NostrOps Relay operators

Operator playbook

Best practices

Drawn from production strfry, nostr-rs-relay, and nostream deployments, plus the NIPs that operators actually have to implement.

These are not a tutorial for compiling a relay. They are the habits that keep a box from becoming a spam sink, a legal surprise, or an unrestorable archive.

A dim workstation with a glowing terminal beside out-of-focus server equipment.
  1. 01
    Terminate TLS in front of the relay.

    Bind the relay to localhost. Put Caddy or nginx in front for certificates and WebSocket upgrades. Never expose raw ws:// on a public address.

  2. 02
    Treat NIP-11 as the most-read file on the box.

    Fill name, description, operator pubkey, contact, software, version, terms of service, limitations, and fees. Clients use this document to decide whether to connect, pay, or AUTH.

  3. 03
    Filter at ingest, not after the disk is full.

    strfry write-policy plugins, GRAIN allow/deny lists, or a filter proxy in front of the relay. Reject, rate-limit, or shadow-reject before events hit LMDB or SQLite.

  4. 04
    Cap everything that can grow without bound.

    Max event size, tag count, subscriptions per connection, idle timeouts, file descriptors, and created_at windows (NIP-22). Advertise the same numbers in limitation so clients fail predictably.

  5. 05
    Use NIP-42 where privacy or payment depends on identity.

    AUTH is the right tool for paid relays, private communities, and restricted reads of DMs (kinds 4 and 1059). Advertise it only when it is actually enabled and the service URL is set.

  6. 06
    Run as an unprivileged user under systemd.

    Dedicated account, NoNewPrivileges, tight ReadWritePaths, and LimitNOFILE matched to config. Relays that start as root quietly break their own maintenance commands.

  7. 07
    Back up events off-box, every night.

    strfry export to JSONL, or SQLite online backup. Copy config and write-policy scripts too. Keep a copy offsite. Events compress well; the archive is the product.

  8. 08
    Compact, prune, and watch the disk.

    LMDB map size is address space, not RAM — but the data directory is real. Compact after deletes. Drop ephemeral events. Alert before the volume fills.

  9. 09
    Keep admin APIs off the public internet.

    NIP-86 (JSON-RPC over HTTP, NIP-98 auth) and any /panel belong on localhost, a VPN, or a locked reverse-proxy path. Do not commit database URIs or admin tokens.

  10. 10
    Say the policy out loud.

    Terms of service, posting policy, and a contact pubkey for abuse reports. Operators are not obliged to answer DMs — but clients need somewhere to send them.

  11. 11
    Pay for public write access, or don’t offer it.

    Lightning admission or subscription is the honest way to run a general-purpose relay. Proof of work (NIP-13) is a weaker cousin. Free and open is a choice you will subsidize.

  12. 12
    Update, monitor, and write the runbook.

    Unattended security updates, logs, connection counts, and a one-page restore procedure. A relay nobody can rebuild is a relay that will disappear.