Browse Source
🐳 Docker Implementation: - Add Dockerfile with Alpine Linux (46MB image) - Add docker-compose.yml with production-ready config - Add manage-relay.sh for easy local management - Add stella-relay.service for systemd auto-start - Published images: silberengel/orly-relay:latest, :v1, :v2 🔧 Apache Reverse Proxy: - Add comprehensive Apache proxy guide for Plesk and standard Apache - Add working WebSocket proxy configuration (ws:// not http://) - Add troubleshooting guide based on real deployment experience - Add debug-websocket.sh script for systematic diagnosismain
9 changed files with 1177 additions and 0 deletions
@ -0,0 +1,188 @@
@@ -0,0 +1,188 @@
|
||||
# Docker Deployment Guide |
||||
|
||||
## Quick Start |
||||
|
||||
### 1. Basic Relay Setup |
||||
|
||||
```bash |
||||
# Build and start the relay |
||||
docker-compose up -d |
||||
|
||||
# View logs |
||||
docker-compose logs -f stella-relay |
||||
|
||||
# Stop the relay |
||||
docker-compose down |
||||
``` |
||||
|
||||
### 2. With Nginx Proxy (for SSL/domain setup) |
||||
|
||||
```bash |
||||
# Start relay with nginx proxy |
||||
docker-compose --profile proxy up -d |
||||
|
||||
# Configure SSL certificates in nginx/ssl/ |
||||
# Then update nginx/nginx.conf to enable HTTPS |
||||
``` |
||||
|
||||
## Configuration |
||||
|
||||
### Environment Variables |
||||
|
||||
Copy `env.example` to `.env` and customize: |
||||
|
||||
```bash |
||||
cp env.example .env |
||||
# Edit .env with your settings |
||||
``` |
||||
|
||||
Key settings: |
||||
- `ORLY_OWNERS`: Owner npubs (comma-separated, full control) |
||||
- `ORLY_ADMINS`: Admin npubs (comma-separated, deletion permissions) |
||||
- `ORLY_PORT`: Port to listen on (default: 7777) |
||||
- `ORLY_MAX_CONNECTIONS`: Max concurrent connections |
||||
- `ORLY_CONCURRENT_WORKERS`: CPU cores for concurrent processing (0 = auto) |
||||
|
||||
### Data Persistence |
||||
|
||||
The relay data is stored in `./data` directory which is mounted as a volume. |
||||
|
||||
### Performance Tuning |
||||
|
||||
Based on the v0.4.8 optimizations: |
||||
- Concurrent event publishing using all CPU cores |
||||
- Optimized BadgerDB access patterns |
||||
- Configurable batch sizes and cache settings |
||||
|
||||
## Development |
||||
|
||||
### Local Build |
||||
|
||||
```bash |
||||
# Pull the latest image (recommended) |
||||
docker pull silberengel/orly-relay:latest |
||||
|
||||
# Or build locally if needed |
||||
docker build -t silberengel/orly-relay:latest . |
||||
|
||||
# Run with custom settings |
||||
docker run -p 7777:7777 -v $(pwd)/data:/data silberengel/orly-relay:latest |
||||
``` |
||||
|
||||
### Testing |
||||
|
||||
```bash |
||||
# Test WebSocket connection |
||||
websocat ws://localhost:7777 |
||||
|
||||
# Run stress tests (if available in cmd/stresstest) |
||||
go run ./cmd/stresstest -relay ws://localhost:7777 |
||||
``` |
||||
|
||||
## Production Deployment |
||||
|
||||
### SSL Setup |
||||
|
||||
1. Get SSL certificates (Let's Encrypt recommended) |
||||
2. Place certificates in `nginx/ssl/` |
||||
3. Update `nginx/nginx.conf` to enable HTTPS |
||||
4. Start with proxy profile: `docker-compose --profile proxy up -d` |
||||
|
||||
### Monitoring |
||||
|
||||
- Health checks are configured for both services |
||||
- Logs are rotated (max 10MB, 3 files) |
||||
- Resource limits are set to prevent runaway processes |
||||
|
||||
### Security |
||||
|
||||
- Runs as non-root user (uid 1000) |
||||
- Rate limiting configured in nginx |
||||
- Configurable authentication and event size limits |
||||
|
||||
## Troubleshooting |
||||
|
||||
### Common Issues (Real-World Experience) |
||||
|
||||
#### **Container Issues:** |
||||
1. **Port already in use**: Change `ORLY_PORT` in docker-compose.yml |
||||
2. **Permission denied**: Ensure `./data` directory is writable |
||||
3. **Container won't start**: Check logs with `docker logs container-name` |
||||
|
||||
#### **WebSocket Issues:** |
||||
4. **HTTP 426 instead of WebSocket upgrade**: |
||||
- Use `ws://127.0.0.1:7777` in proxy config, not `http://` |
||||
- Ensure `proxy_wstunnel` module is enabled |
||||
5. **Connection refused in browser but works with websocat**: |
||||
- Clear browser cache and service workers |
||||
- Try incognito mode |
||||
- Add CORS headers to Apache/nginx config |
||||
|
||||
#### **Plesk-Specific Issues:** |
||||
6. **Plesk not applying Apache directives**: |
||||
- Check if config appears in `/etc/apache2/plesk.conf.d/vhosts/domain.conf` |
||||
- Use direct Apache override if Plesk interface fails |
||||
7. **Virtual host conflicts**: |
||||
- Check precedence with `apache2ctl -S` |
||||
- Remove conflicting Plesk configs if needed |
||||
|
||||
#### **SSL Certificate Issues:** |
||||
8. **Self-signed certificate after Let's Encrypt**: |
||||
- Plesk might not be using the correct certificate |
||||
- Import Let's Encrypt certs into Plesk or use direct Apache config |
||||
|
||||
### Debug Commands |
||||
|
||||
```bash |
||||
# Container debugging |
||||
docker ps | grep relay |
||||
docker logs stella-relay |
||||
curl -I http://127.0.0.1:7777 # Should return HTTP 426 |
||||
|
||||
# WebSocket testing |
||||
echo '["REQ","test",{}]' | websocat wss://domain.com/ |
||||
echo '["REQ","test",{}]' | websocat wss://domain.com/ws/ |
||||
|
||||
# Apache debugging (for reverse proxy issues) |
||||
apache2ctl -S | grep domain.com |
||||
apache2ctl -M | grep -E "(proxy|rewrite)" |
||||
grep ProxyPass /etc/apache2/plesk.conf.d/vhosts/domain.conf |
||||
``` |
||||
|
||||
### Logs |
||||
|
||||
```bash |
||||
# View relay logs |
||||
docker-compose logs -f stella-relay |
||||
|
||||
# View nginx logs (if using proxy) |
||||
docker-compose logs -f nginx |
||||
|
||||
# Apache logs (for reverse proxy debugging) |
||||
sudo tail -f /var/log/apache2/error.log |
||||
sudo tail -f /var/log/apache2/domain-error.log |
||||
``` |
||||
|
||||
### Working Reverse Proxy Config |
||||
|
||||
**For Apache (direct config file):** |
||||
```apache |
||||
<VirtualHost SERVER_IP:443> |
||||
ServerName domain.com |
||||
SSLEngine on |
||||
SSLCertificateFile /etc/letsencrypt/live/domain.com/fullchain.pem |
||||
SSLCertificateKeyFile /etc/letsencrypt/live/domain.com/privkey.pem |
||||
|
||||
# Direct WebSocket proxy for Nostr relay |
||||
ProxyRequests Off |
||||
ProxyPreserveHost On |
||||
ProxyPass / ws://127.0.0.1:7777/ |
||||
ProxyPassReverse / ws://127.0.0.1:7777/ |
||||
|
||||
Header always set Access-Control-Allow-Origin "*" |
||||
</VirtualHost> |
||||
``` |
||||
|
||||
--- |
||||
|
||||
*Crafted for Stella's digital forest* 🌲 |
||||
@ -0,0 +1,78 @@
@@ -0,0 +1,78 @@
|
||||
# Dockerfile for Stella's Nostr Relay (next.orly.dev) |
||||
# Owner: npub1v30tsz9vw6ylpz63g0a702nj3xa26t3m7p5us8f2y2sd8v6cnsvq465zjx |
||||
|
||||
FROM golang:alpine AS builder |
||||
|
||||
# Install build dependencies |
||||
RUN apk add --no-cache \ |
||||
git \ |
||||
build-base \ |
||||
autoconf \ |
||||
automake \ |
||||
libtool \ |
||||
pkgconfig |
||||
|
||||
# Install secp256k1 library from Alpine packages |
||||
RUN apk add --no-cache libsecp256k1-dev |
||||
|
||||
# Set working directory |
||||
WORKDIR /build |
||||
|
||||
# Copy go modules first (for better caching) |
||||
COPY go.mod go.sum ./ |
||||
RUN go mod download |
||||
|
||||
# Copy source code |
||||
COPY . . |
||||
|
||||
# Build the relay with optimizations from v0.4.8 |
||||
RUN CGO_ENABLED=1 GOOS=linux go build -ldflags "-w -s" -o relay . |
||||
|
||||
# Create non-root user for security |
||||
RUN adduser -D -u 1000 stella && \ |
||||
chown -R 1000:1000 /build |
||||
|
||||
# Final stage - minimal runtime image |
||||
FROM alpine:latest |
||||
|
||||
# Install only runtime dependencies |
||||
RUN apk add --no-cache \ |
||||
ca-certificates \ |
||||
curl \ |
||||
libsecp256k1 \ |
||||
libsecp256k1-dev |
||||
|
||||
WORKDIR /app |
||||
|
||||
# Copy binary from builder |
||||
COPY --from=builder /build/relay /app/relay |
||||
|
||||
# Create runtime user and directories |
||||
RUN adduser -D -u 1000 stella && \ |
||||
mkdir -p /data /profiles /app && \ |
||||
chown -R 1000:1000 /data /profiles /app |
||||
|
||||
# Expose the relay port |
||||
EXPOSE 7777 |
||||
|
||||
# Set environment variables for Stella's relay |
||||
ENV ORLY_DATA_DIR=/data |
||||
ENV ORLY_LISTEN=0.0.0.0 |
||||
ENV ORLY_PORT=7777 |
||||
ENV ORLY_LOG_LEVEL=info |
||||
ENV ORLY_MAX_CONNECTIONS=1000 |
||||
ENV ORLY_OWNERS=npub1v30tsz9vw6ylpz63g0a702nj3xa26t3m7p5us8f2y2sd8v6cnsvq465zjx |
||||
ENV ORLY_ADMINS=npub1v30tsz9vw6ylpz63g0a702nj3xa26t3m7p5us8f2y2sd8v6cnsvq465zjx,npub1l5sga6xg72phsz5422ykujprejwud075ggrr3z2hwyrfgr7eylqstegx9z |
||||
|
||||
# Health check to ensure relay is responding |
||||
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \ |
||||
CMD sh -c "code=\$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:7777 || echo 000); echo \$code | grep -E '^(101|200|400|404|426)$' >/dev/null || exit 1" |
||||
|
||||
# Create volume for persistent data |
||||
VOLUME ["/data"] |
||||
|
||||
# Drop privileges and run as stella user |
||||
USER 1000:1000 |
||||
|
||||
# Run Stella's Nostr relay |
||||
CMD ["/app/relay"] |
||||
@ -0,0 +1,101 @@
@@ -0,0 +1,101 @@
|
||||
# Service Worker Certificate Caching Fix |
||||
|
||||
## 🚨 **Problem** |
||||
When accessing Jumble from the ImWald landing page, the service worker serves a cached self-signed certificate instead of the new Let's Encrypt certificate. |
||||
|
||||
## ⚡ **Solutions** |
||||
|
||||
### **Option 1: Force Service Worker Update** |
||||
Add this to your Jumble app's service worker or main JavaScript: |
||||
|
||||
```javascript |
||||
// Force service worker update and certificate refresh |
||||
if ('serviceWorker' in navigator) { |
||||
navigator.serviceWorker.getRegistrations().then(function(registrations) { |
||||
for(let registration of registrations) { |
||||
registration.update(); // Force update |
||||
} |
||||
}); |
||||
} |
||||
|
||||
// Clear all caches on certificate update |
||||
if ('caches' in window) { |
||||
caches.keys().then(function(names) { |
||||
for (let name of names) { |
||||
caches.delete(name); |
||||
} |
||||
}); |
||||
} |
||||
``` |
||||
|
||||
### **Option 2: Update Service Worker Cache Strategy** |
||||
In your service worker file, add cache busting for SSL-sensitive requests: |
||||
|
||||
```javascript |
||||
// In your service worker |
||||
self.addEventListener('fetch', function(event) { |
||||
// Don't cache HTTPS requests that might have certificate issues |
||||
if (event.request.url.startsWith('https://') && |
||||
event.request.url.includes('imwald.eu')) { |
||||
event.respondWith( |
||||
fetch(event.request, { cache: 'no-store' }) |
||||
); |
||||
return; |
||||
} |
||||
|
||||
// Your existing fetch handling... |
||||
}); |
||||
``` |
||||
|
||||
### **Option 3: Version Your Service Worker** |
||||
Update your service worker with a new version number: |
||||
|
||||
```javascript |
||||
// At the top of your service worker |
||||
const CACHE_VERSION = 'v2.0.1'; // Increment this when certificates change |
||||
const CACHE_NAME = `jumble-cache-${CACHE_VERSION}`; |
||||
|
||||
// Clear old caches |
||||
self.addEventListener('activate', function(event) { |
||||
event.waitUntil( |
||||
caches.keys().then(function(cacheNames) { |
||||
return Promise.all( |
||||
cacheNames.map(function(cacheName) { |
||||
if (cacheName !== CACHE_NAME) { |
||||
return caches.delete(cacheName); |
||||
} |
||||
}) |
||||
); |
||||
}) |
||||
); |
||||
}); |
||||
``` |
||||
|
||||
### **Option 4: Add Cache Headers** |
||||
In your Plesk Apache config for Jumble, add: |
||||
|
||||
```apache |
||||
# Prevent service worker from caching SSL-sensitive content |
||||
Header always set Cache-Control "no-cache, no-store, must-revalidate" |
||||
Header always set Pragma "no-cache" |
||||
Header always set Expires "0" |
||||
|
||||
# Only for service worker file |
||||
<Files "sw.js"> |
||||
Header always set Cache-Control "no-cache, no-store, must-revalidate" |
||||
</Files> |
||||
``` |
||||
|
||||
## 🧹 **Immediate User Fix** |
||||
|
||||
For users experiencing the certificate issue: |
||||
|
||||
1. **Clear browser data** for jumble.imwald.eu |
||||
2. **Unregister service worker**: |
||||
- F12 → Application → Service Workers → Unregister |
||||
3. **Hard refresh**: Ctrl+Shift+R |
||||
4. **Or use incognito mode** to test |
||||
|
||||
--- |
||||
|
||||
This will prevent the service worker from serving stale certificate data. |
||||
@ -0,0 +1,109 @@
@@ -0,0 +1,109 @@
|
||||
# WebSocket Connection Debug Guide |
||||
|
||||
## 🚨 **Current Issue** |
||||
`wss://orly-relay.imwald.eu/` returns `NS_ERROR_WEBSOCKET_CONNECTION_REFUSED` |
||||
|
||||
## 🔍 **Debug Steps** |
||||
|
||||
### **Step 1: Verify Relay is Running** |
||||
```bash |
||||
# On your server |
||||
curl -I http://127.0.0.1:7777 |
||||
# Should return: HTTP/1.1 426 Upgrade Required |
||||
|
||||
docker ps | grep stella |
||||
# Should show running container |
||||
``` |
||||
|
||||
### **Step 2: Test Apache Modules** |
||||
```bash |
||||
# Check if WebSocket modules are enabled |
||||
apache2ctl -M | grep -E "(proxy|rewrite)" |
||||
|
||||
# If missing, enable them: |
||||
sudo a2enmod proxy |
||||
sudo a2enmod proxy_http |
||||
sudo a2enmod proxy_wstunnel |
||||
sudo a2enmod rewrite |
||||
sudo a2enmod headers |
||||
sudo systemctl restart apache2 |
||||
``` |
||||
|
||||
### **Step 3: Check Apache Configuration** |
||||
```bash |
||||
# Check what Plesk generated |
||||
sudo cat /etc/apache2/plesk.conf.d/vhosts/orly-relay.imwald.eu.conf |
||||
|
||||
# Look for proxy and rewrite rules |
||||
grep -E "(Proxy|Rewrite)" /etc/apache2/plesk.conf.d/vhosts/orly-relay.imwald.eu.conf |
||||
``` |
||||
|
||||
### **Step 4: Test Direct WebSocket Connection** |
||||
```bash |
||||
# Test if the issue is Apache or the relay itself |
||||
echo '["REQ","test",{}]' | websocat ws://127.0.0.1:7777/ |
||||
|
||||
# If that works, the issue is Apache proxy |
||||
# If that fails, the issue is the relay |
||||
``` |
||||
|
||||
### **Step 5: Check Apache Error Logs** |
||||
```bash |
||||
# Watch Apache errors in real-time |
||||
sudo tail -f /var/log/apache2/error.log |
||||
|
||||
# Then try connecting to wss://orly-relay.imwald.eu/ and see what errors appear |
||||
``` |
||||
|
||||
## 🔧 **Specific Plesk Fix** |
||||
|
||||
Based on your current status, try this **exact configuration** in Plesk: |
||||
|
||||
### **Go to Apache & nginx Settings for orly-relay.imwald.eu:** |
||||
|
||||
**Clear both HTTP and HTTPS sections, then add to HTTPS:** |
||||
|
||||
```apache |
||||
# Enable proxy |
||||
ProxyRequests Off |
||||
ProxyPreserveHost On |
||||
|
||||
# WebSocket handling - the key part |
||||
RewriteEngine On |
||||
RewriteCond %{HTTP:Upgrade} =websocket [NC] |
||||
RewriteCond %{HTTP:Connection} upgrade [NC] |
||||
RewriteRule /(.*) ws://127.0.0.1:7777/$1 [P,L] |
||||
|
||||
# Fallback for regular HTTP |
||||
RewriteCond %{HTTP:Upgrade} !=websocket [NC] |
||||
RewriteRule /(.*) http://127.0.0.1:7777/$1 [P,L] |
||||
|
||||
# Headers |
||||
ProxyAddHeaders On |
||||
``` |
||||
|
||||
### **Alternative Simpler Version:** |
||||
If the above doesn't work, try just: |
||||
|
||||
```apache |
||||
ProxyPass / http://127.0.0.1:7777/ |
||||
ProxyPassReverse / http://127.0.0.1:7777/ |
||||
ProxyPass /ws ws://127.0.0.1:7777/ |
||||
ProxyPassReverse /ws ws://127.0.0.1:7777/ |
||||
``` |
||||
|
||||
## 🧪 **Testing Commands** |
||||
|
||||
```bash |
||||
# Test the WebSocket after each change |
||||
echo '["REQ","test",{}]' | websocat wss://orly-relay.imwald.eu/ |
||||
|
||||
# Check what's actually being served |
||||
curl -v https://orly-relay.imwald.eu/ 2>&1 | grep -E "(HTTP|upgrade|connection)" |
||||
``` |
||||
|
||||
## 🎯 **Expected Fix** |
||||
|
||||
The issue is likely that Apache isn't properly handling the WebSocket upgrade request. The `proxy_wstunnel` module and correct rewrite rules should fix this. |
||||
|
||||
Try the **simpler ProxyPass version first** - it's often more reliable in Plesk environments. |
||||
@ -0,0 +1,116 @@
@@ -0,0 +1,116 @@
|
||||
#!/bin/bash |
||||
# WebSocket Debug Script for Stella's Orly Relay |
||||
|
||||
echo "🔍 Debugging WebSocket Connection for orly-relay.imwald.eu" |
||||
echo "==================================================" |
||||
|
||||
echo "" |
||||
echo "📋 Step 1: Check if relay container is running" |
||||
echo "----------------------------------------------" |
||||
docker ps | grep -E "(stella|relay|orly)" || echo "❌ No relay containers found" |
||||
|
||||
echo "" |
||||
echo "📋 Step 2: Test local relay connection" |
||||
echo "--------------------------------------" |
||||
if curl -s -I http://127.0.0.1:7777 | grep -q "426"; then |
||||
echo "✅ Local relay responding correctly (HTTP 426)" |
||||
else |
||||
echo "❌ Local relay not responding correctly" |
||||
curl -I http://127.0.0.1:7777 |
||||
fi |
||||
|
||||
echo "" |
||||
echo "📋 Step 3: Check Apache modules" |
||||
echo "------------------------------" |
||||
if apache2ctl -M 2>/dev/null | grep -q "proxy_wstunnel"; then |
||||
echo "✅ proxy_wstunnel module enabled" |
||||
else |
||||
echo "❌ proxy_wstunnel module NOT enabled" |
||||
echo "Run: sudo a2enmod proxy_wstunnel" |
||||
fi |
||||
|
||||
if apache2ctl -M 2>/dev/null | grep -q "rewrite"; then |
||||
echo "✅ rewrite module enabled" |
||||
else |
||||
echo "❌ rewrite module NOT enabled" |
||||
echo "Run: sudo a2enmod rewrite" |
||||
fi |
||||
|
||||
echo "" |
||||
echo "📋 Step 4: Check Plesk Apache configuration" |
||||
echo "------------------------------------------" |
||||
if [ -f "/etc/apache2/plesk.conf.d/vhosts/orly-relay.imwald.eu.conf" ]; then |
||||
echo "✅ Plesk config file exists" |
||||
echo "Current proxy configuration:" |
||||
grep -E "(Proxy|Rewrite|proxy|rewrite)" /etc/apache2/plesk.conf.d/vhosts/orly-relay.imwald.eu.conf || echo "❌ No proxy/rewrite rules found" |
||||
else |
||||
echo "❌ Plesk config file not found" |
||||
fi |
||||
|
||||
echo "" |
||||
echo "📋 Step 5: Test WebSocket connections" |
||||
echo "------------------------------------" |
||||
|
||||
# Test with curl first (simpler) |
||||
echo "Testing HTTP upgrade request to local relay..." |
||||
if curl -s -I -H "Connection: Upgrade" -H "Upgrade: websocket" http://127.0.0.1:7777 | grep -q "426\|101"; then |
||||
echo "✅ Local relay accepts upgrade requests" |
||||
else |
||||
echo "❌ Local relay doesn't accept upgrade requests" |
||||
fi |
||||
|
||||
echo "Testing HTTP upgrade request to remote relay..." |
||||
if curl -s -I -H "Connection: Upgrade" -H "Upgrade: websocket" https://orly-relay.imwald.eu | grep -q "426\|101"; then |
||||
echo "✅ Remote relay accepts upgrade requests" |
||||
else |
||||
echo "❌ Remote relay doesn't accept upgrade requests" |
||||
echo "This indicates Apache proxy issue" |
||||
fi |
||||
|
||||
# Try to install websocat if not available |
||||
if ! command -v websocat >/dev/null 2>&1; then |
||||
echo "" |
||||
echo "📥 Installing websocat for proper WebSocket testing..." |
||||
if wget -q https://github.com/vi/websocat/releases/download/v1.12.0/websocat.x86_64-unknown-linux-musl -O websocat 2>/dev/null; then |
||||
chmod +x websocat |
||||
echo "✅ websocat installed" |
||||
else |
||||
echo "❌ Could not install websocat (no internet or wget issue)" |
||||
echo "Manual install: wget https://github.com/vi/websocat/releases/download/v1.12.0/websocat.x86_64-unknown-linux-musl -O websocat && chmod +x websocat" |
||||
fi |
||||
fi |
||||
|
||||
# Test with websocat if available |
||||
if command -v ./websocat >/dev/null 2>&1; then |
||||
echo "" |
||||
echo "Testing actual WebSocket connection..." |
||||
echo "Local WebSocket test:" |
||||
timeout 3 bash -c 'echo "[\"REQ\",\"test\",{}]" | ./websocat ws://127.0.0.1:7777/' 2>/dev/null || echo "❌ Local WebSocket failed" |
||||
|
||||
echo "Remote WebSocket test (ignoring SSL):" |
||||
timeout 3 bash -c 'echo "[\"REQ\",\"test\",{}]" | ./websocat --insecure wss://orly-relay.imwald.eu/' 2>/dev/null || echo "❌ Remote WebSocket failed" |
||||
fi |
||||
|
||||
echo "" |
||||
echo "📋 Step 6: Check ports and connections" |
||||
echo "------------------------------------" |
||||
echo "Ports listening on 7777:" |
||||
netstat -tlnp 2>/dev/null | grep :7777 || ss -tlnp 2>/dev/null | grep :7777 || echo "❌ No process listening on port 7777" |
||||
|
||||
echo "" |
||||
echo "📋 Step 7: Test SSL certificate" |
||||
echo "------------------------------" |
||||
echo "Certificate issuer:" |
||||
echo | openssl s_client -connect orly-relay.imwald.eu:443 -servername orly-relay.imwald.eu 2>/dev/null | openssl x509 -noout -issuer 2>/dev/null || echo "❌ SSL test failed" |
||||
|
||||
echo "" |
||||
echo "🎯 RECOMMENDED NEXT STEPS:" |
||||
echo "=========================" |
||||
echo "1. If proxy_wstunnel is missing: sudo a2enmod proxy_wstunnel && sudo systemctl restart apache2" |
||||
echo "2. If no proxy rules found: Add configuration in Plesk Apache & nginx Settings" |
||||
echo "3. If local WebSocket fails: Check if relay container is actually running" |
||||
echo "4. If remote WebSocket fails but local works: Apache proxy configuration issue" |
||||
echo "" |
||||
echo "🔧 Try this simple Plesk configuration:" |
||||
echo "ProxyPass / http://127.0.0.1:7777/" |
||||
echo "ProxyPassReverse / http://127.0.0.1:7777/" |
||||
@ -0,0 +1,93 @@
@@ -0,0 +1,93 @@
|
||||
# Docker Compose for Stella's Nostr Relay |
||||
# Owner: npub1v30tsz9vw6ylpz63g0a702nj3xa26t3m7p5us8f2y2sd8v6cnsvq465zjx |
||||
|
||||
version: '3.8' |
||||
|
||||
services: |
||||
stella-relay: |
||||
image: silberengel/orly-relay:latest |
||||
container_name: stella-nostr-relay |
||||
restart: unless-stopped |
||||
ports: |
||||
- "127.0.0.1:7777:7777" |
||||
volumes: |
||||
- relay_data:/data |
||||
- ./profiles:/profiles:ro |
||||
environment: |
||||
# Relay Configuration |
||||
- ORLY_DATA_DIR=/data |
||||
- ORLY_LISTEN=0.0.0.0 |
||||
- ORLY_PORT=7777 |
||||
- ORLY_LOG_LEVEL=info |
||||
- ORLY_MAX_CONNECTIONS=1000 |
||||
- ORLY_OWNERS=npub1v30tsz9vw6ylpz63g0a702nj3xa26t3m7p5us8f2y2sd8v6cnsvq465zjx |
||||
- ORLY_ADMINS=npub1v30tsz9vw6ylpz63g0a702nj3xa26t3m7p5us8f2y2sd8v6cnsvq465zjx,npub1l5sga6xg72phsz5422ykujprejwud075ggrr3z2hwyrfgr7eylqstegx9z |
||||
|
||||
# Performance Settings (based on v0.4.8 optimizations) |
||||
- ORLY_CONCURRENT_WORKERS=0 # 0 = auto-detect CPU cores |
||||
- ORLY_BATCH_SIZE=1000 |
||||
- ORLY_CACHE_SIZE=10000 |
||||
|
||||
# Database Settings |
||||
- BADGER_LOG_LEVEL=ERROR |
||||
- BADGER_SYNC_WRITES=false # Better performance, slightly less durability |
||||
|
||||
# Security Settings |
||||
- ORLY_REQUIRE_AUTH=false |
||||
- ORLY_MAX_EVENT_SIZE=65536 |
||||
- ORLY_MAX_SUBSCRIPTIONS=20 |
||||
|
||||
healthcheck: |
||||
test: ["CMD", "curl", "-f", "http://localhost:7777"] |
||||
interval: 30s |
||||
timeout: 10s |
||||
retries: 3 |
||||
start_period: 10s |
||||
|
||||
# Resource limits |
||||
deploy: |
||||
resources: |
||||
limits: |
||||
memory: 1G |
||||
cpus: '1.0' |
||||
reservations: |
||||
memory: 256M |
||||
cpus: '0.25' |
||||
|
||||
# Logging configuration |
||||
logging: |
||||
driver: "json-file" |
||||
options: |
||||
max-size: "10m" |
||||
max-file: "3" |
||||
|
||||
# Optional: Nginx reverse proxy for SSL/domain setup |
||||
nginx: |
||||
image: nginx:alpine |
||||
container_name: stella-nginx |
||||
restart: unless-stopped |
||||
ports: |
||||
- "80:80" |
||||
- "443:443" |
||||
volumes: |
||||
- ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro |
||||
- ./nginx/ssl:/etc/nginx/ssl:ro |
||||
- nginx_logs:/var/log/nginx |
||||
depends_on: |
||||
- stella-relay |
||||
profiles: |
||||
- proxy # Only start with: docker-compose --profile proxy up |
||||
|
||||
volumes: |
||||
relay_data: |
||||
driver: local |
||||
driver_opts: |
||||
type: none |
||||
o: bind |
||||
device: ./data |
||||
nginx_logs: |
||||
driver: local |
||||
|
||||
networks: |
||||
default: |
||||
name: stella-relay-network |
||||
@ -0,0 +1,39 @@
@@ -0,0 +1,39 @@
|
||||
[Unit] |
||||
Description=Stella's Orly Nostr Relay |
||||
Documentation=https://github.com/Silberengel/next.orly.dev |
||||
After=network-online.target |
||||
Wants=network-online.target |
||||
|
||||
[Service] |
||||
Type=simple |
||||
User=madmin |
||||
Group=madmin |
||||
WorkingDirectory=/home/madmin/Projects/GitCitadel/next.orly.dev |
||||
ExecStart=docker compose up stella-relay |
||||
ExecStop=docker compose down |
||||
Restart=always |
||||
RestartSec=10 |
||||
TimeoutStartSec=60 |
||||
TimeoutStopSec=30 |
||||
|
||||
# Environment variables |
||||
Environment=ORLY_DATA_DIR=/home/madmin/.local/share/orly-relay |
||||
Environment=ORLY_LISTEN=127.0.0.1 |
||||
Environment=ORLY_PORT=7777 |
||||
Environment=ORLY_LOG_LEVEL=info |
||||
Environment=ORLY_OWNERS=npub1v30tsz9vw6ylpz63g0a702nj3xa26t3m7p5us8f2y2sd8v6cnsvq465zjx |
||||
Environment=ORLY_ADMINS=npub1v30tsz9vw6ylpz63g0a702nj3xa26t3m7p5us8f2y2sd8v6cnsvq465zjx,npub1l5sga6xg72phsz5422ykujprejwud075ggrr3z2hwyrfgr7eylqstegx9z |
||||
|
||||
# Security settings |
||||
NoNewPrivileges=true |
||||
ProtectSystem=strict |
||||
ProtectHome=read-only |
||||
ReadWritePaths=/home/madmin/.local/share/orly-relay |
||||
ReadWritePaths=/home/madmin/Projects/GitCitadel/next.orly.dev/data |
||||
|
||||
# Resource limits |
||||
LimitNOFILE=65536 |
||||
LimitNPROC=4096 |
||||
|
||||
[Install] |
||||
WantedBy=multi-user.target |
||||
Loading…
Reference in new issue