diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml index c6a57ab..8bc25f6 100644 --- a/.github/FUNDING.yml +++ b/.github/FUNDING.yml @@ -1,4 +1,3 @@ # These are supported funding model platforms - github: [christianchiarulli, jchiarulli] patreon: chrisatmachine diff --git a/README.md b/README.md index 3889a29..fd6ed03 100644 --- a/README.md +++ b/README.md @@ -26,10 +26,10 @@ You'll learn how to: - Set up remote access using SSH -- Configure nginx - - Set up a firewall +- Configure Nginx + - Obtain and set up an SSL/TLS certificate - Build the relay software diff --git a/docs/assets/logo_cropped_purple.png b/docs/assets/logo_cropped_purple.png index 2013409..8730f2b 100644 Binary files a/docs/assets/logo_cropped_purple.png and b/docs/assets/logo_cropped_purple.png differ diff --git a/docs/assets/logo_square_purple.png b/docs/assets/logo_square_purple.png index bf29da5..ccc0ec8 100644 Binary files a/docs/assets/logo_square_purple.png and b/docs/assets/logo_square_purple.png differ diff --git a/docs/bitcoin.pdf b/docs/bitcoin.pdf index 1e19b73..21f8812 100644 Binary files a/docs/bitcoin.pdf and b/docs/bitcoin.pdf differ diff --git a/docs/contact.md b/docs/contact.md new file mode 100644 index 0000000..68b44b8 --- /dev/null +++ b/docs/contact.md @@ -0,0 +1,39 @@ +# Contact + +## NODE-TEC + +đŸŠ© npub: + +```bash +npub1809mpa7748df7kext899m2yatetky9w78zz72x7jgaxarvxyfvtqwvfpz8 +``` + +📧 Email: + +[devs@node-tec.com](mailto:devs@node-tec.com "devs@node-tec.com") + +🔐 PGP Fingerprint: + +```bash +04BD 8C20 598F A5FD DE19 BECD 8F24 69F7 1314 FAD7 +``` + +## Developers + +đŸŠ© Chris' npub: + +```bash +npub1ygzj9skr9val9yqxkf67yf9jshtyhvvl0x76jp5er09nsc0p3j6qr260k2 +``` + +đŸŠ© J's npub: + +```bash +npub1zn559gr2vwyex2s2mt2s7x5r5ryjeyy0zwy2zx3ckp6ktwpe4p4spgt84e +``` + +đŸŠ© Nick's npub: + +```bash +npub1te6nugpy7utp9ls620awmj5zw0nedwhh3rjj2gx6vnzms2rvz5jq9kkh4n +``` diff --git a/docs/donate/index.md b/docs/donate/index.md index 0931867..55234d1 100644 --- a/docs/donate/index.md +++ b/docs/donate/index.md @@ -1,20 +1,19 @@ # Donate Bitcoin -If you find this guide helpful, please consider donating some sats. Your support is greatly appreciated. +If you find these guides helpful, please consider donating some sats. Your support is greatly appreciated. -- **Zap me on nostr:** +- **Zap me on Nostr:** -``` +```bash npub1ygzj9skr9val9yqxkf67yf9jshtyhvvl0x76jp5er09nsc0p3j6qr260k2 ``` - **Bitcoin:** -``` +```bash bc1q6hqtxr5hnhu9asze30a8w02g65nztlw8y27p7q ``` - **Lightning:** -[Tip with lightning](https://getalby.com/p/chrisatmachine) - +[Tip with Lightning](https://getalby.com/p/chrisatmachine) diff --git a/docs/faq.md b/docs/faq.md index 1eab840..72e6a68 100644 --- a/docs/faq.md +++ b/docs/faq.md @@ -1,7 +1,3 @@ -Ask me questions on nostr and maybe I'll answer them here. +# FAQ -pubkey: - -``` -npub1ygzj9skr9val9yqxkf67yf9jshtyhvvl0x76jp5er09nsc0p3j6qr260k2 -``` +If your question wasn't answered here, reach out to us on [Nostr](https://nostr.com "Nostr"). We'll update this page with the answers. diff --git a/docs/images/additional-features.png b/docs/images/additional-features.png index a3bb889..2bb889d 100644 Binary files a/docs/images/additional-features.png and b/docs/images/additional-features.png differ diff --git a/docs/images/choose-image.png b/docs/images/choose-image.png index e13bfac..3a2608b 100644 Binary files a/docs/images/choose-image.png and b/docs/images/choose-image.png differ diff --git a/docs/images/choose-location.png b/docs/images/choose-location.png index 7d3ed4d..045796f 100644 Binary files a/docs/images/choose-location.png and b/docs/images/choose-location.png differ diff --git a/docs/images/choose-plan-personal.png b/docs/images/choose-plan-personal.png index 46c079e..7548a45 100644 Binary files a/docs/images/choose-plan-personal.png and b/docs/images/choose-plan-personal.png differ diff --git a/docs/images/choose-plan-public.png b/docs/images/choose-plan-public.png index 544deee..eab3fa9 100644 Binary files a/docs/images/choose-plan-public.png and b/docs/images/choose-plan-public.png differ diff --git a/docs/images/namecheap-checkout.png b/docs/images/namecheap-checkout.png index 2c97134..c4ca2ec 100644 Binary files a/docs/images/namecheap-checkout.png and b/docs/images/namecheap-checkout.png differ diff --git a/docs/images/namecheap-search.png b/docs/images/namecheap-domain-search.png similarity index 90% rename from docs/images/namecheap-search.png rename to docs/images/namecheap-domain-search.png index 8310d22..49c5368 100644 Binary files a/docs/images/namecheap-search.png and b/docs/images/namecheap-domain-search.png differ diff --git a/docs/images/namecheap-records.png b/docs/images/namecheap-records.png index d391d14..ce45d9a 100644 Binary files a/docs/images/namecheap-records.png and b/docs/images/namecheap-records.png differ diff --git a/docs/images/namecheap-remove-records.png b/docs/images/namecheap-remove-records.png index 41405da..39e2dc4 100644 Binary files a/docs/images/namecheap-remove-records.png and b/docs/images/namecheap-remove-records.png differ diff --git a/docs/images/server-info.png b/docs/images/server-info.png index 8517507..7fb711c 100644 Binary files a/docs/images/server-info.png and b/docs/images/server-info.png differ diff --git a/docs/images/server-password.png b/docs/images/server-password.png index 6a79255..30ddef9 100644 Binary files a/docs/images/server-password.png and b/docs/images/server-password.png differ diff --git a/docs/images/server-type.png b/docs/images/server-type.png index 5e2d541..e2c6063 100644 Binary files a/docs/images/server-type.png and b/docs/images/server-type.png differ diff --git a/docs/images/ssh-copy-id.png b/docs/images/ssh-copy-id.png index 7786b6e..234305d 100644 Binary files a/docs/images/ssh-copy-id.png and b/docs/images/ssh-copy-id.png differ diff --git a/docs/images/ssh-into-server.png b/docs/images/ssh-into-server.png index efcfaf6..426e47f 100644 Binary files a/docs/images/ssh-into-server.png and b/docs/images/ssh-into-server.png differ diff --git a/docs/images/ufw-status.png b/docs/images/ufw-status.png index fc5ad63..6d41fdd 100644 Binary files a/docs/images/ufw-status.png and b/docs/images/ufw-status.png differ diff --git a/docs/implementations.md b/docs/implementations.md index b852330..cd85030 100644 --- a/docs/implementations.md +++ b/docs/implementations.md @@ -1,13 +1,21 @@ # Relay Implementations -There are many different relay implementations available. For this guide we'll be using [nostr-rs-relay](https://github.com/scsibug/nostr-rs-relay). +There are many different relay implementations available. This guide will demonstrate how to set up multiple implementations. The implementation you choose depends on your use case. -Here are some other implementations: +Implementations: -- [nostream](https://github.com/Cameri/nostream) +- [Khatru Pyramid](https://github.com/github-tijlxyz/khatru-pyramid/tree/main "Khatru Pyramid") -- [strfry](https://github.com/hoytech/strfry) +- [Nostream](https://github.com/Cameri/nostream "Nostream") -After following this guide you should have enough knowledge to setup any of these implementations. +- [nostr-rs-relay](https://github.com/scsibug/nostr-rs-relay/tree/master "nostr-rs-relay") +- [strfry](https://github.com/hoytech/strfry/tree/master "strfry") +- [WoT Relay](https://github.com/bitvora/wot-relay/tree/master "WoT Relay") + +- [relay29 Khatru29](https://github.com/fiatjaf/relay29/tree/v0.4.0/examples/groups.fiatjaf.com "relay29 Khatru29") + +- [relay29 strfry29](https://github.com/fiatjaf/relay29/tree/v0.4.0/strfry29 "relay29 strfry29") + +After following this guide, you should have enough knowledge to setup any of these implementations. diff --git a/docs/index.md b/docs/index.md index 20be477..92aa3f3 100644 --- a/docs/index.md +++ b/docs/index.md @@ -1,11 +1,37 @@ # Relay Runner -This site will help you setup a relay for personal or public use. Relays are servers that transmit notes and other stuff to clients on the [nostr](https://nostr.com/) network and may (or may not) store them as well. +This site will help you setup a relay for personal or public use. Relays are servers that transmit notes and other stuff to clients on the [Nostr](https://nostr.com/ "Nostr") network and may (or may not) store them as well. -## Why run a personal relay? +## Why Run a Personal Relay? Running a personal relay is a great way to keep your notes and other data under your control. You can use it as an archive for all of your data or maybe as a dedicated relay for a personal website. -## Why run a public relay? +## Why Run a Public Relay? -Running a public relay is a great way to decentralize and help the nostr network grow. You also have the option to monetize your relay by charging clients for access. +Running a public relay is a great way to decentralize and help the Nostr network grow. You also have the option to monetize your relay by charging clients for access. + +## What You'll Learn + +The guides will walk you through the process of setting up various relay implementations from scratch. + +You'll learn how to: + +- Get a server + +- Get a domain name + +- Set up remote access using SSH + +- Set up a firewall + +- Configure Nginx + +- Obtain and set up an SSL/TLS certificate + +- Build the relay software + +- Install the relay software + +- Configure your relay + +- Set up a systemd service for your relay diff --git a/docs/relay/free-up-space.md b/docs/relay/free-up-space.md deleted file mode 100644 index e69de29..0000000 diff --git a/docs/relay/khatru-pyramid.md b/docs/relay/khatru-pyramid.md new file mode 100644 index 0000000..2bc348f --- /dev/null +++ b/docs/relay/khatru-pyramid.md @@ -0,0 +1 @@ +# Khatru Pyramid diff --git a/docs/relay/khatru-pyramid/configuration.md b/docs/relay/khatru-pyramid/configuration.md new file mode 100644 index 0000000..a025a48 --- /dev/null +++ b/docs/relay/khatru-pyramid/configuration.md @@ -0,0 +1 @@ +# Configuration diff --git a/docs/relay/khatru-pyramid/install.md b/docs/relay/khatru-pyramid/install.md new file mode 100644 index 0000000..55af1c5 --- /dev/null +++ b/docs/relay/khatru-pyramid/install.md @@ -0,0 +1 @@ +# Install diff --git a/docs/relay/khatru-pyramid/service.md b/docs/relay/khatru-pyramid/service.md new file mode 100644 index 0000000..42321b7 --- /dev/null +++ b/docs/relay/khatru-pyramid/service.md @@ -0,0 +1 @@ +# Service diff --git a/docs/relay/khatru-pyramid/test.md b/docs/relay/khatru-pyramid/test.md new file mode 100644 index 0000000..ceb1228 --- /dev/null +++ b/docs/relay/khatru-pyramid/test.md @@ -0,0 +1 @@ +# Test your Relay diff --git a/docs/relay/nostr-rs-relay.md b/docs/relay/nostr-rs-relay.md new file mode 100644 index 0000000..64ea8ce --- /dev/null +++ b/docs/relay/nostr-rs-relay.md @@ -0,0 +1 @@ +# nostr-rs-relay diff --git a/docs/relay/config.md b/docs/relay/nostr-rs-relay/configuration.md similarity index 86% rename from docs/relay/config.md rename to docs/relay/nostr-rs-relay/configuration.md index b69ddec..d747377 100644 --- a/docs/relay/config.md +++ b/docs/relay/nostr-rs-relay/configuration.md @@ -1,7 +1,5 @@ # Configuration -Update the `nostr-rs-relay` config file with your information and preferences: - ```bash mkdir /etc/nostr-rs-relay cd /etc/nostr-rs-relay @@ -26,7 +24,7 @@ Here are some important settings: - `data_directory` - The directory where your relay will store data. We'll set this to `/var/lib/nostr-rs-relay/data`. -- `max_conn` - Maximum number of SQLite reader connections. Recommend setting this to approx the number of CPU cores. +- `max_conn` - Maximum number of SQLite reader connections. Recommend setting this to approx the number of CPU cores. - `address` - The address your relay will listen on. We'll set this to `127.0.0.1`. diff --git a/docs/relay/install.md b/docs/relay/nostr-rs-relay/install.md similarity index 96% rename from docs/relay/install.md rename to docs/relay/nostr-rs-relay/install.md index 7675db7..7362b73 100644 --- a/docs/relay/install.md +++ b/docs/relay/nostr-rs-relay/install.md @@ -12,13 +12,13 @@ apt install build-essential cmake protobuf-compiler pkg-config libssl-dev We'll also need to install `git` and `rust` to clone and compile the repository. -git: +Install git by running: ```bash apt install git ``` -rust: +Install rust by running: ```bash curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh diff --git a/docs/relay/service.md b/docs/relay/nostr-rs-relay/service.md similarity index 85% rename from docs/relay/service.md rename to docs/relay/nostr-rs-relay/service.md index a2b5951..541d3ec 100644 --- a/docs/relay/service.md +++ b/docs/relay/nostr-rs-relay/service.md @@ -4,14 +4,18 @@ A service is a long-running process that can be started and stopped. It can be u ## Create User -Create a new user called `nostr` to run the relay service. Creating a new user is a good practice to isolate the service from the rest of the system. +Create a new user called `nostr` to run the relay service: ```bash sudo adduser --disabled-login nostr ``` +Creating a new user is a good practice to isolate the service from the rest of the system. + ## Change ownership for data directory +Change ownership of the relay data directory: + ```bash chown -R nostr:nostr /var/lib/nostr-rs-relay ``` diff --git a/docs/relay/test.md b/docs/relay/nostr-rs-relay/test.md similarity index 100% rename from docs/relay/test.md rename to docs/relay/nostr-rs-relay/test.md diff --git a/docs/relay/nostr-rs-relay/websocket-connection.md b/docs/relay/nostr-rs-relay/websocket-connection.md new file mode 100644 index 0000000..d02d45f --- /dev/null +++ b/docs/relay/nostr-rs-relay/websocket-connection.md @@ -0,0 +1,111 @@ +# WebSocket Connection + +Replace the contents of `/etc/nginx/conf.d/relay_relayrunner_xyz.conf` with the following configuration where `relay_relayrunner_xyz.conf` should be replaced by whatever name you used for your Nginx config file: + +```nginx title="relay_relayrunner_xyz.conf" +map $http_upgrade $connection_upgrade { + default upgrade; + '' close; +} + +upstream nostr_rs_relay_websocket { # can replace with a unique upstream WebSocket name that you choose + server 127.0.0.1:8080; +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name relay.relayrunner.xyz; # replace with your domain + + location / { + proxy_pass http://nostr_rs_relay_websocket; # can replace with your unique upstream WebSocket name + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Proto $scheme; + try_files $uri $uri/ =404; + } + + # Only return Nginx in server header + server_tokens off; + + #### SSL Configuration #### + # Test configuration: + # https://www.ssllabs.com/ssltest/analyze.html + # https://cryptcheck.fr/ + ssl_certificate /etc/letsencrypt/live/relay.relayrunner.xyz/fullchain.pem; # replace with your domain + ssl_certificate_key /etc/letsencrypt/live/relay.relayrunner.xyz/privkey.pem; # replace with your domain + # Verify chain of trust of OCSP response using Root CA and Intermediate certs + ssl_trusted_certificate /etc/letsencrypt/live/relay.relayrunner.xyz/chain.pem; # replace with your domain + + ssl_protocols TLSv1.3 TLSv1.2; + + # For more information on the security of different cipher suites, you can refer to the following link: + # https://ciphersuite.info/ + # Compilation of the top cipher suites 2024: + # https://ssl-config.mozilla.org/#server=nginx + ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305"; + + # Perfect Forward Secrecy (PFS) is frequently compromised without this + ssl_prefer_server_ciphers on; + + ssl_session_tickets off; + + # Enable SSL session caching for improved performance + # Try setting ssl_session_timeout to 1d if performance is bad + ssl_session_timeout 10m; + ssl_session_cache shared:SSL:10m; + + # By default, the buffer size is 16k, which corresponds to minimal overhead when sending big responses. + # To minimize Time To First Byte it may be beneficial to use smaller values + ssl_buffer_size 8k; + + # OCSP stapling + ssl_stapling on; + ssl_stapling_verify on; + + #### Security Headers #### + # Test configuration: + # https://securityheaders.com/ + # https://observatory.mozilla.org/ + add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload"; + + add_header X-Frame-Options DENY; + + # Avoid MIME type sniffing + add_header X-Content-Type-Options "nosniff" always; + + add_header Referrer-Policy "no-referrer" always; + + add_header X-XSS-Protection "1; mode=block" always; + + add_header Permissions-Policy "geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()" always; + + #### Content-Security-Policy (CSP) #### + add_header Content-Security-Policy "base-uri 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests;" always; +} + +server { + listen 80; + listen [::]:80; + server_name relay.relayrunner.xyz; # replace with your domain + + location /.well-known/acme-challenge/ { + root /var/www/relay.relayrunner.xyz; # replace with the directory you used to store the challenge files in + allow all; + } + + location / { + return 301 https://relay.relayrunner.xyz$request_uri; # replace with your domain + } +} +``` + +Be sure to replace `relay.relayrunner.xyz` with your domain name and `/var/www/relay.relayrunner.xyz` with the directory you used to store the challenge files in. + +You can also replace `nostr_rs_relay_websocket` with a unique upstream WebSocket name that you choose. + +The proxy headers specified in the `location` block above, the SSL/TLS directives, and the security headers specified above can be changed to meet the specific needs of your relay. There are even more strict values that can be set especially for the `Permissions-Policy` and `Content-Security-Policy` headers depending on your requirements. Be sure to test any changes you make are compatible with the nostr-rs-relay implementation. diff --git a/docs/relay/nostream.md b/docs/relay/nostream.md new file mode 100644 index 0000000..08a0887 --- /dev/null +++ b/docs/relay/nostream.md @@ -0,0 +1 @@ +# Nostream diff --git a/docs/relay/nostream/configuration.md b/docs/relay/nostream/configuration.md new file mode 100644 index 0000000..a025a48 --- /dev/null +++ b/docs/relay/nostream/configuration.md @@ -0,0 +1 @@ +# Configuration diff --git a/docs/relay/nostream/install.md b/docs/relay/nostream/install.md new file mode 100644 index 0000000..55af1c5 --- /dev/null +++ b/docs/relay/nostream/install.md @@ -0,0 +1 @@ +# Install diff --git a/docs/relay/nostream/service.md b/docs/relay/nostream/service.md new file mode 100644 index 0000000..42321b7 --- /dev/null +++ b/docs/relay/nostream/service.md @@ -0,0 +1 @@ +# Service diff --git a/docs/relay/nostream/test.md b/docs/relay/nostream/test.md new file mode 100644 index 0000000..ceb1228 --- /dev/null +++ b/docs/relay/nostream/test.md @@ -0,0 +1 @@ +# Test your Relay diff --git a/docs/relay/relay29-khatru29.md b/docs/relay/relay29-khatru29.md new file mode 100644 index 0000000..a087ed8 --- /dev/null +++ b/docs/relay/relay29-khatru29.md @@ -0,0 +1 @@ +# relay29 Khatru29 diff --git a/docs/relay/relay29-khatru29/configuration.md b/docs/relay/relay29-khatru29/configuration.md new file mode 100644 index 0000000..a025a48 --- /dev/null +++ b/docs/relay/relay29-khatru29/configuration.md @@ -0,0 +1 @@ +# Configuration diff --git a/docs/relay/relay29-khatru29/install.md b/docs/relay/relay29-khatru29/install.md new file mode 100644 index 0000000..55af1c5 --- /dev/null +++ b/docs/relay/relay29-khatru29/install.md @@ -0,0 +1 @@ +# Install diff --git a/docs/relay/relay29-khatru29/service.md b/docs/relay/relay29-khatru29/service.md new file mode 100644 index 0000000..42321b7 --- /dev/null +++ b/docs/relay/relay29-khatru29/service.md @@ -0,0 +1 @@ +# Service diff --git a/docs/relay/relay29-khatru29/test.md b/docs/relay/relay29-khatru29/test.md new file mode 100644 index 0000000..ceb1228 --- /dev/null +++ b/docs/relay/relay29-khatru29/test.md @@ -0,0 +1 @@ +# Test your Relay diff --git a/docs/relay/relay29-strfry29.md b/docs/relay/relay29-strfry29.md new file mode 100644 index 0000000..683a86c --- /dev/null +++ b/docs/relay/relay29-strfry29.md @@ -0,0 +1 @@ +# relay29 strfry29 diff --git a/docs/relay/relay29-strfry29/configuration.md b/docs/relay/relay29-strfry29/configuration.md new file mode 100644 index 0000000..a025a48 --- /dev/null +++ b/docs/relay/relay29-strfry29/configuration.md @@ -0,0 +1 @@ +# Configuration diff --git a/docs/relay/relay29-strfry29/install.md b/docs/relay/relay29-strfry29/install.md new file mode 100644 index 0000000..55af1c5 --- /dev/null +++ b/docs/relay/relay29-strfry29/install.md @@ -0,0 +1 @@ +# Install diff --git a/docs/relay/relay29-strfry29/service.md b/docs/relay/relay29-strfry29/service.md new file mode 100644 index 0000000..42321b7 --- /dev/null +++ b/docs/relay/relay29-strfry29/service.md @@ -0,0 +1 @@ +# Service diff --git a/docs/relay/relay29-strfry29/test.md b/docs/relay/relay29-strfry29/test.md new file mode 100644 index 0000000..ceb1228 --- /dev/null +++ b/docs/relay/relay29-strfry29/test.md @@ -0,0 +1 @@ +# Test your Relay diff --git a/docs/relay/strfry.md b/docs/relay/strfry.md new file mode 100644 index 0000000..8da0ce0 --- /dev/null +++ b/docs/relay/strfry.md @@ -0,0 +1 @@ +# strfry diff --git a/docs/relay/strfry/configuration.md b/docs/relay/strfry/configuration.md new file mode 100644 index 0000000..a025a48 --- /dev/null +++ b/docs/relay/strfry/configuration.md @@ -0,0 +1 @@ +# Configuration diff --git a/docs/relay/strfry/install.md b/docs/relay/strfry/install.md new file mode 100644 index 0000000..55af1c5 --- /dev/null +++ b/docs/relay/strfry/install.md @@ -0,0 +1 @@ +# Install diff --git a/docs/relay/strfry/service.md b/docs/relay/strfry/service.md new file mode 100644 index 0000000..42321b7 --- /dev/null +++ b/docs/relay/strfry/service.md @@ -0,0 +1 @@ +# Service diff --git a/docs/relay/strfry/test.md b/docs/relay/strfry/test.md new file mode 100644 index 0000000..ceb1228 --- /dev/null +++ b/docs/relay/strfry/test.md @@ -0,0 +1 @@ +# Test your Relay diff --git a/docs/relay/wot-relay.md b/docs/relay/wot-relay.md new file mode 100644 index 0000000..8ccd3aa --- /dev/null +++ b/docs/relay/wot-relay.md @@ -0,0 +1 @@ +# WoT Relay diff --git a/docs/relay/wot-relay/configuration.md b/docs/relay/wot-relay/configuration.md new file mode 100644 index 0000000..a025a48 --- /dev/null +++ b/docs/relay/wot-relay/configuration.md @@ -0,0 +1 @@ +# Configuration diff --git a/docs/relay/wot-relay/install.md b/docs/relay/wot-relay/install.md new file mode 100644 index 0000000..55af1c5 --- /dev/null +++ b/docs/relay/wot-relay/install.md @@ -0,0 +1 @@ +# Install diff --git a/docs/relay/wot-relay/service.md b/docs/relay/wot-relay/service.md new file mode 100644 index 0000000..42321b7 --- /dev/null +++ b/docs/relay/wot-relay/service.md @@ -0,0 +1 @@ +# Service diff --git a/docs/relay/wot-relay/test.md b/docs/relay/wot-relay/test.md new file mode 100644 index 0000000..ceb1228 --- /dev/null +++ b/docs/relay/wot-relay/test.md @@ -0,0 +1 @@ +# Test your Relay diff --git a/docs/resources.md b/docs/resources.md index 0d24906..9099bff 100644 --- a/docs/resources.md +++ b/docs/resources.md @@ -1,16 +1,31 @@ # Resources -Learn about nostr: +## Learn about Nostr -- [nostr.com](https://nostr.how/en/relays) -- [nostr.how](https://nostr.how) +- [nostr.com](https://nostr.com "nostr.com") -Other Guides: +- [nostr.how](https://nostr.how "nostr.how") -- [Nostr Relay Setup Guide](https://github.com/BlockChainCaffe/Nostr-Relay-Setup-Guide) -- [How to Setup a Paid Nostr Relay](https://andreneves.xyz/p/how-to-setup-a-paid-nostr-relay) -- [Nostr Relay Quick Start](https://zbd.dev/knowledge-base/guides/nostr-relay) +- [Nostr GitHub](https://github.com/nostr-protocol/nostr "Nostr GitHub") -Relay Quickstart: +- [NIPs](https://github.com/nostr-protocol/nips "NIPs") -- [relay.tools](https://relay.tools/) +## Other Guides + +- [Nostr Relay Setup Guide](https://github.com/BlockChainCaffe/Nostr-Relay-Setup-Guide "Nostr Relay Setup Guide") + +- [How to Setup a Paid Nostr Relay](https://andreneves.xyz/p/how-to-setup-a-paid-nostr-relay "How to Setup a Paid Nostr Relay") + +- [Nostr Relay Quick Start](https://zbd.dev/knowledge-base/guides/nostr-relay "Nostr Relay Quick Start") + +## Relay Quick Start + +- [relay.tools](https://relay.tools "relay.tools") + +- [Relay Wizard](https://relaywizard.com "Relay Wizard") + +## Clients + +- [Damus](https://damus.io "Damus") + +- [NoteStack](https://notestack.com "NoteStack") diff --git a/docs/server/domain-name.md b/docs/server/domain-name.md deleted file mode 100644 index 85cc8c8..0000000 --- a/docs/server/domain-name.md +++ /dev/null @@ -1,40 +0,0 @@ -# Get a Domain Name - -For this guide we'll be using [Namecheap](https://www.namecheap.com/). You can use any domain registrar you like, but the images in this guide will be specific to Namecheap. - -## Register - -First, go to [Namecheap](https://www.namecheap.com/) and search for a domain name. Once you find one you like, add it to your cart and proceed to checkout. You can get a `.xyz` for about $1 for the first year so if you don't want to commit to a domain just yet get one of these to get started. - -![Namecheap Domain Search](../images/namecheap-search.png) - -## Checkout - -Once you're at the checkout screen, you'll see a few options. You can toggle on the switch for `Domain Privacy` which is free and leave the rest toggled off. If you like your domain and plan to keep it I recommend turning on `AUTO-RENEW` as well. - -![Namecheap Checkout](../images/namecheap-checkout.png) - -## DNS - -After your order is processed you can go to your Domain List and see your new domain. You can click on the `Manage` button, and then choose `Advanced DNS` to get started hooking up your domain to the server you created in the last section. We'll be adding a few records so make sure you have the IP addresses from the server from the last section. - -First, remove the default records that name cheap added for you. You should have a `CNAME` record for `www` and an `A` record for `@`. - -![Namecheap Remove Records](../images/namecheap-remove-records.png) - -Now we'll add a few records for `@` which is the root domain (relayrunner.xyz), `www` (www.relayrunner.xyz), and `relay` (relay.relayrunner.xyz). You will need to create an `A` record for each IPv4 address and a `AAAA` record for each Ipv6 address. When you're done it should look like the image below: - -![Namecheap Records](../images/namecheap-records.png) - -## DNS Propagation - -It can take up to 24 hours for your DNS changes to propagate. You can check the status of your DNS changes by going to [WhatsMyDNS.net](https://www.whatsmydns.net/) - -When you enter your domain name you should see the IP addresses you added in the previous step. If you don't see them yet, wait a few hours and check again. - -## Some other places to get a domain - -- [porkbun](https://porkbun.com/) * Pay with Bitcoin -- [hostinger](https://www.hostinger.com/) * Pay with Bitcoin - - diff --git a/docs/server/firewall.md b/docs/server/firewall.md index 4050a60..9cdee82 100644 --- a/docs/server/firewall.md +++ b/docs/server/firewall.md @@ -1,18 +1,129 @@ # Firewall -You should allow traffic on port 80 and 443. +By setting up a firewall we’ll be able to monitor, allow, and block incoming and outgoing network traffic based on security rules that we define. Multiple network ports may be open and listening for incoming connections by default which leaves the relay open to various network based attacks. By monitoring and gaining control over which ports are open and closed we’ll be able to mitigate many of the network based attacks. -Check the status of the firewall: +We’ll be using the [Uncomplicated Firewall (UFW)](https://launchpad.net/ufw "Uncomplicated Firewall (UFW)") which is a firewall configuration tool that allows us to easily manage a [netfilter](https://www.netfilter.org/ "netfilter") firewall by using the provided `ufw` command. + +## Install UFW + +To install UFW run the following command: + +```bash +apt install ufw +``` + +## Status + +To check the status of UFW run the following command: ```bash ufw status ``` -If only SSH is allowed you can allow HTTP and HTTPS traffic by running the following commands: +The output indicates if the firewall is `active` or `inactive`. + +## Default Policy + +Before enabling UFW and activating the firewall, we’re going to first discuss the default policies for incoming and outgoing network traffic. The default policies determine how traffic that doesn’t match a specific rule is controlled. + +By default, UFW is configured to deny all incoming connections and to allow all outgoing connections. This means no one can establish a connection with the server while an application running on the server can establish a connection outside of the server. + +The following commands can be run to reset the default behavior of UFW for incoming and outgoing connections. + +### Deny Incoming + +To deny all incoming connections run the following command: + +```bash +ufw default deny incoming +``` + +### Allow Outgoing + +To allow all outgoing connections run the following command: + +```bash +ufw default allow outgoing +``` + +## Allow Incoming SSH Connections + +When UFW is enabled by default it will block all incoming connections to the relay. With the current configuration of UFW we’ll be disconnected once we enable it since we’re using SSH to access the relay. Therefore, we need to first allow incoming SSH connections before we enable UFW. + +To allow incoming SSH connections we need to open the port the relay is using for SSH. + +If you’re using the default port for the SSH server, i.e., port `22`, you can run the following command to allow incoming SSH connections: + +```bash +ufw allow ssh +``` + +If you changed the default port for the SSH server, then run the following command to allow incoming SSH connections on the custom port: + +```bash +ufw allow +``` + +Here `` should be replaced with the custom listening port number you set for the SSH server. + +## Allow Incoming Nginx Connections + +We're going to set up an Nginx reverse proxy in the next section, so we're going to allow incoming HTTP and HTTPS connections on ports `80` and `443`, respectively. + +To allow incoming HTTP and HTTPS connections you can run the following command: ```bash ufw allow 'Nginx Full' ``` -![ufw status](../images/ufw-status.png) +## Logging + +By default, UFW will keep logs using low mode which means it logs all the packets that are blocked or allowed by the rules we set. + +### Disable Logging + +If you don’t have a valid reason to keep UFW’s logging active, you should disable the logging because it can take up GBs of the relay's storage. + +```bash +ufw logging off +``` +## Enable + +After setting the incoming connections rules and setting the logging preference, we’re now ready to enable UFW which will activate it and apply the rules we set. + +To enable UFW run the following command: + +```bash +ufw enable +``` + +After running the above command, you may receive a warning message that looks similar to: + +```bash +Command may disrupt existing ssh connections. Proceed with operation (y|n)? +``` + +If you successfully configured the rules for the incoming SSH connections, then enter `y` and press enter. + +## Check Status + +After enabling UFW, you can check the status by running the following command: + +```bash +ufw status +``` + +The output indicates if the firewall is `active` or `inactive` as well as all of the rules you set for your firewall. + +The status of your firewall should look similar to the following: + +![UFW Status](../images/ufw-status.png) + +## Enable on Boot + +UFW should already be enabled to start automatically on boot, but if it isn’t then run the following command: + +```bash +systemctl enable ufw +``` diff --git a/docs/server/get-a-domain-name.md b/docs/server/get-a-domain-name.md new file mode 100644 index 0000000..c15550a --- /dev/null +++ b/docs/server/get-a-domain-name.md @@ -0,0 +1,39 @@ +# Get a Domain Name + +For this guide we'll be using [Namecheap](https://www.namecheap.com "Namecheap"). You can use any domain registrar you like, but the images in this guide will be specific to Namecheap. + +## Register + +First, go to Namecheap and search for a domain name. Once you find one you like, add it to your cart and proceed to checkout. You can get a `.xyz` for about $1 for the first year, so if you don't want to commit to a domain just yet get one of these to get started. + +![Namecheap Domain Search](../images/namecheap-domain-search.png) + +## Checkout + +Once you're at the checkout screen, you'll see a few options. You can toggle on the switch for `Domain Privacy` which is free and leave the rest toggled off. If you like your domain and plan to keep it, it's recommended to turn on `AUTO-RENEW` as well. + +![Namecheap Checkout](../images/namecheap-checkout.png) + +## DNS + +After your order is processed, you can go to your Domain List and see your new domain. You can click on the `Manage` button, and then choose `Advanced DNS` to get started hooking up your domain to the server you created in the last section. We'll be adding a few records so make sure you have the IP addresses from the server from the last section. + +First, remove the default records that Namecheap added for you. You should have a `CNAME` record for `www` and an `A` record for `@`. + +![Namecheap Remove Records](../images/namecheap-remove-records.png) + +Now we'll add a few records for `@` which is the root domain (relayrunner.xyz), `www` (www.relayrunner.xyz), and `relay` (relay.relayrunner.xyz). You will need to create an `A` record for each IPv4 address and a `AAAA` record for each Ipv6 address. When you're done it should look like the image below: + +![Namecheap Records](../images/namecheap-records.png) + +## DNS Propagation + +It can take up to 24 hours for your DNS changes to propagate. You can check the status of your DNS changes by going to [whatsmydns.net](https://www.whatsmydns.net "whatsmydns.net") + +When you enter your domain name you should see the IP addresses you added in the previous step. If you don't see them yet, wait a few hours and check again. + +## Domain Name Registrars + +- [Hostinger](https://www.hostinger.com "Hostinger") \* Pay with Bitcoin + +- [Porkbun](https://porkbun.com "Porkbun") \* Pay with Bitcoin diff --git a/docs/server/get-a-server.md b/docs/server/get-a-server.md index ee7919a..7e99e0e 100644 --- a/docs/server/get-a-server.md +++ b/docs/server/get-a-server.md @@ -1,54 +1,60 @@ # Get a Server -For this guide we'll be using a Virtual Private Server (VPS) from [vultr](https://www.vultr.com/?ref=9247696). You can use any VPS provider you like, but I recommend vultr because they have a wide range of locations and their pricing is pretty good. +For this guide we'll be using a Virtual Private Server (VPS) from [Vultr](https://www.vultr.com/?ref=9247696 "Vultr"). You can use any VPS provider you like, but Vultr is recommended because they have a wide range of locations and their pricing is reasonable. ## Create an Account -First, you'll need to create an account on vultr. You can do that [here](https://www.vultr.com/?ref=9247696). +First, you'll need to create an account on Vultr. You can do that on the [Vultr](https://www.vultr.com/?ref=9247696 "Vultr") website. ## Deploy a Server -Once you've created an account, you can deploy a server by clicking on the `Deploy` button. +Once you've created an account, you can deploy a server by clicking on the `Deploy +` button in the top right corner. ## Choose a Server Type -If you're just starting out or just plan to use this as a personal relay, I recommend using the `Cloud Compute - Shared CPU` server type. It will only cost you about $6 per month and will be more than enough to store your own notes and test things out. +If you're just starting out or just plan to use this as a personal relay, it's recommended to use the `Cloud Compute - Shared CPU` server type. It will only cost you about $6 per month and will be more than enough to store your own notes and test things out. -If you plan to run a public relay, you may want to choose a more powerful server type. I recommend their `Optimized Cloud Compute - Dedicated CPU` option. +If you plan to run a public relay, you may want to choose a more powerful server type. In that case it's recommended to use their `Optimized Cloud Compute - Dedicated CPU` option. -![server type](../images/server-type.png) +![Server Type](../images/server-type.png) ## Choose a Server Location -You can choose a server location that is closest to you or your target audience. I'll be choosing `New York (NJ)` since it's closest to my location and I only plan to use this as a personal relay. +You can choose a server location that is closest to you or your target audience. We'll be choosing `New York (NJ)` for our server location. -![choose location](../images/choose-location.png) +![Choose Location](../images/choose-location.png) ## Choose an Operating System -You can choose any operating system you like, but I for this guide I'll be using `Debian 12 x64`. +You can choose any operating system (OS) you like, but we'll be using `Debian 12 x64` for this guide. If you want to follow along exactly, be sure to choose the same OS. -![choose image](../images/choose-image.png) +![Choose Image](../images/choose-image.png) ## Choose a Plan +You'll now need to choose a server type for your relay. + +### Cloud Compute - Shared CPU + If you chose the `Cloud Compute - Shared CPU` server type, you can choose the $6 per month plan since it will likely be more than enough for your needs and you can always upgrade later. -![choose plan personal](../images/choose-plan-personal.png) +![Choose Plan Personal](../images/choose-plan-personal.png) + +### Optimized Cloud Compute - Dedicated CPU -If you chose the `Optimized Cloud Compute - Dedicated CPU` server type, I recommend choosing one of the `Storage Optimized` plans since you'll likely need more storage for a public relay. +If you chose the `Optimized Cloud Compute - Dedicated CPU` server type, it's recommended to choose one of the `Storage Optimized` plans since you'll likely need more storage for a public relay. -![choose plan public](../images/choose-plan-public.png) +![Choose Plan Public](../images/choose-plan-public.png) ## Additional Features -You can add additional features like backups, DDoS protection, and more if you like. I recommend adding backups for peace of mind and you might as well enable IPv6 since it's free and could maybe one day matter. If you're running a public server you might also consider enabling DDoS Protection. +You can add additional features like `Auto Backups`, `IPv6`, `DDoS Protection`, etc. It's recommended to add auto backups for peace of mind, and you might as well enable IPv6 since it's free. If you're running a public server, you might also consider enabling DDoS protection. -![additional features](../images/additional-features.png) +![Additional Features](../images/additional-features.png) ## Server Settings -You have the option to choose an ssh key that will automatically be added to your server. If you don't have one don't worry we'll be settings one up later. +You have the option to choose an SSH key that will automatically be added to your server. If you don't have one, don't worry we'll be setting one up later. ## Server Hostname & Label @@ -56,16 +62,24 @@ You can choose a hostname and label for your server. I recommend choosing someth ## Server Info -After your server is provisioned take note of the IP and IPv6 address since we'll need those in the next section. +After your server is provisioned, take note of the IP address and the IPv6 address since we'll need those in the next section. + +![Server Info](../images/server-info.png) + +## Web Hosting/VPS Services + +Here are some other places to get a server: + +- [Njalla](https://njal.la "Njalla") \* Pay with Bitcoin + +- [OrangeWebsite](https://orangewebsite.com "OrangeWebsite") \* Pay with Bitcoin + +- [1984 Hosting Company](https://1984.hosting "1984 Hosting Company") \* Pay with Bitcoin + +- [AWS](https://aws.amazon.com "AWS") -![server info](../images/server-info.png) +- [DigitalOcean](https://www.digitalocean.com "DigitalOcean") -## Some Other places to get a server +- [Hetzner](https://www.hetzner.com "Hetzner") -- [OrangeWebsite](https://orangewebsite.com/) * Pay with Bitcoin -- [Njalla](https://njal.la/) * Pay with Bitcoin -- [1984 Hosting](https://1984.hosting/) * Pay with Bitcoin -- [Hetzner](https://www.hetzner.com/) -- [AWS](https://aws.amazon.com/) -- [Linode](https://www.linode.com/) -- [Digital Ocean](https://www.digitalocean.com/) +- [Linode](https://www.linode.com "Linode") diff --git a/docs/server/remote-access.md b/docs/server/remote-access.md index ab406ec..30513ab 100644 --- a/docs/server/remote-access.md +++ b/docs/server/remote-access.md @@ -1,45 +1,140 @@ # Remote Access -You will need to access your server remotely to install software, update the server, and manage the relay. This guide will show you how to access your server using SSH. +You'll need to access your server remotely to install software, update the server, and manage the relay. This guide will show you how to access your server using SSH. -## Login to your server +## Login to your Server -You will need to login to your server using SSH. You can do this by running the following command: +You'll need to login to your server using SSH. + +You can do this by running the following command: ```bash -ssh root@relayrunner.xyz # replace with your domain name +ssh root@relayrunner.xyz ``` -![SSH into server](../images/ssh-into-server.png) +Be sure to replace `relayrunner.xyz` with the domain name you're using with your relay. + +### Confirm Fingerprint + +When you first attempt to SSH into the relay from your client you’ll be prompted with the SSH server fingerprint and asked to confirm the connection. + +To confirm the connection answer the prompt by typing `yes` and pressing enter. + +After answering `yes` and establishing the connection the SSH server fingerprint will be stored in the client’s `known_hosts` file which is located in the `.ssh` hidden directory. + +### Enter Password + +You'll then be prompted to enter the password for the user you're using with SSH, i.e., `root` in our case. -You will be prompted to enter your password. You can find the password in your server details. +You can find the password in your server details. ![Server Password](../images/server-password.png) -### [Optional] Login with ssh key +### SSH Login Output + +If the SSH login was successful, the output should look similar to the following: + +![SSH into Server](../images/ssh-into-server.png) + +After successfully logging into your server, it's recommended to set up public key authentication and to disable password authentication or at the very least to change the password provided by your VPS to be something unique and secure. + +## Exit SSH Server + +To exit the SSH server session run the following command: + +```bash +exit +``` + +You should now be returned to the terminal of your client. + +## Public Key Authentication + +Since the relay is visible from the internet and not just present on a Local Area Network (LAN), it needs to be secured against various attacks, e.g., brute forcing your SSH login password. + +To improve the security of the SSH login, we’re going to set up public key authentication and disable password authentication. This improves the security of the SSH login by reducing the possibility of unauthorized access since an SSH key pair will be used to login to the server. Therefore, only someone with physical possession of the private key can easily login to the server. + +Since anyone with the private key will be able to login to the server, it’s important to properly secure the private key by using secure key management practices and to use a passphrase which is used to encrypt the private key. + +### Copy Public Key + +You can copy your SSH public key to your relay by running the following command from your client: + +```bash +ssh-copy-id -i root@relayrunner.xyz +``` + +Be sure to replace `` with the path to the SSH public key you're using with your relay which is located in the `/root/.ssh` directory if you used the default location when generating your SSH key pair. -If you have a ssh key you can use that instead of a password. You can add your ssh key to your server by running the following command: +Also, be sure to replace `relayrunner.xyz` with the domain name you're using with your relay. + +After running the `ssh-copy-id` command you’ll initially be prompted to enter the SSH login password. + +Once you successfully authenticate the user you’ll see output similar to: + +![SSH Copy ID](../images/ssh-copy-id.png) + +The public key will be appended to the `authorized_keys` +file on the relay which will be created if it doesn’t exist, and the connection will be closed. + +The `authorized_keys` file contains all of the public keys that have been copied to the relay and is located in the `/root/.ssh` directory. + +If you ever want to remove a public key, then open the `authorized_keys` file, delete the line containing the public key you want to remove, and save the file. + +### Login + +Now you can login to your relay and you shouldn't be prompted to enter a password since you're using public key authentication: ```bash -ssh-copy-id root@relayrunner.xyz # replace with your domain name +ssh root@relayrunner.xyz ``` -![SSH copy id](../images/ssh-copy-id.png) +## Disable Password Authentication + +To add another layer of security to the relay, we’re going to disable the password authentication for SSH which means only public key authentication will be used to login to the relay. Preventing password authentication protects the relay from various attacks like attempting to brute force or guess the SSH login password. + +Before disabling password authentication, make sure you’re able to login with public key authentication and the user you’re logging in with has `sudo` privileges which should be the case if you’ve been following along. -Now you can login to your server without a password. +To start SSH into the relay using public key authentication if you’re not already logged in. -If you'd like to disable password login you can do so by editing the sshd config file: +Next, we need to open the `sshd_config` file on the relay by running the following command: ```bash nano /etc/ssh/sshd_config ``` -Find the line that says `#PasswordAuthentication yes` uncomment it and change it to `PasswordAuthentication no`. +To disable tunneled clear text passwords locate the `PasswordAuthentication` keyword, uncomment it, and set it to `no`. + +The line should look like the following: + +```bash +PasswordAuthentication no +``` + +To disable challenge-response passwords locate the `KbdInteractiveAuthentication` keyword and set it to `no`. -Find the line that says `UsePAM yes` and change it to `UsePAM no`. +The line should look like the following: -Then reload the ssh service: +```bash +KbdInteractiveAuthentication no +``` + +To disable PAM authentication, account processing, and session processing locate the `UsePAM` keyword and set it to `no`. + +The line should look like the following: + +```bash +UsePAM no +``` + +After editing the file, save and exit. + +For the changes to take effect we need to reload the SSH server which we can do by running the following command: ```bash systemctl reload sshd ``` + +Now, if you attempt to SSH into the relay from a client that doesn’t have access to the private key from your SSH key pair, then the login attempt will be refused without giving the option of entering the SSH login password. + +If you lose access to your SSH keys, then you'll be unable to access the relay remotely using SSH. Be sure to securely backup the passphrase for the private key if you used one as well as the SSH keys using, e.g., a USB. diff --git a/docs/server/reverse-proxy.md b/docs/server/reverse-proxy.md index 32dac89..2824335 100644 --- a/docs/server/reverse-proxy.md +++ b/docs/server/reverse-proxy.md @@ -1,10 +1,16 @@ # Reverse Proxy -A reverse proxy is a server that sits between clients and the backend server(s) that they’re trying to access. It receives requests from clients and forwards them to the backend server(s). The response from the backend server(s) is then sent back to the client. +A reverse proxy is a server that sits between clients and the backend server(s) that the clients are trying to access. It receives requests from clients and forwards them to the backend server(s). The response from the backend server(s) is then sent back to the client. -## Update your server +We'll be setting up an HTTP server with an upstream backend WebSocket server. -You should update your server to make sure you have the latest software. You can do this by running the following command: +Since the server only uses HTTP, the communication between the client and the server isn't encrypted. We'll be going over how to set up an SSL/TLS certificate in the next section to enable HTTPS which will encrypt the communication between the client and the server. + +## Update your Server + +You should update your server to make sure you have the latest software. + +You can do this by running the following command: ```bash apt update && apt upgrade -y @@ -12,66 +18,128 @@ apt update && apt upgrade -y ## Install Nginx +Install Nginx by running the following command: + ```bash apt install nginx ``` ## Configure Nginx -Add a configuration file for your site in the `/etc/nginx/conf.d/` directory. +You now need to add an Nginx config file for your site in the `/etc/nginx/conf.d` directory. + +First, navigate to the `/etc/nginx/conf.d` directory by running: ```bash -cd /etc/nginx/conf.d/ +cd /etc/nginx/conf.d ``` -You can name the file whatever you'd like, but it should end with `.conf`. Here is an example configuration file for a relay: +You can name the file whatever you'd like, but it should end with `.conf`. -```nginx title="relay.conf" -map $http_upgrade $connection_upgrade { - default upgrade; - '' close; -} +We'll be naming the file using the `relay` subdomain we previously set up in [Namecheap](https://www.namecheap.com "Namecheap"), i.e., `relay.relayrunner.xyz`. -upstream websocket { - server 127.0.0.1:8080; -} +To create the file run the following command: + +```bash +touch relay_relayrunner_xyz.conf +``` + +Be sure to replace `relay_relayrunner_xyz.conf` with your Nginx config file name. +Here's an example config file for `relay_relayrunner_xyz.conf`: + +```nginx title="relay_relayrunner_xyz.conf" server { listen 80; listen [::]:80; server_name relay.relayrunner.xyz; # replace with your domain location /.well-known/acme-challenge/ { - root /var/www/relayrunner; # replace with your domain + root /var/www/relay.relayrunner.xyz; # replace with your domain allow all; } location / { - proxy_pass http://websocket; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $connection_upgrade; - proxy_set_header Host $host; - proxy_set_header X-Forwarded-For $remote_addr; + try_files $uri $uri/ =404; } + + # Only return Nginx in server header + server_tokens off; + + #### Security Headers #### + # Test configuration: + # https://securityheaders.com/ + # https://observatory.mozilla.org/ + add_header X-Frame-Options DENY; + + # Avoid MIME type sniffing + add_header X-Content-Type-Options "nosniff" always; + + add_header Referrer-Policy "no-referrer" always; + + add_header X-XSS-Protection "1; mode=block" always; + + add_header Permissions-Policy "geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()" always; + + #### Content-Security-Policy (CSP) #### + add_header Content-Security-Policy "base-uri 'self'; object-src 'none'; frame-ancestors 'none';" always; } ``` -Make sure to replace `relayrunner` with your domain name. +Be sure to replace `relay.relayrunner.xyz` with your domain name. -## Reload Nginx +The security headers specified above can be changed to meet the specific needs of your relay. The values chosen here place an emphasis on security and privacy, but there are even more strict values that can be set depending on your use case. + +If you want to properly secure your server, be sure to set up an SSL/TLS certificate in the next section. + +## Test Nginx -now test your config and restart Nginx to apply the changes: +Now you can test your Nginx configuration: ```bash -nginx -t # if this command fails, you have a syntax error in your config +nginx -t +``` + +If this command fails, you most likely have a syntax error in your Nginx config file. + +## Reload Nginx + +After successfully testing your Nginx config file, you can reload Nginx to apply the changes: -systemctl restart nginx +```bash +systemctl reload nginx ``` -## Nginx Resources +## Resources + +If you want to learn more about Nginx, security headers, and the Content Security Policy (CSP), be sure to check out the resources below. + +### Nginx + +- [Nginx Product Documentation](https://docs.nginx.com "Nginx Product Documentation") + +- [Beginner's Guide](https://nginx.org/en/docs/beginners_guide.html "Beginner's Guide") + +- [Nginx Directory Structure](https://wiki.debian.org/Nginx/DirectoryStructure "Nginx Directory Structure") + +- [Nginx Configuration Generator](https://www.digitalocean.com/community/tools/nginx "Nginx Configuration Generator") + +### Content Security Policy (CSP) + +- [Content Security Policy - An Introduction](https://scotthelme.co.uk/content-security-policy-an-introduction "Content Security Policy - An Introduction") + +- [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP "Content Security Policy (CSP)") + +- [Content security policy](https://web.dev/articles/csp "Content security policy") + +- [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy "Content-Security-Policy") + +### Security Headers + +- [Hardening your HTTP response headers](https://scotthelme.co.uk/hardening-your-http-response-headers "Hardening your HTTP response headers") + +- [A new security header: Referrer Policy](https://scotthelme.co.uk/a-new-security-header-referrer-policy "A new security header: Referrer Policy") + +- [A new security header: Feature Policy](https://scotthelme.co.uk/a-new-security-header-feature-policy "A new security header: Feature Policy") -- [Nginx Documentation](https://docs.nginx.com/) -- [Nginx Configuration](https://nginx.org/en/docs/beginners_guide.html) -- [Nginx Directory Structure](https://wiki.debian.org/Nginx/DirectoryStructure) -- [Nginx Configuration Generator](https://www.digitalocean.com/community/tools/nginx) +- [Goodbye Feature Policy and hello Permissions Policy!](https://scotthelme.co.uk/goodbye-feature-policy-and-hello-permissions-policy "Goodbye Feature Policy and hello Permissions Policy!") diff --git a/docs/server/ssl-tls-certificate.md b/docs/server/ssl-tls-certificate.md new file mode 100644 index 0000000..9558d21 --- /dev/null +++ b/docs/server/ssl-tls-certificate.md @@ -0,0 +1,214 @@ +# SSL/TLS Certificate + +SSL/TLS certificates are used to secure the connection between the client and the server. This is important for protecting sensitive information such as passwords and personal information. The certificates are used to encrypt the data that is sent between the client and the server. This ensures that the data cannot be intercepted by a third party. + +By generating SSL/TLS certificates for our server, we'll be enabling the ability to use HTTPS on the server which we'll then configure for Nginx. + +## Install Certbot + +Certbot is a tool that can be used to automatically generate and renew SSL/TLS certificates. + +To install Certbot on your server run: + +```bash +apt install certbot python3-certbot-nginx +``` + +## Add acme-challenge Directory + +To generate the SSL/TLS certificate, we need to create a directory to store the challenge files: + +```bash +mkdir -p /var/www/relay.relayrunner.xyz/.well-known/acme-challenge +``` + +The `acme-challenge` directory will be used by Certbot to verify that you own the domain. + +Be sure to replace the `relay.relayrunner.xyz` directory with your domain name that you're using for your relay. + +## Generate SSL/TLS Certificate + +Generate the SSL/TLS certificate using Certbot: + +```bash +certbot certonly --webroot -w /var/www/relay.relayrunner.xyz -d relay.relayrunner.xyz +``` + +Be sure to replace `relay.relayrunner.xyz` with your domain name that you're using for your relay. + +### Certbot Email + +If this is your first time running Certbot on your server, you'll be prompted to provide an email address which is used to send warnings about upcoming certificate expirations as well as warnings about using a deprecated and possibly insecure setup. + +If you don't want to provide an email, leave the input empty. It's possible to add an email to your Certbot account later if you decide you do want to receive the notifications. + +If you do provide an email, you'll be asked if you want to share your email with the Electronic Frontier Foundation (EFF) to receive news, campaigns, ways to support digital freedom, etc. If you don't want to receive EFF emails, type `n` and press enter. + +To add an email to your Certbot account and to update the email associated with your Certbot account run the following command: + +```bash +certbot update_account --email your-email@example.com +``` + +Be sure to replace `your-email@example.com` with the email address you want to use with your Certbot account. + +## Configure Nginx + +Replace the contents of `/etc/nginx/conf.d/relay_relayrunner_xyz.conf` with the following configuration where `relay_relayrunner_xyz.conf` should be replaced by whatever name you used for your Nginx config file: + +```nginx title="relay_relayrunner_xyz.conf" +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name relay.relayrunner.xyz; # replace with your domain + + location / { + try_files $uri $uri/ =404; + } + + # Only return Nginx in server header + server_tokens off; + + #### SSL Configuration #### + # Test configuration: + # https://www.ssllabs.com/ssltest/analyze.html + # https://cryptcheck.fr/ + ssl_certificate /etc/letsencrypt/live/relay.relayrunner.xyz/fullchain.pem; # replace with your domain + ssl_certificate_key /etc/letsencrypt/live/relay.relayrunner.xyz/privkey.pem; # replace with your domain + # Verify chain of trust of OCSP response using Root CA and Intermediate certs + ssl_trusted_certificate /etc/letsencrypt/live/relay.relayrunner.xyz/chain.pem; # replace with your domain + + ssl_protocols TLSv1.3 TLSv1.2; + + # For more information on the security of different cipher suites, you can refer to the following link: + # https://ciphersuite.info/ + # Compilation of the top cipher suites 2024: + # https://ssl-config.mozilla.org/#server=nginx + ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305"; + + # Perfect Forward Secrecy (PFS) is frequently compromised without this + ssl_prefer_server_ciphers on; + + ssl_session_tickets off; + + # Enable SSL session caching for improved performance + # Try setting ssl_session_timeout to 1d if performance is bad + ssl_session_timeout 10m; + ssl_session_cache shared:SSL:10m; + + # By default, the buffer size is 16k, which corresponds to minimal overhead when sending big responses. + # To minimize Time To First Byte it may be beneficial to use smaller values + ssl_buffer_size 8k; + + # OCSP stapling + ssl_stapling on; + ssl_stapling_verify on; + + #### Security Headers #### + # Test configuration: + # https://securityheaders.com/ + # https://observatory.mozilla.org/ + add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload"; + + add_header X-Frame-Options DENY; + + # Avoid MIME type sniffing + add_header X-Content-Type-Options "nosniff" always; + + add_header Referrer-Policy "no-referrer" always; + + add_header X-XSS-Protection "1; mode=block" always; + + add_header Permissions-Policy "geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()" always; + + #### Content-Security-Policy (CSP) #### + add_header Content-Security-Policy "base-uri 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests;" always; +} + +server { + listen 80; + listen [::]:80; + server_name relay.relayrunner.xyz; # replace with your domain + + location /.well-known/acme-challenge/ { + root /var/www/relay.relayrunner.xyz; # replace with the directory you used to store the challenge files in + allow all; + } + + location / { + return 301 https://relay.relayrunner.xyz$request_uri; # replace with your domain + } +} +``` + +Be sure to replace `relay.relayrunner.xyz` with your domain name and `/var/www/relay.relayrunner.xyz` with the directory you used to store the challenge files in. + +The SSL/TLS directives and the security headers specified above can be changed to meet the specific needs of your relay. The values chosen here place an emphasis on security and privacy. There are even more strict values that can be set especially for the `Permissions-Policy` and `Content-Security-Policy` headers depending on your requirements. + +## Test Nginx + +Now you can test your Nginx configuration: + +```bash +nginx -t +``` + +If this command fails, you most likely have a syntax error in your Nginx config file. + +## Reload Nginx + +After successfully testing your Nginx config file, you can reload Nginx to apply the changes: + +```bash +systemctl reload nginx +``` + +## Resources + +If you want to learn more about Nginx, security headers, the Content Security Policy (CSP), and how to test your configuration, be sure to check out the resources below. + +### Nginx + +- [Nginx Product Documentation](https://docs.nginx.com "Nginx Product Documentation") + +- [Beginner's Guide](https://nginx.org/en/docs/beginners_guide.html "Beginner's Guide") + +- [Nginx Directory Structure](https://wiki.debian.org/Nginx/DirectoryStructure "Nginx Directory Structure") + +- [How I configure my sites in NGINX](https://blog.jeanbruenn.info/2021/08/12/how-i-configure-my-sites-in-nginx "How I configure my sites in NGINX") + +- [Nginx Configuration Generator](https://www.digitalocean.com/community/tools/nginx "Nginx Configuration Generator") + +- [moz://a SSL Configuration Generator](https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=modern&openssl=1.1.1d&guideline=5.7 "moz://a SSL Configuration Generator") + +### Content Security Policy (CSP) + +- [Content Security Policy - An Introduction](https://scotthelme.co.uk/content-security-policy-an-introduction "Content Security Policy - An Introduction") + +- [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP "Content Security Policy (CSP)") + +- [Content security policy](https://web.dev/articles/csp "Content security policy") + +- [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy "Content-Security-Policy") + +### Security Headers + +- [Hardening your HTTP response headers](https://scotthelme.co.uk/hardening-your-http-response-headers "Hardening your HTTP response headers") + +- [A new security header: Referrer Policy](https://scotthelme.co.uk/a-new-security-header-referrer-policy "A new security header: Referrer Policy") + +- [A new security header: Feature Policy](https://scotthelme.co.uk/a-new-security-header-feature-policy "A new security header: Feature Policy") + +- [Goodbye Feature Policy and hello Permissions Policy!](https://scotthelme.co.uk/goodbye-feature-policy-and-hello-permissions-policy "Goodbye Feature Policy and hello Permissions Policy!") + +### Tests + +- [Qualys SSL Labs](https://www.ssllabs.com "Qualys SSL Labs") + +- [CryptCheck](https://cryptcheck.fr "CryptCheck") + +- [Security Headers](https://securityheaders.com "Security Headers") + +- [Observatory](https://observatory.mozilla.org "Observatory") + +- [webbkoll](https://webbkoll.dataskydd.net/en "webbkoll") diff --git a/docs/server/ssl.md b/docs/server/ssl.md deleted file mode 100644 index fc0d69e..0000000 --- a/docs/server/ssl.md +++ /dev/null @@ -1,93 +0,0 @@ -# SSL/TLS Certificate - -SSL/TLS certificates are used to secure the connection between the client and the server. This is important for protecting sensitive information such as passwords and personal information. The certificates are used to encrypt the data that is sent between the client and the server. This ensures that the data cannot be intercepted by a third party. - -## Install Certbot - -Certbot is a tool that can be used to automatically generate and renew SSL/TLS certificates. - -```bash -apt install certbot python3-certbot-nginx -``` - -## Add acme-challenge directory - -To generate the SSL/TLS certificate, we need to create a directory to store the challenge files. This directory will be used by Certbot to verify that you own the domain. Replace this directory name with your domain name. - -```bash -mkdir -p /var/www/relayrunner # replace with your domain - -mkdir -p /var/www/relayrunner/.well-known/acme-challenge/ # replace with your domain -``` - -## Generate SSL/TLS Certificate - -Generate the SSL/TLS certificate using Certbot. Replace `relayrunner.xyz` with your domain name. - -```bash -certbot certonly --webroot -w /var/www/relayrunner -d relay.relayrunner.xyz # replace with your domain -``` - -## Configure Nginx - -Replace the contents of `/etc/nginx/conf.d/relay.conf` with the following configuration: - -```nginx title="relay.conf" -map $http_upgrade $connection_upgrade { - default upgrade; - '' close; -} - -upstream websocket { - server 127.0.0.1:8080; -} - -server { - listen 443 ssl; - listen [::]:443 ssl; - server_name relay.relayrunner.xyz; # replace with your domain - - location / { - proxy_pass http://websocket; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $connection_upgrade; - proxy_set_header Host $host; - proxy_set_header X-Forwarded-For $remote_addr; - } - - #### SSL Configuration #### - ssl_certificate /etc/letsencrypt/live/relayrunner.xyz/fullchain.pem; # replace with your domain - ssl_certificate_key /etc/letsencrypt/live/relayrunner.xyz/privkey.pem; # replace with your domain - - ssl_session_cache shared:SSL:10m; - ssl_session_timeout 10m; - ssl_protocols TLSv1.2 TLSv1.1 TLSv1; - ssl_prefer_server_ciphers on; - ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"; - ssl_stapling on; - ssl_stapling_verify on; - ssl_ecdh_curve secp384r1; - - add_header Strict-Transport-Security "max-age=31536000; includeSubdomains"; - add_header X-Frame-Options DENY; - add_header X-Content-Type-Options nosniff; - add_header X-XSS-Protection "1; mode=block"; - add_header Referrer-Policy same-origin; - add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;"; -} -``` - -## Reload Nginx - -First, test the configuration to make sure there are no syntax errors: - -```bash -nginx -t -``` - -If that went well, reload Nginx to apply the changes: - -```bash -systemctl reload nginx -``` \ No newline at end of file diff --git a/mkdocs.yml b/mkdocs.yml index 6542b9f..6cec1fa 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -3,23 +3,60 @@ nav: - Home: - Introduction: index.md - Implementations: implementations.md + - Contact: contact.md - Resources: resources.md - FAQ: faq.md - Server: - Get a Server: server/get-a-server.md - - Get a Domain Name: server/domain-name.md + - Get a Domain Name: server/get-a-domain-name.md - Remote Access: server/remote-access.md - - Reverse Proxy: server/reverse-proxy.md - Firewall: server/firewall.md - - SSL/TLS Certificate: server/ssl.md + - Reverse Proxy: server/reverse-proxy.md + - SSL/TLS Certificate: server/ssl-tls-certificate.md - Relay: - - Install: relay/install.md - - Configure: relay/config.md - - Service: relay/service.md - # - Free up Space: relay/free-up-space.md - - Test Your Relay: relay/test.md + - Khatru Pyramid: relay/khatru-pyramid.md + - Install: relay/khatru-pyramid/install.md + - Configuration: relay/khatru-pyramid/configuration.md + - Service: relay/khatru-pyramid/service.md + - Test Your Relay: relay/khatru-pyramid/test.md + + - Nostream: relay/nostream.md + - Install: relay/nostream/install.md + - Configuration: relay/nostream/configuration.md + - Service: relay/nostream/service.md + - Test Your Relay: relay/nostream/test.md + + - nostr-rs-relay: relay/nostr-rs-relay.md + - Install: relay/nostr-rs-relay/install.md + - Configuration: relay/nostr-rs-relay/configuration.md + - Service: relay/nostr-rs-relay/service.md + - Test Your Relay: relay/nostr-rs-relay/test.md + + - strfry: relay/strfry.md + - Install: relay/strfry/install.md + - Configuration: relay/strfry/configuration.md + - Service: relay/strfry/service.md + - Test Your Relay: relay/strfry/test.md + + - WoT Relay: relay/wot-relay.md + - Install: relay/wot-relay/install.md + - Configuration: relay/wot-relay/configuration.md + - Service: relay/wot-relay/service.md + - Test Your Relay: relay/wot-relay/test.md + + - relay29 Khatru29: relay/relay29-khatru29.md + - Install: relay/relay29-khatru29/install.md + - Configuration: relay/relay29-khatru29/configuration.md + - Service: relay/relay29-khatru29/service.md + - Test Your Relay: relay/relay29-khatru29/test.md + + - relay29 strfry29: relay/relay29-strfry29.md + - Install: relay/relay29-strfry29/install.md + - Configuration: relay/relay29-strfry29/configuration.md + - Service: relay/relay29-strfry29/service.md + - Test Your Relay: relay/relay29-strfry29/test.md - Donate: - bitcoin: donate/index.md @@ -97,11 +134,11 @@ extra: generator: false social: - icon: fontawesome/brands/twitter - link: https://twitter.com/@chrisatmachine - name: chrisatmachine on Twitter + link: https://x.com/node_tec + name: NODE-TEC on Twitter - icon: fontawesome/brands/youtube - link: https://youtube.com/@chrisatmachine - name: chrisatmachine on YouTube + link: https://www.youtube.com/@nodetec + name: NODE-TEC on YouTube - icon: fontawesome/brands/github link: https://github.com/nodetec name: NODE-TEC on GitHub diff --git a/nginx.conf b/nginx.conf index 25b8ed9..d0b208a 100644 --- a/nginx.conf +++ b/nginx.conf @@ -1,5 +1,4 @@ server { - listen 80; listen [::]:80;