mirror of
https://relay.ngit.dev/npub15qydau2hjma6ngxkl2cyar74wzyjshvl65za5k5rl69264ar2exs5cyejr/ngit-grasp.git
synced 2026-10-05 15:08:24 +00:00
DanConwayDev
7cc5d37cbf
Replace the owner-npub configuration option with relay-owner-nsec to provide a persistent cryptographic identity for the relay operator. This addresses NIP-42 authentication requirements discovered during sync debugging. Motivation: - Some relays (e.g., relay.damus.io) require NIP-42 authentication for advanced features like NIP-77 negentropy sync - Previously used random ephemeral keys per connection, providing no persistent identity - Other relays can now recognize us by pubkey for reputation-based rate limiting - Ensures consistency between NIP-11 pubkey and authentication key Changes: - Config: relay_owner_nsec with auto-load/generate from .relay-owner.nsec - NIP-11: Pubkey derived from nsec instead of separate npub field - Sync: RelayConnection now uses operator keys for NIP-42 auth - Docs: Updated README, .env.example, and added .relay-owner.nsec to gitignore Key Features: - Auto-generates key on first run and saves to .relay-owner.nsec - Loads existing key from file on subsequent runs - Can override via CLI flag or environment variable - Enables reputation building across relay network - Future-ready for event signing and WoT calculations Testing: - 225/232 tests passing (7 pre-existing purgatory failures unrelated) - Verified key generation, loading, and NIP-11 derivation - Release build successful Related: work/sync-debug-analysis.md, work/relay-owner-nsec-implementation.md
150 lines
5.4 KiB
Bash
150 lines
5.4 KiB
Bash
# ngit-grasp Configuration
|
|
#
|
|
# Configuration Priority (highest to lowest):
|
|
# 1. CLI flags (e.g., --domain example.com)
|
|
# 2. Environment variables (e.g., NGIT_DOMAIN=example.com)
|
|
# 3. This .env file
|
|
# 4. Built-in defaults
|
|
#
|
|
# Run `ngit-grasp --help` for all CLI options
|
|
|
|
# ============================================================================
|
|
# REQUIRED
|
|
# ============================================================================
|
|
|
|
# Domain where this instance is hosted (required, used in GRASP validation)
|
|
# CLI: --domain <domain>
|
|
# No default - must be set
|
|
# NGIT_DOMAIN=
|
|
|
|
# ============================================================================
|
|
# SERVER CONFIGURATION
|
|
# ============================================================================
|
|
|
|
# Server bind address (IP:PORT)
|
|
# CLI: --bind-address <address>
|
|
# Default: 127.0.0.1:8080
|
|
# NGIT_BIND_ADDRESS=127.0.0.1:8080
|
|
|
|
# ============================================================================
|
|
# RELAY INFORMATION (NIP-11)
|
|
# ============================================================================
|
|
|
|
# Relay operator's nsec (private key) for signing and authentication
|
|
# Used for:
|
|
# - NIP-11 relay information document (pubkey field derived from this nsec)
|
|
# - NIP-42 authentication when syncing from other relays
|
|
# - Future: signing events, WoT-based rate limiting of syncing relays
|
|
#
|
|
# CLI: --relay-owner-nsec <nsec>
|
|
# Default: Loaded from/saved to .relay-owner.nsec file in current directory
|
|
# If file doesn't exist, a new key is generated and saved automatically
|
|
# NGIT_RELAY_OWNER_NSEC=nsec1...
|
|
|
|
# Relay name shown in NIP-11 information document
|
|
# CLI: --relay-name <name>
|
|
# Default: ${domain} grasp relay (e.g., "gitnostr.com grasp relay")
|
|
# NGIT_RELAY_NAME=My GRASP Relay
|
|
|
|
# Relay description shown in NIP-11 information document
|
|
# CLI: --relay-description <description>
|
|
# Default: Git Nostr Relay - a grasp implementation
|
|
# NGIT_RELAY_DESCRIPTION="A GRASP-compliant Git relay with Nostr authorization"
|
|
|
|
# ============================================================================
|
|
# STORAGE
|
|
# ============================================================================
|
|
|
|
# Path to store Git repositories
|
|
# CLI: --git-data-path <path>
|
|
# Default: ./data/git
|
|
# NGIT_GIT_DATA_PATH=./data/git
|
|
|
|
# Path to store Nostr relay data
|
|
# CLI: --relay-data-path <path>
|
|
# Default: ./data/relay
|
|
# NGIT_RELAY_DATA_PATH=./data/relay
|
|
|
|
# Database backend for Nostr events
|
|
# CLI: --database-backend <backend>
|
|
# Options: lmdb, memory, nostrdb
|
|
# Default: lmdb
|
|
# - lmdb: LMDB backend (persistent, general purpose) - RECOMMENDED
|
|
# - memory: In-memory database (fastest, no persistence, uses temp dirs)
|
|
# - nostrdb: NostrDB backend (persistent, Nostr-optimized) [Not yet implemented]
|
|
#
|
|
# Note: When using 'memory' backend, git_data_path and relay_data_path
|
|
# are automatically set to temporary directories for ephemeral testing.
|
|
# NGIT_DATABASE_BACKEND=lmdb
|
|
|
|
# ============================================================================
|
|
# METRICS
|
|
# ============================================================================
|
|
|
|
# Enable Prometheus metrics endpoint at /metrics
|
|
# CLI: --metrics-enabled
|
|
# Default: true
|
|
# NGIT_METRICS_ENABLED=true
|
|
|
|
# Connections per IP before flagging as potential abuse in metrics
|
|
# (display only, no rate limiting - purely for monitoring visibility)
|
|
# CLI: --metrics-connection-per-ip-abuse-threshold <count>
|
|
# Default: 10
|
|
# NGIT_METRICS_CONNECTION_PER_IP_ABUSE_THRESHOLD=10
|
|
|
|
# Number of top bandwidth repositories to track in metrics
|
|
# CLI: --metrics-top-n-repos <count>
|
|
# Default: 10
|
|
# NGIT_METRICS_TOP_N_REPOS=10
|
|
|
|
# ============================================================================
|
|
# LOGGING
|
|
# ============================================================================
|
|
|
|
# Rust log level (not a ngit-grasp config, but useful for debugging)
|
|
# Options: error, warn, info, debug, trace
|
|
# RUST_LOG=info
|
|
|
|
# ============================================================================
|
|
# PROACTIVE SYNC (GRASP-02)
|
|
# ============================================================================
|
|
|
|
# Bootstrap relay URL for initial sync (optional)
|
|
# Additional relays are automatically discovered from repository announcements
|
|
# that list our service domain.
|
|
# CLI: --sync-bootstrap-relay-url <url>
|
|
# Default: (none - relay discovery from stored announcements only)
|
|
# NGIT_SYNC_BOOTSTRAP_RELAY_URL=wss://relay.example.com
|
|
|
|
# Maximum backoff time in seconds for sync relay reconnection
|
|
# CLI: --sync-max-backoff-secs <seconds>
|
|
# Default: 3600 (1 hour)
|
|
# NGIT_SYNC_MAX_BACKOFF_SECS=3600
|
|
|
|
# Delay in seconds before running startup catchup
|
|
# CLI: --sync-startup-delay-secs <seconds>
|
|
# Default: 30
|
|
# NGIT_SYNC_STARTUP_DELAY_SECS=30
|
|
|
|
# Delay in seconds before running reconnect catchup
|
|
# CLI: --sync-reconnect-delay-secs <seconds>
|
|
# Default: 10
|
|
# NGIT_SYNC_RECONNECT_DELAY_SECS=10
|
|
|
|
# Number of days to look back for reconnect catchup
|
|
# CLI: --sync-reconnect-lookback-days <days>
|
|
# Default: 3
|
|
# NGIT_SYNC_RECONNECT_LOOKBACK_DAYS=3
|
|
|
|
# Maximum startup jitter in milliseconds for sync connections
|
|
# Set to 0 to disable jitter (useful for testing)
|
|
# CLI: --sync-startup-jitter-ms <ms>
|
|
# Default: 10000 (10 seconds)
|
|
# NGIT_SYNC_STARTUP_JITTER_MS=10000
|
|
|
|
# ============================================================================
|
|
# FUTURE/PLANNED OPTIONS (not yet implemented)
|
|
# ============================================================================
|
|
|
|
# Archive mode (GRASP-05)
|
|
# NGIT_ARCHIVE_MODE=false |