contact = ""
+    }
+
+    # Maximum size of an inbound WebSocket message (bytes).
+    maxWebsocketPayloadSize = 131072
+
+    # Send a ping every N seconds to keep connections alive.
+    autoPingSeconds = 55
+
+    # Enable per-message compression.
+    enableTcpNoDelay = false
+
+    rejectFutureEventsSeconds = 900
+    rejectEphemeralEventsOlderThanSeconds = 60
+    rejectEventsNewerThanSeconds = 900
+
+    maxFilterLimit = 500
+    maxSubsPerConnection = 20
+
+    writePolicy {
+        # Plugin executable for write-policy decisions (leave empty to allow all).
+        plugin = ""
+    }
+
+    compression {
+        enabled = true
+        slidingWindow = true
+    }
+
+    logging {
+        dumpInAll = false
+        dumpInEvents = false
+        dumpInReqs = false
+        dbScanPerf = false
+    }
+
+    numThreads {
+        ingester = 3
+        reqWorker = 3
+        reqMonitor = 3
+        negentropy = 2
+    }
+
+    negentropy {
+        enabled = true
+        maxSyncEvents = 1000000
+    }
+}